Re: general protection fault in get_futex_key

[Peter Xu]

On Wed, Apr 08, 2020 at 03:36:45PM +0200, Thomas Gleixner wrote:
> syzbot <syzbot+a95c7753605c9d219466@xxxxxxxxxxxxxxxxxxxxxxxxx> writes:
> > syzbot found the following crash on:
> >
> > HEAD commit:    763dede1 Merge tag 'for-linus-5.7-rc1' of git://git.kernel..
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=136a055de00000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=12205d036cec317f
> > dashboard link: https://syzkaller.appspot.com/bug?extid=a95c7753605c9d219466
> > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1578287de00000
> >
> > The bug was bisected to:
> >
> > commit 4426e945df588f2878affddf88a51259200f7e29
> > Author: Peter Xu <peterx@xxxxxxxxxx>
> > Date:   Thu Apr 2 04:08:49 2020 +0000
> >
> >     mm/gup: allow VM_FAULT_RETRY for multiple times
> >
> > bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1707878fe00000
> > final crash:    https://syzkaller.appspot.com/x/report.txt?x=1487878fe00000
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1087878fe00000
> >
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+a95c7753605c9d219466@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Fixes: 4426e945df58 ("mm/gup: allow VM_FAULT_RETRY for multiple times")
> >
> > general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN
> > KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
> > CPU: 1 PID: 8869 Comm: syz-executor.1 Not tainted 5.6.0-syzkaller #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> > RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline]
> > RIP: 0010:compound_head include/linux/page-flags.h:174 [inline]
> > RIP: 0010:get_futex_key+0x2cd/0x1670 kernel/futex.c:574
> 
> This means that
> 
>      get_user_pages_fast(address, 1, FOLL_WRITE, &page)
> 
> returned 0, which is breaking the interface:
> 
>  * Returns number of pages pinned. This may be fewer than the number requested.
>  * If nr_pages is 0 or negative, returns 0. If no pages were pinned, returns
>  * -errno.
> 
> nr_pages is clearly 1. So if the call fails, the number of pinned pages
> is 0 and it should return a proper error number. It did before.
> 
> From a quick look at the commit in question I assume it's the
> 
> +               if (fatal_signal_pending(current))
> +                       break;
> 
> which can cause that to happen.

Right, sorry for the mess.

Hillf has posted a fix already in the other thread (with you CCed).
So I'm marking this one as a dup now.

#syz dup: WARNING in af_alg_make_sg

Thanks,

-- 
Peter Xu