Re: kernel BUG in memory_bm_free

[Dmitry Vyukov]

On Wed, Feb 3, 2021 at 6:59 AM syzbot
<syzbot+5ecbe63baca437585bd4@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    3aaf0a27 Merge tag 'clang-format-for-linux-v5.11-rc7' of g..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17ef6108d00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=10152c2ea16351e7
> dashboard link: https://syzkaller.appspot.com/bug?extid=5ecbe63baca437585bd4
> userspace arch: arm64
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+5ecbe63baca437585bd4@xxxxxxxxxxxxxxxxxxxxxxxxx

The BUG is:
BUG_ON(!virt_addr_valid(addr));

#syz fix: arm64: Do not pass tagged addresses to __is_lm_address()

> ------------[ cut here ]------------
> kernel BUG at kernel/power/snapshot.c:257!
> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
> Modules linked in:
> CPU: 1 PID: 2394 Comm: syz-executor.0 Not tainted 5.11.0-rc6-syzkaller-00055-g3aaf0a27ffc2 #0
> Hardware name: linux,dummy-virt (DT)
> pstate: 20400009 (nzCv daif +PAN -UAO -TCO BTYPE=--)
> pc : free_image_page kernel/power/snapshot.c:257 [inline]
> pc : free_image_page kernel/power/snapshot.c:253 [inline]
> pc : free_list_of_pages kernel/power/snapshot.c:274 [inline]
> pc : memory_bm_free+0x260/0x320 kernel/power/snapshot.c:726
> lr : free_basic_memory_bitmaps+0x3c/0x90 kernel/power/snapshot.c:1173
> sp : ffff8000163dbc50
> x29: ffff8000163dbc50 x28: f4ff000025204070
> x27: ffff800012d4c000 x26: f4ff000025204008
> x25: f5ff00002827c700 x24: ffff800012d4c000
> x23: 00007fffffffffff x22: f4ff000025204018
> x21: 0000000000000001 x20: ffff800013b576d0
> x19: f5ff00002827c700 x18: 0000000000000000
> x17: 0000000000000000 x16: 0000000000000000
> x15: 0000000000000000 x14: 0000000000000000
> x13: 0000000000000000 x12: 0000000000000000
> x11: 0000000000000000 x10: 0000000000000000
> x9 : fcff000025205400 x8 : 0000000000000002
> x7 : f6ff000025205000 x6 : 00000000000001ff
> x5 : 0000000000000000 x4 : 0000000000000000
> x3 : ffff800013b576d0 x2 : f4ff00002517e000
> x1 : 0000000000000001 x0 : 0b0000002517e000
> Call trace:
>  free_image_page kernel/power/snapshot.c:257 [inline]
>  free_list_of_pages kernel/power/snapshot.c:274 [inline]
>  memory_bm_free+0x260/0x320 kernel/power/snapshot.c:726
>  free_basic_memory_bitmaps+0x3c/0x90 kernel/power/snapshot.c:1173
>  snapshot_release+0x74/0x90 kernel/power/user.c:120
>  __fput+0x78/0x230 fs/file_table.c:280
>  ____fput+0x10/0x20 fs/file_table.c:313
>  task_work_run+0x80/0x160 kernel/task_work.c:140
>  tracehook_notify_resume include/linux/tracehook.h:189 [inline]
>  do_notify_resume+0x20c/0x13e0 arch/arm64/kernel/signal.c:939
>  work_pending+0xc/0x3d4
> Code: cb000260 d34cfc00 97fcf6fe 35fffc20 (d4210000)
> ---[ end trace 174c294156b0dfb3 ]---
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.