On Tue, Aug 08, 2017 at 11:52:04AM +0100, Mark Rutland wrote: > Hi, > > As a heads-up, I hit the below splat when using Syzkaller to fuzz arm64 > VMAP_STACK patches [1] atop of v4.13-rc3. I haven't hit anything else > major, and so far I haven't had any luck reproducing this, so it may be > an existing issue that's difficult to hit. > > Note that while reported as a BUG(), it's actually the WARN_ON_ONCE() > introduced in commit: > > 65d8fc777f6dcfee ("futex: Remove requirement for lock_page() in > get_futex_key()") > > ... misreported as I accidentally throw away the flags in __BUG_FLAGS(). > Other than that, I believe BUG() and friends are working correctly. > > The Syzkaller log is huge (1.0M), so rather than attaching it, I've > uploaded the log, report, and kernel config to: > > http://data.yaey.co.uk/bugs/20170808-futex-bug/ > > I'll continue trying to reproduce and minimize this.
AFAICT, get_futex_key() can race with an mmap() changing the page in question, whereupon things go wrong. So I believe we need to restore some of the page locking in get_futex_key(). The below test case fires for me in a few seconds on an arm64 platform, triggering the kernel BUG at kernel/futex.c:679. If left running for longer, I then get a stream of other BUGs that I believe are a result of the first issue. Thanks, Mark. ---->8---- #include <linux/futex.h> #include <pthread.h> #include <stdio.h> #include <stdlib.h> #include <sys/mman.h> #include <sys/syscall.h> #include <sys/time.h> #include <unistd.h> #define NR_FUTEX_THREADS 16 pthread_t threads[NR_FUTEX_THREADS]; void *mem; #define MEM_PROT (PROT_READ | PROT_WRITE) #define MEM_SIZE 65536 static int futex_wrapper(int *uaddr, int op, int val, const struct timespec *timeout, int *uaddr2, int val3) { syscall(SYS_futex, uaddr, op, val, timeout, uaddr2, val3); } void *poll_futex(void *unused) { for (;;) { futex_wrapper(mem, FUTEX_CMP_REQUEUE_PI, 1, NULL, mem + 4, 1); } } int main(int argc, char *argv[]) { int i; mem = mmap(NULL, MEM_SIZE, MEM_PROT, MAP_SHARED | MAP_ANONYMOUS, -1, 0); printf("Mapping @ %p\n", mem); printf("Creating futex threads...\n"); for (i = 0; i < NR_FUTEX_THREADS; i++) pthread_create(&threads[i], NULL, poll_futex, NULL); printf("Flipping mapping...\n"); for (;;) { mmap(mem, MEM_SIZE, MEM_PROT, MAP_FIXED | MAP_SHARED | MAP_ANONYMOUS, -1, 0); } return 0; }