Messages in this thread | | | From | Andrey Konovalov <> | Date | Tue, 6 Sep 2022 16:39:57 +0200 | Subject | Re: [syzbot] KASAN: invalid-access Read in copy_page |
| |
On Tue, Sep 6, 2022 at 4:29 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > > > Does it take long to reproduce this kasan warning? > > > > syzbot finds several such cases every day (200 crashes for the past 35 days): > > https://syzkaller.appspot.com/bug?extid=c2c79c6d6eddc5262b77 > > So once it reaches the tested tree, we should have an answer within a day.
To be specific, this syzkaller instance fuzzes the mainline, so the patch with the WARN_ON needs to end up there.
If this is unacceptable, perhaps, we could switch the MTE syzkaller instance to the arm64 testing tree.
> That's good to know. BTW, does syzkaller write tags in mmap'ed pages or > only issues random syscalls?
syzkaller doesn't write tags. Or, at least, shouldn't. Theoretically it could come up with same way to generate instructions that write tags, but this is unlikely.
> I'm trying to figure out whether tag 0xf2 > was written by the kernel without updating the corresponding > page_kasan_tag() or it was syzkaller recolouring the page.
Just in case, I want to point out that the kasantag == 0xa from the page flags matches the pointer tag 0xf5 in the report. The tag value is stored bitwise-inverted in the page flags. Not that this matters in this case though.
| |