On Wed, Jan 27, 2021 at 8:43 PM Dmitry Vyukov <[email protected]> wrote: > > > > > > > This happens on arm64 instance with mte enabled. > > > > > > > There is a GPF in reiserfs_xattr_init on x86_64 reported: > > > > > > > https://syzkaller.appspot.com/bug?id=8abaedbdeb32c861dc5340544284167dd0e46cde > > > > > > > so I would assume it's just a plain NULL deref. Is this WARNING > > > > > > > not > > > > > > > indicative of a kernel bug? Or there is something special about > > > > > > > this > > > > > > > particular NULL deref? > > > > > > > > > > > > Congratulations, you're the first person to trigger this warning! > > > > > > > > > > > > This fires if we take an unexpected data abort in the kernel but > > > > > > when we > > > > > > get into the fault handler the page-table looks ok (according to > > > > > > the CPU via > > > > > > an 'AT' instruction). Are you using QEMU system emulation? Perhaps > > > > > > its > > > > > > handling of AT isn't quite right. > > > > > > > > > > Hi Will, > > > > > > > > > > Yes, it's qemu-system-aarch64 5.2 with -machine virt,mte=on -cpu max. > > > > > Do you see any way forward for this issue? Can somehow prove/disprove > > > > > it's qemu at fault? > > > > > > > > I've reproduced this crash (by taking [1] and changing > > > > sys_memfd_create to 279), but it manifests as a normal null-ptr-deref > > > > for me. I'm using the latest QEMU master. Which QEMU does syzbot use > > > > exactly? > > > > > > qemu-system-aarch64 5.2 from this container: > > > https://github.com/google/syzkaller/blob/master/tools/docker/syzbot/Dockerfile > > > you can get a prebuilt version with: > > > docker pull gcr.io/syzkaller/syzbot > > > > Reproduced with this QEMU, still a normal null-ptr-deref. Where do I > > find the full list of arguments that are passed to QEMU on syzbot? > > I am yet to document all details of these new instances, but the > syzkaller config contains: > "qemu_args": "-machine > virt,virtualization=on,mte=on,graphics=on,usb=on -cpu max" > the rest are in vm/qemu/qemu.go
OK, the virtualization=on part is what causes this. Bug in QEMU?
