From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.5 required=3.0 tests=FREEMAIL_FORGED_FROMDOMAIN, FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 98E59C2BB1D for ; Tue, 14 Apr 2020 04:07:34 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 48E37206D5 for ; Tue, 14 Apr 2020 04:07:34 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 48E37206D5 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=sina.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id D95A08E0003; Tue, 14 Apr 2020 00:07:33 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D20088E0001; Tue, 14 Apr 2020 00:07:33 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C0E448E0003; Tue, 14 Apr 2020 00:07:33 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0219.hostedemail.com [216.40.44.219]) by kanga.kvack.org (Postfix) with ESMTP id A50FB8E0001 for ; Tue, 14 Apr 2020 00:07:33 -0400 (EDT) Received: from smtpin03.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 65611181AEF1F for ; Tue, 14 Apr 2020 04:07:33 +0000 (UTC) X-FDA: 76705126386.03.hair58_24a86d743f63c X-HE-Tag: hair58_24a86d743f63c X-Filterd-Recvd-Size: 5387 Received: from r3-19.sinamail.sina.com.cn (r3-19.sinamail.sina.com.cn [202.108.3.19]) by imf27.hostedemail.com (Postfix) with SMTP for ; Tue, 14 Apr 2020 04:07:31 +0000 (UTC) Received: from unknown (HELO localhost.localdomain)([221.219.5.127]) by sina.com with ESMTP id 5E9536FF000005DF; Tue, 14 Apr 2020 12:07:28 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com X-SMAIL-MID: 85054215073424 From: Hillf Danton To: Qian Cai Cc: LKML , Linux-MM , Jens Axboe Subject: Re: [PATCH 0/2] mm: Two small fixes for recent syzbot reports Date: Tue, 14 Apr 2020 12:07:17 +0800 Message-Id: <20200414040717.22040-1-hdanton@sina.com> In-Reply-To: <20200410092951.6db32bfe@canb.auug.org.au> References: <20200408014010.80428-1-peterx@redhat.com> <20200408174732.bc448bbe41d190bfe5cc252e@linux-foundation.org> <20200410092951.6db32bfe@canb.auug.org.au> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, 13 Apr 2020 18:06:21 -0400 Qian Cai wrote: >=20 > BTW, I=3DE2=3D80=3D99ll be adding fuzzers to my daily linux-next routin= es =3D > where it triggers this > io_uring/scheduler bug almost immediately, so hopefully would buy syzbo= t =3D > some > time to resume on linux-next. >=20 > [67493.516737][T211750] BUG: unable to handle page fault for address: =3D > ffffffffffffffe8 > [67493.557315][T211750] #PF: supervisor read access in kernel mode > [67493.586726][T211750] #PF: error_code(0x0000) - not-present page > [67493.614434][T211750] PGD f96e17067 P4D f96e17067 PUD f96e19067 PMD 0= =3D20=3D >=20 > [67493.644846][T211750] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI > [67493.674127][T211750] CPU: 55 PID: 211750 Comm: trinity-c127 Tainted:= =3D > G B L 5.7.0-rc1-next-20200413 #4 > [67493.722516][T211750] Hardware name: HP ProLiant DL380 Gen9/ProLiant = =3D > DL380 Gen9, BIOS P89 04/12/2017 > [67493.764925][T211750] RIP: 0010:__wake_up_common+0x98/0x290 > __wake_up_common at kernel/sched/wait.c:87 > [67493.790675][T211750] Code: 40 4d 8d 78 e8 49 8d 7f 18 49 39 fd 0f 84= =3D > 80 00 00 00 e8 6b bd 2b 00 49 8b 5f 18 45 31 e4 48 83 eb 18 4c 89 ff e8= =3D > 08 bc 2b 00 <45> 8b 37 41 f6 c6 04 75 71 49 8d 7f 10 e8 46 bd 2b 00 49 = =3D > 8b 47 10 > [67493.881650][T211750] RSP: 0018:ffffc9000adbfaf0 EFLAGS: 00010046 > [67493.909854][T211750] RAX: 0000000000000000 RBX: ffffffffffffffe8 RCX= : =3D > ffffffffaa9636b8 > [67493.947131][T211750] RDX: 0000000000000003 RSI: dffffc0000000000 RDI= : =3D > ffffffffffffffe8 > [67493.983829][T211750] RBP: ffffc9000adbfb40 R08: fffffbfff582c5fd R09= : =3D > fffffbfff582c5fd > [67494.020861][T211750] R10: ffffffffac162fe3 R11: fffffbfff582c5fc R12= : =3D > 0000000000000000 > [67494.059249][T211750] R13: ffff888ef82b0960 R14: ffffc9000adbfb80 R15= : =3D > ffffffffffffffe8 > [67494.099699][T211750] FS: 00007fdcba4c4740(0000) =3D > GS:ffff889033780000(0000) knlGS:0000000000000000 > [67494.141858][T211750] CS: 0010 DS: 0000 ES: 0000 CR0: =3D > 0000000080050033 > [67494.172660][T211750] CR2: ffffffffffffffe8 CR3: 0000000f776a0004 CR4= : =3D > 00000000001606e0 > [67494.209760][T211750] Call Trace: > [67494.224720][T211750] __wake_up_common_lock+0xea/0x150 > (inlined by) __wake_up_common_lock at kernel/sched/wait.c:124 > [67494.248753][T211750] ? __wake_up_common+0x290/0x290 > [67494.272014][T211750] ? lockdep_hardirqs_on+0x16/0x2c0 > [67494.296139][T211750] __wake_up+0x13/0x20 > [67494.314946][T211750] io_cqring_ev_posted+0x75/0xe0 > (inlined by) io_cqring_ev_posted at fs/io_uring.c:1160 > [67494.337726][T211750] io_ring_ctx_wait_and_kill+0x1c0/0x2f0 > io_ring_ctx_wait_and_kill at fs/io_uring.c:7305 > [67494.363840][T211750] io_uring_create+0xa8d/0x13b0 > [67494.386526][T211750] ? io_req_defer_prep+0x990/0x990 > [67494.410119][T211750] ? __kasan_check_write+0x14/0x20 > [67494.433646][T211750] io_uring_setup+0xb8/0x130 > [67494.454870][T211750] ? io_uring_create+0x13b0/0x13b0 > [67494.478342][T211750] ? check_flags.part.28+0x220/0x220 > [67494.502947][T211750] ? lockdep_hardirqs_on+0x16/0x2c0 > [67494.526965][T211750] __x64_sys_io_uring_setup+0x31/0x40 > [67494.551820][T211750] do_syscall_64+0xcc/0xaf0 > [67494.574829][T211750] ? syscall_return_slowpath+0x580/0x580 > [67494.604591][T211750] ? lockdep_hardirqs_off+0x1f/0x140 > [67494.628901][T211750] ? entry_SYSCALL_64_after_hwframe+0x3e/0xb3 > [67494.657616][T211750] ? trace_hardirqs_off_caller+0x3a/0x150 > [67494.683999][T211750] ? trace_hardirqs_off_thunk+0x1a/0x1c > [67494.709982][T211750] entry_SYSCALL_64_after_hwframe+0x49/0xb3 See if it makes your fuzzers happy. --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -934,6 +934,7 @@ static struct io_ring_ctx *io_ring_ctx_a idr_init(&ctx->personality_idr); mutex_init(&ctx->uring_lock); init_waitqueue_head(&ctx->wait); + init_waitqueue_head(&ctx->sqo_wait); spin_lock_init(&ctx->completion_lock); INIT_LIST_HEAD(&ctx->poll_list); INIT_LIST_HEAD(&ctx->defer_list); @@ -6824,7 +6825,6 @@ static int io_sq_offload_start(struct io { int ret; =20 - init_waitqueue_head(&ctx->sqo_wait); mmgrab(current->mm); ctx->sqo_mm =3D current->mm; =20