From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 01034C54E5D for ; Mon, 18 Mar 2024 21:33:06 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6537C6B0092; Mon, 18 Mar 2024 17:33:06 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 602A66B0093; Mon, 18 Mar 2024 17:33:06 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4A33D6B0096; Mon, 18 Mar 2024 17:33:06 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 3A39C6B0092 for ; Mon, 18 Mar 2024 17:33:06 -0400 (EDT) Received: from smtpin10.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 0AFDDA0C61 for ; Mon, 18 Mar 2024 21:33:06 +0000 (UTC) X-FDA: 81911460372.10.33E6133 Received: from mail-qt1-f171.google.com (mail-qt1-f171.google.com [209.85.160.171]) by imf09.hostedemail.com (Postfix) with ESMTP id BFE48140022 for ; Mon, 18 Mar 2024 21:33:03 +0000 (UTC) Authentication-Results: imf09.hostedemail.com; dkim=pass header.d=cmpxchg-org.20230601.gappssmtp.com header.s=20230601 header.b=p9xbLhOL; dmarc=pass (policy=none) header.from=cmpxchg.org; spf=pass (imf09.hostedemail.com: domain of hannes@cmpxchg.org designates 209.85.160.171 as permitted sender) smtp.mailfrom=hannes@cmpxchg.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1710797584; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=mGPv8yamP9bphcl7rsqbJVKUCn1NBYwIxJacintSX4E=; b=Dh3FtixjDxRmxVBaM6EJa9QXcHCzSk8aswrxUgID/u6JlMMAIqDw4AoDgJn8uvqG0G0rek z4B3/MTr5bLjKQ4m+0JAk1r2l+B5mwpK57jI5iNrF4XU+J8FIUNU9uo35s98BPtiME9fAr mzXxZl3u4NhzfKpbcOXWWjZXiV1edGg= ARC-Authentication-Results: i=1; imf09.hostedemail.com; dkim=pass header.d=cmpxchg-org.20230601.gappssmtp.com header.s=20230601 header.b=p9xbLhOL; dmarc=pass (policy=none) header.from=cmpxchg.org; spf=pass (imf09.hostedemail.com: domain of hannes@cmpxchg.org designates 209.85.160.171 as permitted sender) smtp.mailfrom=hannes@cmpxchg.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1710797584; a=rsa-sha256; cv=none; b=Rg0MjLV6cLojx05krAIrxorTxGIyzyUMiIXNkRzGcTlaPgdZ0um+5aNkp6qFqhAiZ9lk2p yGx+khNAXZLXkT1vxY6tdPHqo/BfeSBMYBrDySIrB0n8Eiy7jwhA7XPosY6s5L1rX9o+aa 3n+xmBQ++wxGNWBbxttelqH69qLgGws= Received: by mail-qt1-f171.google.com with SMTP id d75a77b69052e-430c4d0408eso12140471cf.3 for ; Mon, 18 Mar 2024 14:33:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cmpxchg-org.20230601.gappssmtp.com; s=20230601; t=1710797583; x=1711402383; darn=kvack.org; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date:from:to :cc:subject:date:message-id:reply-to; bh=mGPv8yamP9bphcl7rsqbJVKUCn1NBYwIxJacintSX4E=; b=p9xbLhOLZ07DMf5PfNKkR/+52BS4cCuow7Oro5Ce0xXED8su8Fq4yiwxwmxKXpD7eQ UXrXMH33W7GUZ2RDzSsoiIghgFaq9pILF28plYQphTne7ZukQB56j/PqoO3RdDzqesWg /sPUpUY8kZKEnbtO3poVtuiVB0MxqR2jgeSUYimTpFuv/YQW2ci8ZVTJWrScPNqc6GUW pktdL4UXlgFgzrBryIxXK9cxjLbPe3umQRN/YDLnC3C1Wol3BxAlcjE8jFVx57/4MFdz wubNMcNMJ37dVwZAkB8zUtnrmaru4ctPbnom8S7hj6i9BmqvmI4ZbQ2eiYT0PqQQPyL0 521w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710797583; x=1711402383; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=mGPv8yamP9bphcl7rsqbJVKUCn1NBYwIxJacintSX4E=; b=Tly47nthR9cV+quhhvnA9PSnLxlE2cigQq2KC0N4/G37v8v1R+gijPSSc7OXFRRRxZ YeXeX0CbYBiFIM+x4mw8QKvyIRiWC24IV5Vq1XxcfzXBXC9HceyJfoMhk2CppyyDT29U D3hQK5LpPIzQqYtCLw4AkLaeG7QnSr2LMLz384qbIvybSegKMIy9w5t/FLH5dg3aALOE w87jXO//cFt7rTd/HDMQJujrwbuENIw/RZbwt4pl5amWaoLHOFxWOXeNp8Iu8iE0tkqr 4NJzoHnArSGXfSFCp41kSwUxztLozIF10tce6AsGMYRTTvznjY+dXpT5PLzZ4tBYbd5S xEjQ== X-Forwarded-Encrypted: i=1; AJvYcCUTyaKcTtsvPfmYaFMmdtTF41GVwIRLLJYxisfxnXc2louTTcJ5aRJNw/w6FIx9mgM1UfgV39WCQau5i8ENKkALDYA= X-Gm-Message-State: AOJu0Yw4R4O3YUtu27TGwkwpraVYaIUsdN7jX5XUZkyrsqD74+4AZsyl uenf9OcuGzYgVbtXr7BLsmx1+53ePgRzUP1NF73ctZRkHhntxW+sB73KI7/s66E= X-Google-Smtp-Source: AGHT+IHy9RlxCISU3kmenwXlDWSWKdj/pdGdU/FQ7uGUX7Pn1QHqJCVyLWVjT1NiurJWUrhsxjcsvQ== X-Received: by 2002:ac8:7e96:0:b0:430:e2a3:f80c with SMTP id w22-20020ac87e96000000b00430e2a3f80cmr696515qtj.31.1710797582770; Mon, 18 Mar 2024 14:33:02 -0700 (PDT) Received: from localhost (2603-7000-0c01-2716-da5e-d3ff-fee7-26e7.res6.spectrum.com. [2603:7000:c01:2716:da5e:d3ff:fee7:26e7]) by smtp.gmail.com with ESMTPSA id ay29-20020a05622a229d00b00430b385f721sm3924923qtb.15.2024.03.18.14.33.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 Mar 2024 14:33:02 -0700 (PDT) Date: Mon, 18 Mar 2024 17:32:57 -0400 From: Johannes Weiner To: Barry Song <21cnbao@gmail.com> Cc: Yosry Ahmed , Nhat Pham , syzbot , akpm@linux-foundation.org, chengming.zhou@linux.dev, linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com, Barry Song Subject: Re: [syzbot] [mm?] kernel BUG in sg_init_one Message-ID: <20240318213257.GB4210@cmpxchg.org> References: <000000000000bbb3d80613f243a6@google.com> <20240318210917.GA4210@cmpxchg.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Rspamd-Queue-Id: BFE48140022 X-Rspam-User: X-Rspamd-Server: rspam02 X-Stat-Signature: 8ftjcqyp3cytitzx58f43bwfa4otgsyy X-HE-Tag: 1710797583-19153 X-HE-Meta: U2FsdGVkX19HLm5okoVT3kQmeJHjXR1q88NPs1YjCOfH9eLm2r7/lt1x/cDJIIRreuD+8dgqbiBiUDQGzU50k7GZAi4CGOD7UQRJ9zvhJ5nzI1cr8oeMFiQ75CiI819fEWDUopsTTBfUNklEzicsXCaoLehZlreLYj9M5vc4pEzFoB05Wf3YMwc+wDyxe15buVY01gK98+zgg8LSMIWp0rkwwR1iGmAi3kV24K4QHawoyeWivXszfMmluO3ss++VRhcTptyMqh/BQnQMtc8UJgP4Wh/okkozzqxc/uSjrArHfKjPBHPJsQOIuH8oX8Eo6z91nKkj5Ru88qNT2B4GlJOqmzT8EvF0W/fQObIGaRBSwTLyTD4Qsml3qK7YPa4tz2JuzSyKpqP5HZF5bTUf7zv6DfFUvVfUaFd2FvrEHElYWo/gB5pWtNS3ILw25922CCLV8StG7UqxBTO8Jx3DZm8p5nYjshdt+TId9T2J63iVDZZZQ3SSUlNt1Yg3wsnDrEG0LQ+HIj8HjMi5CW4PQlJCJxgrENd3CPAr6qM68qt5x3ef1PraB47OC3/g4HBTn8nAmlMkGaQwpI43DD6WeGIaEBSXx8SU0Dk2p/nKJO3+MQgBzIseDPwqAq+yJ8aSu0cWtO/PZYuG5sQRfURSIA++h61O/UX1HXPIGn/Kdn7cNBhDR1Bs+MbToqadNpRxTufnDJ2+jmpOoP9Asuh1DRMFlX3SO5XGxpW1KHIIbZw8wbo7SK6icvQSw89gzQa0gPjhdS/HN7/KXQUudJPB5j0tAN3FYMjfAGFbWCbQUMc8mlV/I4LnaIzthzjRHqS/B4X/siiCGlbgeOPn/JIYodqj+Tu8zjwsMPJi2GecbOb1mZmoa3WkTv5t/JRsp0aiRQAiuM10oAoR21CCQnkqqm3YSRGJ+9Na0eqh1vBuOr2lDHGBzPxv9wRuY54glg61S6Ux5w9eWMnTNDpJkYm ZmuSX18C caEt+yzb5PWEUk2dyczF4QNJIc182n+sCBM6xz03YaCxNnN3WmsbL5IbU2SYCD+pgt9DQ8mN65Q9pjD2TBnH2YTcRDt0QzLoSCOvia+87n6Q7Pps2m934xfaKKgb6MI65XeiQp/Evpqk7fNQbQj/XpNtzTb1eGvqFHtM86ZQ+P6nTQ3dIf2JHNIT2s/KScVCiGBBiiwnrRweNncTMI1x++bRzWpo0jJikeUhHm5mhP97ubJ3ET9Q6ELMLdTPdRtp76EpHIzsiNcafWXSVYJD0Tj5TfRLyUB/lo4h1KFam88m4glkUooEngA65Lmdvmmb1lHfEgMgXSfvgX38LXDsDDEYLaP/U8FoF9ZvfoZZz5SCRILyVcDZxtaXbw3LpQtDdpNUFkEZkYTQTD+tZoiCsr1x9unZ+1mX5/7isdQpsMAJlYNVpj//t1UlO1sBQ/878EhQB0TQFN9XYL2Hy5pXOcbShSmsJ0CYE8P12eDLE+Pzr4NUjq//mnvyukgfmfR49Zlrmv+R3/ClTaNRYqTCkO1huegQrmvt34lLMXa225pZ9G7ZQaahWTbwXCuWirH2CSTZjPPNzSkpY7WXNCg5id2DdDeM2HPc+Vp8mcbL0M2z+yshPPcQ5jDgvjABsnDM6p8CiTBtkldz+lk/iAYb7WI/7IT4sSx6DKGVq8HicrmY6gcjd+re/KZL91+QGSB+qRMCQOJC/YSI3PC6c+IgMQBmzp3YbaFOpW9eSPEm33HuQyffBQ3MVDQoEoVZsAjcF4k+tx0hc2C4/nOI6NHJH9a9hpyRXH8gjga0JGx8Ae8Zn2QwgsAUkGb7prpxXlHwEWDCW4gVJ+7IhJO5vk8UjsM/NXTi/p2Gm359Hi/5lxkCxU4UxLq2y/IVh4q8MHwxQTizgOPI19VBW07T6bgt+AoWdsnZuUMTdAhm0ixClabHmoJeotaKanN+V+n0SxRbwVQ8aha7gwD7rQtlWIpA72Mg/I+Ko fdyggobt 17uZYDKP8NgmM600lJ9MA+yUhqLZsttIrdz4SNysvGNxiSqR86Ziu3IOP/EUkOHctg0MJwPfVjVKGPk5tOjaFm4ulTH07pkTyiw1b/sW3vgGwdkUayGizSRvOtkRvhkn0N9AzdhjfKrinofSB6JgKA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Tue, Mar 19, 2024 at 10:15:43AM +1300, Barry Song wrote: > On Tue, Mar 19, 2024 at 10:10 AM Johannes Weiner wrote: > > > > On Mon, Mar 18, 2024 at 01:17:19PM -0700, Yosry Ahmed wrote: > > > On Mon, Mar 18, 2024 at 11:00 AM Nhat Pham wrote: > > > > > > > > On Mon, Mar 18, 2024 at 9:58 AM syzbot > > > > wrote: > > > > > > > > > > Hello, > > > > > > > > > > syzbot found the following issue on: > > > > > > > > > > HEAD commit: e5eb28f6d1af Merge tag 'mm-nonmm-stable-2024-03-14-09-36' .. > > > > > git tree: upstream > > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=13043abe180000 > > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=19bb57c23dffc38e > > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=adbc983a1588b7805de3 > > > > > compiler: arm-linux-gnueabi-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 > > > > > userspace arch: arm > > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1706d231180000 > > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13ba7959180000 > > > > > > > > > > Downloadable assets: > > > > > disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/8ead8862021c/non_bootable_disk-e5eb28f6.raw.xz > > > > > vmlinux: https://storage.googleapis.com/syzbot-assets/0a7371c63ff2/vmlinux-e5eb28f6.xz > > > > > kernel image: https://storage.googleapis.com/syzbot-assets/7539441b4add/zImage-e5eb28f6.xz > > > > > > > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > > > > Reported-by: syzbot+adbc983a1588b7805de3@syzkaller.appspotmail.com > > > > > > > > > > ------------[ cut here ]------------ > > > > > kernel BUG at include/linux/scatterlist.h:187! > > > > > > > > Looks like the provided buffer is invalid: > > > > > > > > #ifdef CONFIG_DEBUG_SG > > > > BUG_ON(!virt_addr_valid(buf)); > > > > #endif > > > > > > > > which is "src" from: > > > > > > > > sg_init_one(&input, src, entry->length); > > > > > > > > Looking at the surrounding code and recent history, there's this > > > > commit that stands out: > > > > > > > > mm/zswap: remove the memcpy if acomp is not sleepable > > > > (sha: 270700dd06ca41a4779c19eb46608f076bb7d40e) > > > > > > > > which has the effect of, IIUC, using the zpool mapped memory directly > > > > as src, instead of acomp_ctx->buffer (which was previously the case, > > > > as zsmalloc was not sleepable). > > > > > > > > This might not necessarily be a bug with that commit itself, but might > > > > have revealed another bug elsewhere. > > > > > > > > Anyway, cc-ing the author, Barry Song, to fact check me :) Will take a > > > > closer look later. > > > > > > I am not a highmem expert, but the reproducer has CONFIG_HIGHMEM=y, > > > and it seems like zs_map_object() may return a highmem address if the > > > compressed object is entirely in a single page to avoid copying to a > > > buffer: > > > > > > if (off + class->size <= PAGE_SIZE) { > > > /* this object is contained entirely within a page */ > > > area->vm_addr = kmap_atomic(page); > > > ret = area->vm_addr + off; > > > goto out; > > > } > > > > > > The virt_addr_valid() check seems to indicate that we expect a direct > > > map address in sg_init_one(), right? > > > > If the page is highmem, kmap_atomic() establishes a temporary mapping > > to it in the direct map, such that we have a legit kernel pointer to > > the memory. Otherwise the memcpy() in zswap also wouldn't work... Am I > > missing something? > > Right, we built a map but it is not a linear mapping. so we can't use > virt_to_page > on this kind of non-linear mapping. > kmap_to_page can handle both linear and non-linear, but Ira's commit > added a WARN_ON_ONCE in it for non-linear mapping case. Ah, I misread what virt_addr_valid() does. It actually excludes kmap. Which, yes, makes sense, if the next line does virt_to_page()... Sorry about the noise.