From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id B94B1C282DE for ; Thu, 13 Mar 2025 10:26:18 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3750A280003; Thu, 13 Mar 2025 06:26:16 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 323FE280001; Thu, 13 Mar 2025 06:26:16 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1ED40280003; Thu, 13 Mar 2025 06:26:16 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id F384A280001 for ; Thu, 13 Mar 2025 06:26:15 -0400 (EDT) Received: from smtpin22.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id C33235400F for ; Thu, 13 Mar 2025 10:26:16 +0000 (UTC) X-FDA: 83216147952.22.530F2FD Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by imf24.hostedemail.com (Postfix) with ESMTP id A19DC180002 for ; Thu, 13 Mar 2025 10:26:14 +0000 (UTC) Authentication-Results: imf24.hostedemail.com; dkim=none; spf=pass (imf24.hostedemail.com: domain of dev.jain@arm.com designates 217.140.110.172 as permitted sender) smtp.mailfrom=dev.jain@arm.com; dmarc=pass (policy=none) header.from=arm.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1741861575; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5DtdDGd5hNkP+WwZb04N8qhMoBUkPE+QGadmdu13D9M=; b=HfO8RhzeE6Unz67X8ajMWXj92ZqUnGkakyGHzs4zmhLCDulPHcMGcLSYUdagKJ9mH0J7UI VGnewv5fQb0mvTFxzjOxS2vvZKyJiC7pz2pFgroHiVDzaJbl8INNyGhl3lPo7E+B3KnX35 IoRWsk9lcxpC+oxyddasoif6boP9Qzo= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1741861575; a=rsa-sha256; cv=none; b=hKsAf/6zQepwFjE1su8tX669NxBKEssOEUQZtjz8XqU6XjbBl7VvxAEpameCQo+69DWGsA R9CWuoUSUPX7kGvkfX1kpx3Rn6DeBjdCbHhlkgZOFHNZpUlK3+f7c91QDD9UhXcdEf85qw YfRFGzcpCggu2UMu0f6W/mlaUOy+TYY= ARC-Authentication-Results: i=1; imf24.hostedemail.com; dkim=none; spf=pass (imf24.hostedemail.com: domain of dev.jain@arm.com designates 217.140.110.172 as permitted sender) smtp.mailfrom=dev.jain@arm.com; dmarc=pass (policy=none) header.from=arm.com Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 0BE1F1516; Thu, 13 Mar 2025 03:26:24 -0700 (PDT) Received: from [10.162.42.23] (K4MQJ0H1H2.blr.arm.com [10.162.42.23]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id D91713F694; Thu, 13 Mar 2025 03:26:10 -0700 (PDT) Message-ID: <76e11ff2-0247-4221-b95a-d73998c8cea7@arm.com> Date: Thu, 13 Mar 2025 15:56:07 +0530 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] mm/vmalloc: Move free_vm_area(area) from the __vmalloc_area_node function to the __vmalloc_node_range_noprof function To: "Lai, Yi" , Liu Ye Cc: akpm@linux-foundation.org, urezki@gmail.com, hch@infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, yi1.lai@intel.com References: <20250303015702.319416-1-liuye@kylinos.cn> Content-Language: en-US From: Dev Jain In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Rspam-User: X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: A19DC180002 X-Stat-Signature: wunb4e8745t74m1dyj5pped7w8rumgpa X-HE-Tag: 1741861574-772865 X-HE-Meta: U2FsdGVkX18uzTOTg7imnjKbboVPntiRs/k3T+pG3tizsV3Xvqx+3p37PdJUn391odrSKh49/rc2eBDCdbHDCwV1BPXiQWkIW4dLXKHvlPkLtDVx/Ex8qRIf2sQ9HMvVkKIzqzgdIOx4wKlbDJc867t4QGPD0FxY4iUNRsj0C9iin6D1GPV1hS9Vyo/gwhnPK/3IhpWl+fWFMUYbO4nh5+BIORcNDioc4+6FMTm+D51UEVT0fl0WsyXQQsZ3M7TKMK1Z1teaDjzmm5pnz9iZKvoNGWIanLiPtOjyBdPSjIyRtJ1wvIVsVaK7rMFG09hImGGn9vF1mjc6mJiOGrzhvM9BqwzcCKDsSejXONP6S19RdkPwpuJgWhek24VaAjbPKMkfWbqS4xbqaVugVp+QkjTpRu7e/Vr7XdVus6aZSPS6R+Gd9GXZWigF1OT87QlbM+Ho6n2+nADPYzgTDZjry20OsZ35T8mx9WrnnvY/XWf0eO07S/am4JwBkjm0A8paTdXWcyRhuAWVmKjrnPDruet9EvJqdLAtuXA4yNIsurbAjqpYgroUQUDeKcU1sSb3JenDQ61XmELJLcdge01w3mh23EIJRXe57YOY6Mji7+BLxks5b8RT+eSZZMOdtX/xq19UplJ960H/pjnN/HFyM1bubBo5SOeHw+aKsNqtY15cOVfCvGRAQOkBwugxRln1vRVZBGC17ol6v8FHnsaZrxtrp9FZjE4TKdOdNSKXJ+/AByVN0325p87rSaQojn9d3eBjIarMACNdmT0fgUyx0zUi9nlaDO/quyRwLMjcvT9C/AsAFJovPKSB1Q2gNtnX7pagICVUsBBd8AXzhcvUPYqoIluvWybIIPt48AP9sU3LNxY8Z3atHt+xQsj0oKnZOqCLEAFU8aFEZvBHvPkaXq4SihQtZ9E24DbGULXM75aMr1QDPMzTVd77IhijBafa15saMx0HMrzg2WQCN7L VhcqGzCH tP8QumM0SkVP94AHvb44QqLDfmwF9LNQF+w/9fk5+nn31maapam6M9aksQSCH0ssLVlTdEdv0AKXXi1a/QIUEyRxTDG7IBUm7+EEfnWoOLqRMYXAZVpYK1m09Zpsdx80a941KtJukXNFN3LpfklCovBRKAqXP/9tJhlTZ6uPnERcZf2SvonQhMjLe5yGSd/d1a4KmDuCbNkaIJCVfW0KXOqKdMyDhHApb5ZtqODdytpoHgMGkmIQ+qkOv3XiDrsIxLtWXcEO/3RUUZZw= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 13/03/25 2:48 pm, Lai, Yi wrote: > On Mon, Mar 03, 2025 at 09:57:02AM +0800, Liu Ye wrote: >> Moved free_vm_area from the __vmalloc_area_node function to the >> __vmalloc_node_range_noprof function so that allocation and freeing >> of the area can be paired in one function for better readability. >> >> Signed-off-by: Liu Ye >> --- >> mm/vmalloc.c | 5 +++-- >> 1 file changed, 3 insertions(+), 2 deletions(-) >> >> diff --git a/mm/vmalloc.c b/mm/vmalloc.c >> index a6e7acebe9ad..dc658d4af181 100644 >> --- a/mm/vmalloc.c >> +++ b/mm/vmalloc.c >> @@ -3651,7 +3651,6 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask, >> warn_alloc(gfp_mask, NULL, >> "vmalloc error: size %lu, failed to allocated page array size %lu", >> nr_small_pages * PAGE_SIZE, array_size); >> - free_vm_area(area); >> return NULL; >> } >> >> @@ -3844,8 +3843,10 @@ void *__vmalloc_node_range_noprof(unsigned long size, unsigned long align, >> >> /* Allocate physical pages and map them into vmalloc space. */ >> ret = __vmalloc_area_node(area, gfp_mask, prot, shift, node); >> - if (!ret) >> + if (!ret) { >> + free_vm_area(area); >> goto fail; >> + } >> >> /* >> * Mark the pages as accessible, now that they are mapped. >> -- >> 2.25.1 >> > > Another issue is also bisected to this commit: there is KASAN: slab-use-after-free Read in io_create_region > > > Syzkaller repro code: > https://github.com/laifryiee/syzkaller_logs/tree/main/250313_124102_io_create_region/repro.c > Syzkaller repro syscall steps: > https://github.com/laifryiee/syzkaller_logs/tree/main/250313_124102_io_create_region/repro.prog > Syzkaller report: > https://github.com/laifryiee/syzkaller_logs/tree/main/250313_124102_io_create_region/repro.report > Issue dmesg: > https://github.com/laifryiee/syzkaller_logs/blob/main/250313_124102_io_create_region/eea255893718268e1ab852fb52f70c613d109b99_dmesg.log > > " > [ 24.707888] __asan_report_load8_noabort+0x18/0x20 > [ 24.707895] __vmalloc_node_range_noprof+0x1344/0x1420 > [ 24.707901] ? __lock_acquire+0x1bad/0x5d60 > [ 24.707915] ? io_create_region+0x6ca/0xe00 > [ 24.707933] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 > [ 24.707940] ? debug_smp_processor_id+0x20/0x30 > [ 24.707958] __kvmalloc_node_noprof+0x2a9/0x6a0 > [ 24.707969] ? io_create_region+0x6ca/0xe00 > [ 24.707979] ? io_create_region+0x6ca/0xe00 > [ 24.707992] io_create_region+0x6ca/0xe00 > [ 24.708002] ? io_create_region+0x6ca/0xe00 > [ 24.708015] ? __pfx_io_create_region+0x10/0x10 > [ 24.708025] ? __this_cpu_preempt_check+0x21/0x30 > [ 24.708035] ? lock_release+0x440/0x870 > [ 24.708046] ? __pfx_lock_release+0x10/0x10 > [ 24.708056] io_create_region_mmap_safe+0xaf/0x150 > [ 24.708067] ? __pfx_io_create_region_mmap_safe+0x10/0x10 > [ 24.708081] ? __sanitizer_cov_trace_const_cmp8+0x1c/0x30 > [ 24.708096] __do_sys_io_uring_register+0xb90/0x2b10 > [ 24.708110] ? __pfx___do_sys_io_uring_register+0x10/0x10 > [ 24.708127] ? trace_hardirqs_on+0x51/0x60 > [ 24.708145] ? __audit_syscall_entry+0x39c/0x500 > [ 24.708157] __x64_sys_io_uring_register+0x9f/0x100 > [ 24.708168] ? syscall_trace_enter+0x14d/0x280 > [ 24.708179] x64_sys_call+0x1eef/0x2150 > [ 24.708188] do_syscall_64+0x6d/0x140 > [ 24.708199] entry_SYSCALL_64_after_hwframe+0x76/0x7e > [ 24.708206] RIP: 0033:0x7f9276c3ee5d > [ 24.708217] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 93 af 1b 00 f7 d8 64 89 01 48 > [ 24.708224] RSP: 002b:00007ffd41ff7c18 EFLAGS: 00000202 ORIG_RAX: 00000000000001ab > [ 24.708234] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9276c3ee5d > [ 24.708238] RDX: 0000000020003300 RSI: 0000000000000022 RDI: 0000000000000003 > [ 24.708242] RBP: 00007ffd41ff7c30 R08: 00007ffd41ff7c30 R09: 00007ffd41ff7c30 > [ 24.708246] R10: 0000000000000001 R11: 0000000000000202 R12: 00007ffd41ff7d88 > [ 24.708250] R13: 00000000004017f5 R14: 0000000000403e08 R15: 00007f9276f77000 > [ 24.708260] > [ 24.708262] > [ 24.719961] Allocated by task 1208: > [ 24.720136] kasan_save_stack+0x2c/0x60 > [ 24.720336] kasan_save_track+0x18/0x40 > [ 24.720529] kasan_save_alloc_info+0x3c/0x50 > [ 24.720744] __kasan_kmalloc+0x88/0xa0 > [ 24.720933] __kmalloc_cache_node_noprof+0x1d0/0x470 > [ 24.721174] __get_vm_area_node+0xf7/0x260 > [ 24.721380] __vmalloc_node_range_noprof+0x25c/0x1420 > [ 24.721622] __kvmalloc_node_noprof+0x2a9/0x6a0 > [ 24.721848] io_create_region+0x6ca/0xe00 > [ 24.722049] io_create_region_mmap_safe+0xaf/0x150 > [ 24.722291] __do_sys_io_uring_register+0xb90/0x2b10 > [ 24.722539] __x64_sys_io_uring_register+0x9f/0x100 > [ 24.722782] x64_sys_call+0x1eef/0x2150 > [ 24.722976] do_syscall_64+0x6d/0x140 > [ 24.723159] entry_SYSCALL_64_after_hwframe+0x76/0x7e > [ 24.723405] > [ 24.723491] Freed by task 1208: > [ 24.723648] kasan_save_stack+0x2c/0x60 > [ 24.723841] kasan_save_track+0x18/0x40 > [ 24.724035] kasan_save_free_info+0x3f/0x60 > [ 24.724247] __kasan_slab_free+0x3d/0x60 > [ 24.724450] kfree+0x28d/0x440 > [ 24.724610] vfree+0x2ce/0x910 > [ 24.724769] __vmalloc_node_range_noprof+0xeca/0x1420 > [ 24.725017] __kvmalloc_node_noprof+0x2a9/0x6a0 > [ 24.725240] io_create_region+0x6ca/0xe00 > [ 24.725442] io_create_region_mmap_safe+0xaf/0x150 > [ 24.725682] __do_sys_io_uring_register+0xb90/0x2b10 > [ 24.725934] __x64_sys_io_uring_register+0x9f/0x100 > [ 24.726177] x64_sys_call+0x1eef/0x2150 > [ 24.726365] do_syscall_64+0x6d/0x140 > [ 24.726549] entry_SYSCALL_64_after_hwframe+0x76/0x7e > [ 24.726796] > [ 24.726882] The buggy address belongs to the object at ffff8880166bfb80 > [ 24.726882] which belongs to the cache kmalloc-64 of size 64 > [ 24.727442] The buggy address is located 8 bytes inside of > [ 24.727442] freed 64-byte region [ffff8880166bfb80, ffff8880166bfbc0) > [ 24.727990] > [ 24.728078] The buggy address belongs to the physical page: > [ 24.728344] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x166bf > [ 24.728712] anon flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) > [ 24.729034] page_type: f5(slab) > [ 24.729196] raw: 000fffffc0000000 ffff88800d4418c0 0000000000000000 dead000000000001 > [ 24.729562] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 > [ 24.729922] page dumped because: kasan: bad access detected > [ 24.730189] > [ 24.730274] Memory state around the buggy address: > [ 24.730503] ffff8880166bfa80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > [ 24.730839] ffff8880166bfb00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > [ 24.731179] >ffff8880166bfb80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > [ 24.731518] ^ > [ 24.731696] ffff8880166bfc00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > [ 24.732032] ffff8880166bfc80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > [ 24.732369] ================================================================== > [ 24.732787] Disabling lock debugging due to kernel taint > [ 24.734673] ------------[ cut here ]------------ > [ 24.734907] Trying to vfree() bad address (00000000ea48f0e7) > [ 24.735229] WARNING: CPU: 0 PID: 1207 at mm/vmalloc.c:3231 remove_vm_area+0x1c2/0x220 > [ 24.735601] Modules linked in: > [ 24.735760] CPU: 0 UID: 0 PID: 1207 Comm: repro Tainted: G B 6.14.0-rc6-next-20250311-eea255893718 #1 > [ 24.736307] Tainted: [B]=BAD_PAGE > [ 24.736477] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 > [ 24.737002] RIP: 0010:remove_vm_area+0x1c2/0x220 > [ 24.737230] Code: c3 cc cc cc cc e8 7e e2 a4 ff 49 81 ee 00 10 00 00 e9 51 ff ff ff e8 6d e2 a4 ff 4c 89 e6 48 c7 c7 a0 eb fa 85 e8 ce 71 63 ff <0f> 0b 45 31 ed eb bb 45 31 ed eb b6 e8 ed d2 0f 00 e9 10 ff ff ff > [ 24.738072] RSP: 0000:ffff88804dbc78b8 EFLAGS: 00010292 > " > > Hope this cound be insightful to you. > > Regards, > Yi Lai > I guess this trace is something else, butiIf __vmalloc_area_node() fails while allocating physical memory (after we have allocated the pages array), you call vfree(area->addr), and then the patch does a free_vm_area() again, causing a double free.