From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77835C433EF for ; Thu, 28 Apr 2022 05:13:39 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6E70D6B0071; Thu, 28 Apr 2022 01:13:38 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 697846B0072; Thu, 28 Apr 2022 01:13:38 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 55EB66B0073; Thu, 28 Apr 2022 01:13:38 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (relay.hostedemail.com [64.99.140.25]) by kanga.kvack.org (Postfix) with ESMTP id 465EF6B0071 for ; Thu, 28 Apr 2022 01:13:38 -0400 (EDT) Received: from smtpin19.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 065DE209C1 for ; Thu, 28 Apr 2022 05:13:38 +0000 (UTC) X-FDA: 79405120116.19.A04EDA2 Received: from mail-oi1-f182.google.com (mail-oi1-f182.google.com [209.85.167.182]) by imf27.hostedemail.com (Postfix) with ESMTP id 3679F40053 for ; Thu, 28 Apr 2022 05:13:36 +0000 (UTC) Received: by mail-oi1-f182.google.com with SMTP id s131so4292035oie.1 for ; Wed, 27 Apr 2022 22:13:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=XZ0kXxBSl23w8GkxJCbpihVcMvIBI0EhKBEVZyl19iU=; b=dvftVoIMKtGIe2CqgEQVSZkJI1zm+fPAvSgmxv4X4kZ7DVd7W6SrmLMRZkZQ6EwSvV yT22EXrwEA+DNaLxV2s/XJYBoxapr8kqn7UsTVOUUP8tzzoJoatSFEbfC6TlS7rpIrTc OQYmlpnKP7AUCPfB9B7HMIh6hkjBUKWwQ2dT6mwtMroUOz7+A3y9NlYKIg08+X3YWiAO OFK4VhpU0R9IuPAOCncrJS2+H2jtFpxvuxmRkBlS6FrBY+SvHLRUgRS8ZlpKgqnjJv3A Q+ygVBrbRlqRjbg1KUnPDfeCVmeK4MQe6RdrQZi3rQJROVtACYJuzzR/9n8L2Rnsto5Y RjFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=XZ0kXxBSl23w8GkxJCbpihVcMvIBI0EhKBEVZyl19iU=; b=EDfbOTyc7/IfbRh0hAwKkT5edC8WG3CGeWk0mxmY2KXxbcp4qmi75PdI4NNqsJrC+d L1W6w+4m62n/U8ZxYkl2+ckQNFqHM0JFiP0RDxHIOiJcPGqwP0q+5ZI9gxznOIWwTa3z uuBUy4mRIQYdtZSZFYz2svJtenniW6u0ZuDHfdOB93Vo6JACbsBxFYY2jkIRN7TUEwqZ NDOiAuVoRpT3VOyzkRbivEP66cUv7IywFYy2oJWK/6XeYKNO/QrKTOLLpRWrxBLYlrd5 6AQ+W4KN2rsKG9qDjSB9DQAxhEzvLFlWweYzESsUL9FNEaLYJSDqnJtRAsKVYXtkiRHf cceg== X-Gm-Message-State: AOAM533zoNLj+BvSZjFo1F3zSDJ1dwJEm8+hloOv+azmCMwUf2UW5HV6 UlGVHgkv7iXsnkxXnp4Ymbiw/YKzdDpEjrAZwifvsQ== X-Google-Smtp-Source: ABdhPJy3HFzFNgAPmuC1QL08wYl+z2x2VruD9o0uNrzOW+yxDSEP76x8hxU5uC3/wq1Efr/Hz7pL3BCyhhsnTJAk0/w= X-Received: by 2002:a05:6808:21a1:b0:322:b5a1:b261 with SMTP id be33-20020a05680821a100b00322b5a1b261mr19509167oib.211.1651122816673; Wed, 27 Apr 2022 22:13:36 -0700 (PDT) MIME-Version: 1.0 References: <000000000000a23c8505dda227eb@google.com> <000000000000f28f0005dda29992@google.com> <20220427102032.5a87283eb64d06c1a6d682fd@linux-foundation.org> <20220427175218.cazytgdlpc6lpn45@revolver> <20220427190622.wgoxjjbmphdo3xxw@revolver> In-Reply-To: <20220427190622.wgoxjjbmphdo3xxw@revolver> From: Dmitry Vyukov Date: Thu, 28 Apr 2022 07:13:25 +0200 Message-ID: Subject: Re: [syzbot] WARNING in vma_merge To: Liam Howlett Cc: Andrew Morton , syzbot , "linux-kernel@vger.kernel.org" , "linux-mm@kvack.org" , "syzkaller-bugs@googlegroups.com" , Peter Xu , Qian Cai Content-Type: text/plain; charset="UTF-8" X-Stat-Signature: rr7k8uet5rjrdzhqujudsxyzd3buo7zs X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 3679F40053 X-Rspam-User: Authentication-Results: imf27.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=dvftVoIM; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf27.hostedemail.com: domain of dvyukov@google.com designates 209.85.167.182 as permitted sender) smtp.mailfrom=dvyukov@google.com X-HE-Tag: 1651122816-214478 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, 27 Apr 2022 at 21:06, Liam Howlett wrote: > > * Liam R. Howlett [220427 13:52]: > > * Andrew Morton [220427 13:20]: > > > On Wed, 27 Apr 2022 06:15:20 -0700 syzbot wrote: > > > > > > > syzbot has found a reproducer for the following issue on: > > > > > > Thanks. > > > > > > userfaultfd_release() appears to have offended vma_merge(). > > > > Potentially apply_mlockall_flags() and not userfaultfd_release(). There > > is a potential that the vma iterator is stale if a split/merge succeeds, > > although KASAN should pick this up and KASAN is active according to the > > config below. I've sent a patch for the mlockall issue after Qian Cai's > > reported it to linux-mm. > > > > > > > > I'm not seeing any changes in that area from Peter, but Liam's > > > mapletree work changed things around a bit. Gents, could you please > > > take a look? > > > > > > > > > > HEAD commit: f02ac5c95dfd Add linux-next specific files for 20220427 > > > > git tree: linux-next > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=105a33a2f00000 > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=e9256c70f586da8a > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=7728e4ab5371cebc9c00 > > > > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15f76f82f00000 > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12b42c3cf00000 > > > > > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > > > Reported-by: syzbot+7728e4ab5371cebc9c00@syzkaller.appspotmail.com > > > > > > ... > > > > > I cannot get this issue to trigger with the given tree and git repo with > > my config. I will try again with the kernel config above. > > > I was able to reproduce the issue using the config from syzkaller in my > VM and can confirm it was the apply_mlockall_flags() bug also reported > by Qian Cai [1]. The patch I sent earlier [2] fixes this issue as well. > > > 1. https://lore.kernel.org/linux-mm/20220427161033.GA1935@qian/ > 2. https://lore.kernel.org/linux-mm/20220427165139.5s3qcj2u5vqrvwlc@revolver/ > > Thanks, > Liam Let's tell syzbot about the fix: #syz fix: mm/mlock: use maple state in apply_mlockall_flags()