From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A375FC43334 for ; Tue, 21 Jun 2022 11:01:00 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A88B66B0072; Tue, 21 Jun 2022 07:00:59 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A37EC6B0073; Tue, 21 Jun 2022 07:00:59 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 8FE986B0074; Tue, 21 Jun 2022 07:00:59 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 8151A6B0072 for ; Tue, 21 Jun 2022 07:00:59 -0400 (EDT) Received: from smtpin09.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 276FA10CE for ; Tue, 21 Jun 2022 11:00:59 +0000 (UTC) X-FDA: 79601950638.09.F3D9F6D Received: from mail-lf1-f53.google.com (mail-lf1-f53.google.com [209.85.167.53]) by imf10.hostedemail.com (Postfix) with ESMTP id AC177C00AC for ; Tue, 21 Jun 2022 11:00:58 +0000 (UTC) Received: by mail-lf1-f53.google.com with SMTP id t24so9482351lfr.4 for ; Tue, 21 Jun 2022 04:00:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YuiB2lEEMCk0w/w/b+ALLeZ6vsLYTAjuyX+rwIjOEXk=; b=aqaw3+BMMU0j938NWoZbZ9UP6JuFL0AXN2pvwceLelhH1yoKvwXyL5EgVTxbpxmG/R dJaah/AfgOMSCCDdDay6LYB+g2DIBrAXRsVD6wyNYMz2Qgn9rZSdUsSdmHAsm6f8+yVt xoJLh5X56XJpSwV6KSW120800VS7yh/dEq5Lg5mzR9zek7I4hkavSCrRt16zo5E9tesf CBD2UtOpTGjAU6jpobd4DH0BkziZWqNszjbJX7a+CMhhMig6iZnZboxy9aff3i5hyFey /UDiMuL90ho1PdpiAjB5TEeZP0G+mf0yK/e+R5ukV90gvqYwxrTYAIMOVJ6stF8NfVSr afBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YuiB2lEEMCk0w/w/b+ALLeZ6vsLYTAjuyX+rwIjOEXk=; b=XKRw0oWkCtsLUb+dXi0WGbeaUCMWIYSqB2VdnpUw8ot6s8GJPqalkXzF6qMziw6dH2 t9GA8GHTUS7GVmPIW0I/Xc2Rv6VkwAAFCZV5+NasS+zKdftV9mlADQyO3e+AOBk+u3x1 +im+OfehHQcg8C0OYU3Wuc9WwtyCQ116PuTzOiDjA/Qlj7SOsDd75NeUmMHYXfuoWBEz LmwGvOQMlN0HjLUmzyV30vBaWGUCCsiuExbNdHYHujjMffGh6vBuwgKKDb5whr5A+6F0 eMWg/1V8JrXxXwrPKHHRlzwrXWeuGvI7y2PA0vn9qNO+4ZxdRtIkIk36ZoYQdxkFq/Fk c0qQ== X-Gm-Message-State: AJIora/FlLFBfZQYj5ePEULSVyrgcLBju7TQ3cwdHJXMyWvga2OyAPBr GjygIrJKSTtLE8L5KiEYN/VMw4Q4Uw9VrSTbh1E= X-Google-Smtp-Source: AGRyM1vjPstPhMcfRgUwQXS8N/cl5cvZIXZ3mQrH7rDQ3i/dbq4zsOWG2nTOOO6P5X32unp502ZF7KykuNIxjSSVxyw= X-Received: by 2002:ac2:484d:0:b0:47f:7ebf:336 with SMTP id 13-20020ac2484d000000b0047f7ebf0336mr1677240lfy.130.1655809256871; Tue, 21 Jun 2022 04:00:56 -0700 (PDT) MIME-Version: 1.0 References: <1653447164-15017-1-git-send-email-zhaoyang.huang@unisoc.com> In-Reply-To: From: Zhaoyang Huang Date: Tue, 21 Jun 2022 19:00:27 +0800 Message-ID: Subject: Re: [PATCH] mm: fix racing of vb->va when kasan enabled To: Uladzislau Rezki Cc: "zhaoyang.huang" , Andrew Morton , "open list:MEMORY MANAGEMENT" , LKML , Ke Wang , Christoph Hellwig Content-Type: text/plain; charset="UTF-8" ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1655809258; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=YuiB2lEEMCk0w/w/b+ALLeZ6vsLYTAjuyX+rwIjOEXk=; b=oNkLHGNqtvLa8H+C9EHEZzndv7etT4A6nib6Ouh69lY3Udcswy6oF7j5+tjppizDKGtbnv aNUjEhoX7Zphq/HRftvrDDLENcx2dRu37J+QkjCn6CuzTowMqtJ/cEL78HrePSs8zJZeF6 uAlxmHuzzOAzKZRaTvW2ZUTUx1hBM/o= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1655809258; a=rsa-sha256; cv=none; b=MNz4m9No+NPyaGH5TbpbDFpEDM/rlkNOxCJJWGcoMAAVl3WKqS6C6EQz7WSLEBi7EY7oFI 5kuN6wz3XdLbvH/1NwoWP/BYoVWAwYWneacgEDAPhZiJ2Gyudk/yKUvXbhiK6H78v7vRDD n28ePVOZqdxRCDAatM1z4hIKNKe181w= ARC-Authentication-Results: i=1; imf10.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=aqaw3+BM; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf10.hostedemail.com: domain of huangzhaoyang@gmail.com designates 209.85.167.53 as permitted sender) smtp.mailfrom=huangzhaoyang@gmail.com Authentication-Results: imf10.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=aqaw3+BM; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf10.hostedemail.com: domain of huangzhaoyang@gmail.com designates 209.85.167.53 as permitted sender) smtp.mailfrom=huangzhaoyang@gmail.com X-Rspamd-Server: rspam12 X-Rspam-User: X-Stat-Signature: p7j5e47tmwmunpk18baj17p4oief685b X-Rspamd-Queue-Id: AC177C00AC X-HE-Tag: 1655809258-425721 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000119, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Jun 21, 2022 at 5:27 PM Uladzislau Rezki wrote: > > > On Mon, Jun 20, 2022 at 6:44 PM Uladzislau Rezki wrote: > > > > > > > > > > > > > > Is it easy to reproduce? If so could you please describe the steps? As i see > > > > > the freeing of the "vb" is RCU safe whereas vb->va is not. But from the first > > > > > glance i do not see how it can accessed twice. Hm.. > > > > It was raised from a monkey test on A13_k515 system and got 1/20 pcs > > > > failed. IMO, vb->va which out of vmap_purge_lock protection could race > > > > with a concurrent ra freeing within __purge_vmap_area_lazy. > > > > > > > Do you have exact steps how you run "monkey" test? > > There are about 30+ kos inserted during startup which could be a > > specific criteria for reproduction. Do you have doubts about the test > > result or the solution? > > > > I do not have any doubt about your test results, so if you can trigger it > then there is an issue at least on the 5.4.161-android12 kernel. > > 1. With your fix we get expanded mutex range, thus the worst case of vmalloc > allocation can be increased when it fails and repeat. Because it also invokes > the purge_vmap_area_lazy() that access the same mutex. I am not sure I get your point. _vm_unmap_aliases calls _purge_vmap_area_lazy instead of purge_vmap_area_lazy. Do you have any other solutions? I really don't think my patch is the best way as I don't have a full view of vmalloc mechanism. > > 2. You run 5.4.161-android12 kernel what is quite old. Could you please > retest with latest kernel? I am asking because on the latest kernel with > CONFIG_KASAN i am not able to reproduce it. > > I do a lot of: vm_map_ram()/vm_unmap_ram()/vmalloc()/vfree() in parallel > by 64 kthreads on my 64 CPUs test system. The failure generates at 20s from starting up, I think it is a rare timing. > > Could you please confirm that you can trigger an issue on the latest kernel? Sorry, I don't have an available latest kernel for now. > > Thanks! > > -- > Uladzislau Rezki