From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id B7AB3C54E5D for ; Tue, 19 Mar 2024 02:15:53 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id EC9B26B007B; Mon, 18 Mar 2024 22:15:52 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E52F56B0082; Mon, 18 Mar 2024 22:15:52 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CCE766B0083; Mon, 18 Mar 2024 22:15:52 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id BAAA06B007B for ; Mon, 18 Mar 2024 22:15:52 -0400 (EDT) Received: from smtpin13.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 29061140873 for ; Tue, 19 Mar 2024 02:15:52 +0000 (UTC) X-FDA: 81912172944.13.772BFC6 Received: from mail-yw1-f182.google.com (mail-yw1-f182.google.com [209.85.128.182]) by imf10.hostedemail.com (Postfix) with ESMTP id 56C46C001A for ; Tue, 19 Mar 2024 02:15:50 +0000 (UTC) Authentication-Results: imf10.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=S2QkLSrW; spf=pass (imf10.hostedemail.com: domain of nphamcs@gmail.com designates 209.85.128.182 as permitted sender) smtp.mailfrom=nphamcs@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1710814550; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=fYVrQrEsh6uYviSopgSQhcHv9TIjtMyaJxqSICXb3ro=; b=kd5OV4oCP6ZyTIoadoHg0nbctdP+NnIOhYd/Tg/eM37ICuxlq9zcw763QJItpAR63bIUDY jEV3axlxXhb/teye5+3PsusAw/WTdqvR817UTRhpnvjTrm7/B1nyfl6Hb1XbgbrIQmd660 NAQ7F0tWjw3tVP+3+27M9etHDOIOsu0= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1710814550; a=rsa-sha256; cv=none; b=Ie3SL7moZiQPOEqrCE6REYKtjUSZav8nzLQlCaBrTis43H/VUXA23IE0VHe3NxDg6eO8Rr cLBtWBXba3azr4+8QV09okdy9yDuyXpJLggxv6bMJxCKIbV09ZXIftb9dJ8J3e7+0Yejwc WD+1Ui8oqkxWr3pUT9XCpapVhJdh+t0= ARC-Authentication-Results: i=1; imf10.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=S2QkLSrW; spf=pass (imf10.hostedemail.com: domain of nphamcs@gmail.com designates 209.85.128.182 as permitted sender) smtp.mailfrom=nphamcs@gmail.com; dmarc=pass (policy=none) header.from=gmail.com Received: by mail-yw1-f182.google.com with SMTP id 00721157ae682-609fb0450d8so53551897b3.0 for ; Mon, 18 Mar 2024 19:15:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1710814549; x=1711419349; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=fYVrQrEsh6uYviSopgSQhcHv9TIjtMyaJxqSICXb3ro=; b=S2QkLSrWZwCg9VZ8AfnG1w96i2pXJsd4CHH+x+BqlyY0r2yToOMUxJVdl1Wo4V4RmV LBEeSOA6g0k/4yA0ycUBnjJIwm9KpsNhyXxZso/IoDnBB10j/KD6V+TNzp6/ILp7cS44 +GHgFWhl4rCKO/UqZQD7GLDtyvkPbdg3CtVqY2FoVWYQFmFfhhvjkEKrLc+cNiDNtN2t CHXUu6AOcO49gQGn9BVxT9/sX/49SmK7hBVJp605bRZGp+GlfnzvFaTFZgmfbb7hjJnR l6uMrg0NNrCFy1tzXdr0Vw6ZVKxWGtCxH0dscBJdaneI6hIJHsQ2Fx6POKI+TNt9kpls aPyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710814549; x=1711419349; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=fYVrQrEsh6uYviSopgSQhcHv9TIjtMyaJxqSICXb3ro=; b=dhJ+tj84W82wSs6jooAi08ckWKngaDy2jdw1Nn/ilUiOIm+JoH1SsXt4QbMQJNgvEb gVoFxqhaTciOcoMioOCzztj9uDSimi7dg7hhyqtqPLULkSVLCs8eJsW5Qtnhxt+z+lyl CWv7WF9ZuUVBEnnDo6ka1oiDHtHhkgBr9AU0LnauW8DtDPjd2JK4ZIGT4MFzUiAxCLWK +GqZd7W1rmRh0LeJotp56HzLxiXJZM4zYD1sextQDVYM/3LfzbAczXz0dOPRy946loAP Tu0ZXFfY7UPrErq9tTObLcRTNmjSi08VwZ3a3cI/enmzhWqAX7wpKYnUdbh6xm9Nwjlg sfNA== X-Forwarded-Encrypted: i=1; AJvYcCXOX3deDMcFCnL1WP4F4yLOiFvnskIe+Jgnkc4wFhLP3A6xxLeMFyYq5I1fsy2r9Ke/GD/JJb2EGFULM+oX7rxenrU= X-Gm-Message-State: AOJu0Ywy06iiY+9u8JGC4ogT73g542RWsLykAzR2/WNDrgbq/aLST/8Q bX6w2TaTnck71UMoxZq6HEbdAgS/G0jhL1jWJTQsmIwMWnGJ2GHNgDq0009NOX3D0MLp7W//s4J VW4IClMaxzZoRONiXaOoVuYMCoxU= X-Google-Smtp-Source: AGHT+IEZNIhbNyYG+uI64ZLjlo0tkDENy952EK2dJ1BI9Q53Khz7vgHe08KvUjvzgVsECUGrom4LN+dZfFriPOIUM4Y= X-Received: by 2002:a5b:b10:0:b0:dcb:fa70:c09 with SMTP id z16-20020a5b0b10000000b00dcbfa700c09mr660781ybp.28.1710814549112; Mon, 18 Mar 2024 19:15:49 -0700 (PDT) MIME-Version: 1.0 References: <20240318234706.95347-1-21cnbao@gmail.com> In-Reply-To: <20240318234706.95347-1-21cnbao@gmail.com> From: Nhat Pham Date: Mon, 18 Mar 2024 19:15:38 -0700 Message-ID: Subject: Re: [PATCH v2] mm: zswap: fix kernel BUG in sg_init_one To: Barry Song <21cnbao@gmail.com> Cc: hannes@cmpxchg.org, yosryahmed@google.com, akpm@linux-foundation.org, chrisl@kernel.org, v-songbaohua@oppo.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, ira.weiny@intel.com, syzbot+adbc983a1588b7805de3@syzkaller.appspotmail.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Queue-Id: 56C46C001A X-Rspam-User: X-Rspamd-Server: rspam11 X-Stat-Signature: ugqbmxxugmddxbjc661w4psxm1rpak15 X-HE-Tag: 1710814550-838732 X-HE-Meta: U2FsdGVkX1/NxFda+M69xblSnfSLUg6uughNAhPqjhesBwf9/0okPUQRL9HQWyqNi9DHqCrbT7K2OhlvCy4oK1z8e/jW2wZyfmn1M7xPE0bVB9I4ES8jyMmN/s8TZYUxUUUuhti8gvdgQ9hJGc6Zk/kQtRrXKpMo/FvMKs/NxSPYKzOD8u4H0AcSmIvCscibT5ftuAx+gxHYh6BxHdM/XZuzUutohUlQa8C0oIsxdGW9LcZ+13LypogpAmgW67JQH7b/70iXdkwl22cCMdxJU2V9j3cGBcx9I4XHWXml162MKxGDN0h+XazLlZyMx06mz4xwWaovMv68eK37LLQ863EmkBchOyY9uiiz/8UWA524/EuHx/07dO3ZVqLn3RagayFnSi6eutSFZ2nF5hN//jBapczVJxJUYjqUH04apjF8v34cinGO08H+/dWWVl0zwsngqe5MRmfs8yl5zYwZ6LrUBxlSjh4UZUG1Ce2ESIOWS3/FOa1SU3y2PiuaPT44WxFlfw2BTITMJZAHbvg1/NlyMSY6GWuWxY5iOSo6/yC0qY50YvCnJupzn+ju6mBiqaXCAZ38EKOQjGDyV1F5dIUfe+7eIaBApJnWp5PlDkWV1IDgd960gQQjpoW7M40Wmv57TMdHIdpx1T2zEQic1jlnRnDMed0BC0tOXtgCbArZb++WUo+1sKq4SORRtVecV1awnK981B3ShKXicatej7ntcPuxNzclli4AfHC+nmN2L92oCQentHbeDXFaqLozvAXxxnb4gdTOd+wsdueVhQkVKr3KH+bqJxNiz73GZ2zLNH99P5gC7D79sP2zvBdWF+ZbK8lMNcSl4IzIW9BxhAEMVALLQPxyWXjc8fPvKdxiAJ2rJXUloUxVvfR+wms385HkOoI8AO9guxeOR6jk79bwUhv2klMnWjcy9kTbsIPyiRmrDy5DLHCSLmmnaqarYnbl5pzOa77wUabbLj5 5u/xupXX VZTbtPk4mGsDBFTlUcG4+ypnXa7ea/pKXVy7P5MYHNdZFTPn2YayR8c0lixk7ufMvaXJq+y4KOOiDOHnGy4ani+NM7u827ekX2LqxHC8fnH22Mlld/eWk1cczZvKZs3Dm5P7Iu9R8HAVAMXiakCzsZcd07ruW/ZrGKZzOn7C2YYWL/c0zPlXipcD8teG0dMx6vV54vygYBoXjH7HdyTaXkPouTRE7XEmGSckKpjcPax/UwwbeHjtOnGH2ZwLMxJ0IaclfQa18MTVejhSAawvEUx4xJvsKzIpTiJBdqgvUvzakskg15FkrKfKr9zqD8i51jE92UYkWbSYYz7eW/6WU1kU2F+Kl1R1ZEwqT4GIXoVv6x09zkJQi4zxESoBgGvWpjrJIEY7rYNLufEeteFKiujXWCCOY4JOopy5e1cv2NwSIGymq6L7OdADqwbZwyvXztEOgOYM+naK+FcK6hq+9aRmRMGEKd6dHRVAE5WrMOI0L7eVGgyFomeA9E3OJCN/5wLuDEarWLo8V27lq9oXDhZITTKmKepnUmJxYdDMbFrc+TQrYVUy/PHqDwaahHor+NOsVXUS6VshKzllHTvGTfql0BnBvedGtRrh2SSIX3+KQz+zzfyOp7lagbvXcYLCwR4kpHtUU008/aBqazw/kXbE43UUCjigrgvbi+CWHYU5hemMaWZDch9YcFUB7CSZSEkwoe/XtVfKtNVvt0eXHa4x17w== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Mon, Mar 18, 2024 at 4:47=E2=80=AFPM Barry Song <21cnbao@gmail.com> wrot= e: > > From: Barry Song > > sg_init_one() relies on linearly mapped low memory for the safe > utilization of virt_to_page(). Otherwise, we trigger a kernel > BUG, > > kernel BUG at include/linux/scatterlist.h:187! > Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM > Modules linked in: > CPU: 0 PID: 2997 Comm: syz-executor198 Not tainted 6.8.0-syzkaller #0 > Hardware name: ARM-Versatile Express > PC is at sg_set_buf include/linux/scatterlist.h:187 [inline] > PC is at sg_init_one+0x9c/0xa8 lib/scatterlist.c:143 > LR is at sg_init_table+0x2c/0x40 lib/scatterlist.c:128 > Backtrace: > [<807e16ac>] (sg_init_one) from [<804c1824>] (zswap_decompress+0xbc/0x208= mm/zswap.c:1089) > r7:83471c80 r6:def6d08c r5:844847d0 r4:ff7e7ef4 > [<804c1768>] (zswap_decompress) from [<804c4468>] (zswap_load+0x15c/0x198= mm/zswap.c:1637) > r9:8446eb80 r8:8446eb80 r7:8446eb84 r6:def6d08c r5:00000001 r4:844847d0 > [<804c430c>] (zswap_load) from [<804b9644>] (swap_read_folio+0xa8/0x498 m= m/page_io.c:518) > r9:844ac800 r8:835e6c00 r7:00000000 r6:df955d4c r5:00000001 r4:def6d08c > [<804b959c>] (swap_read_folio) from [<804bb064>] (swap_cluster_readahead+= 0x1c4/0x34c mm/swap_state.c:684) > r10:00000000 r9:00000007 r8:df955d4b r7:00000000 r6:00000000 r5:00100cca > r4:00000001 > [<804baea0>] (swap_cluster_readahead) from [<804bb3b8>] (swapin_readahead= +0x68/0x4a8 mm/swap_state.c:904) > r10:df955eb8 r9:00000000 r8:00100cca r7:84476480 r6:00000001 r5:00000000 > r4:00000001 > [<804bb350>] (swapin_readahead) from [<8047cde0>] (do_swap_page+0x200/0xc= c4 mm/memory.c:4046) > r10:00000040 r9:00000000 r8:844ac800 r7:84476480 r6:00000001 r5:00000000 > r4:df955eb8 > [<8047cbe0>] (do_swap_page) from [<8047e6c4>] (handle_pte_fault mm/memory= .c:5301 [inline]) > [<8047cbe0>] (do_swap_page) from [<8047e6c4>] (__handle_mm_fault mm/memor= y.c:5439 [inline]) > [<8047cbe0>] (do_swap_page) from [<8047e6c4>] (handle_mm_fault+0x3d8/0x12= b8 mm/memory.c:5604) > r10:00000040 r9:842b3900 r8:7eb0d000 r7:84476480 r6:7eb0d000 r5:835e6c00 > r4:00000254 > [<8047e2ec>] (handle_mm_fault) from [<80215d28>] (do_page_fault+0x148/0x3= a8 arch/arm/mm/fault.c:326) > r10:00000007 r9:842b3900 r8:7eb0d000 r7:00000207 r6:00000254 r5:7eb0d9b4 > r4:df955fb0 > [<80215be0>] (do_page_fault) from [<80216170>] (do_DataAbort+0x38/0xa8 ar= ch/arm/mm/fault.c:558) > r10:7eb0da7c r9:00000000 r8:80215be0 r7:df955fb0 r6:7eb0d9b4 r5:00000207 > r4:8261d0e0 > [<80216138>] (do_DataAbort) from [<80200e3c>] (__dabt_usr+0x5c/0x60 arch/= arm/kernel/entry-armv.S:427) > Exception stack(0xdf955fb0 to 0xdf955ff8) > 5fa0: 00000000 00000000 22d5f800 0008= d158 > 5fc0: 00000000 7eb0d9a4 00000000 00000109 00000000 00000000 7eb0da7c 7eb0= da3c > 5fe0: 00000000 7eb0d9a0 00000001 00066bd4 00000010 ffffffff > r8:824a9044 r7:835e6c00 r6:ffffffff r5:00000010 r4:00066bd4 > Code: 1a000004 e1822003 e8860094 e89da8f0 (e7f001f2) > ---[ end trace 0000000000000000 ]--- > ---------------- > Code disassembly (best guess): > 0: 1a000004 bne 0x18 > 4: e1822003 orr r2, r2, r3 > 8: e8860094 stm r6, {r2, r4, r7} > c: e89da8f0 ldm sp, {r4, r5, r6, r7, fp, sp, pc} > * 10: e7f001f2 udf #18 <-- trapping instruction > > Consequently, we have two choices: either employ kmap_to_page() alongside > sg_set_page(), or resort to copying high memory contents to a temporary > buffer residing in low memory. However, considering the introduction > of the WARN_ON_ONCE in commit ef6e06b2ef870 ("highmem: fix kmap_to_page() > for kmap_local_page() addresses"), which specifically addresses high > memory concerns, it appears that memcpy remains the sole viable > option. > > Reported-and-tested-by: syzbot+adbc983a1588b7805de3@syzkaller.appspotmail= .com > Closes: https://lore.kernel.org/all/000000000000bbb3d80613f243a6@google.c= om/ > Fixes: 270700dd06ca ("mm/zswap: remove the memcpy if acomp is not sleepab= le") > Signed-off-by: Barry Song > --- > -v2: > add comments according to Yosry > > mm/zswap.c | 14 ++++++++++++-- > 1 file changed, 12 insertions(+), 2 deletions(-) > > diff --git a/mm/zswap.c b/mm/zswap.c > index 9dec853647c8..dbd9f745fa8f 100644 > --- a/mm/zswap.c > +++ b/mm/zswap.c > @@ -1080,7 +1080,17 @@ static void zswap_decompress(struct zswap_entry *e= ntry, struct page *page) > mutex_lock(&acomp_ctx->mutex); > > src =3D zpool_map_handle(zpool, entry->handle, ZPOOL_MM_RO); > - if (acomp_ctx->is_sleepable && !zpool_can_sleep_mapped(zpool)) { > + /* > + * If zpool_map_handle is atomic, we cannot reliably utilize its = mapped buffer > + * to do crypto_acomp_decompress() which might sleep. In such cas= es, we must > + * resort to copying the buffer to a temporary one. > + * Meanwhile, zpool_map_handle() might return a non-linearly mapp= ed buffer, nit: /s/Meanwhile/In addition Very insignificant though - please disregard unless you submit a new versio= n :) > + * such as a kmap address of high memory or even ever a vmap addr= ess. > + * However, sg_init_one is only equipped to handle linearly mappe= d low memory. > + * In such cases, we also must copy the buffer to a temporary and= lowmem one. > + */ I like this extensive comment - this will be useful for beginners who are not familiar with the underlying machinery (read: me). > + if ((acomp_ctx->is_sleepable && !zpool_can_sleep_mapped(zpool)) |= | > + !virt_addr_valid(src)) { Nice! You and Yosry beat me to it - I was staring at the same piece of zsmalloc code. It's somewhat serendipitous (albeit anti-climatic) when the fix is simply checking for the BUG_ON condition. Thanks for the fix and the detailed explanation, Barry! Reviewed-by: Nhat Pham