From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4761C433EF for ; Sat, 11 Jun 2022 20:12:23 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 07AE58D0115; Sat, 11 Jun 2022 16:12:23 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 029586B019D; Sat, 11 Jun 2022 16:12:22 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E33208D0115; Sat, 11 Jun 2022 16:12:22 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id D15766B019C for ; Sat, 11 Jun 2022 16:12:22 -0400 (EDT) Received: from smtpin30.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id A0474347E7 for ; Sat, 11 Jun 2022 20:12:22 +0000 (UTC) X-FDA: 79567052124.30.9CC3A8F Received: from mail-vs1-f44.google.com (mail-vs1-f44.google.com [209.85.217.44]) by imf09.hostedemail.com (Postfix) with ESMTP id 3D804140077 for ; Sat, 11 Jun 2022 20:12:22 +0000 (UTC) Received: by mail-vs1-f44.google.com with SMTP id k4so2395714vsp.3 for ; Sat, 11 Jun 2022 13:12:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hrersHGvOicUnlt7OJEv+EsQiBVx9OyQPU1C0m5zTpc=; b=C2bvL2clKJHcY49ynfJDwWAymr9REz5ZTkgaV+oBKeJaC5gGvNhgtA3h1lPHsNOLtP Sm1BwftfVETHcDfqy8qwA+/gXJiy6BsaJWaDM4U0Dk2etI6NxQ18TzsJVgtxGuhBx7bO pibSXszpqvlc5AmroDInCrJrWaRE6cORgKAOuQ13F6dGKfL1smVr7nvLu0Cy/ppaF5ng K6Vdbyc0SImMLOZkF4JYba8W9vYwN5rT0TldmARJFa7yw931lO/EHBv8LCrbJ68/nYZc Sgoc1MU6NTlDK6nMWXe+T/b0TmglJT82cb85NA/fnW/2n8sUfvr003CsocR998iSnsAy pA+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hrersHGvOicUnlt7OJEv+EsQiBVx9OyQPU1C0m5zTpc=; b=5Dl9OJSQp5ebysddXW1sDnzaCdjr4JyLQys1nqgARLx4+7Z7pDVQI6AAn1RqLFOUlQ Ejyj5yDIlk4uJGvSqTIfA7JFfZJWQsemrV1aF6PiQWGXMY9WAZ4aBP2ADEoHm3r0ccYM feyQir9nlSm2WrZc07XiZuTfZT0cJvCbCsSYAHUAZuYmvnwcwZmkAqVOFhY3D6OUQpjB CheQ3RalWW5K5vhzfKrchvjNVrqyxjeIv3FmKdr8GgVGGDF0tOvOWHWN2CJbRDAJhzEm Vf4t5N9hFntCJo3rwNvQCzjmqRsh+BXdE7I82LURbl9fDmIVosZtPhctX0n1gBcKw4xd plUg== X-Gm-Message-State: AOAM530EkavhJrl43O4SHiAJO7zwKByZ3gb7bk4xhdYKops0C0Q87Bcp 0nADCOEZNgUEpSscZvtmRBtilxwU9wbS56TJ2c7tBw== X-Google-Smtp-Source: ABdhPJyCoHzk5AG6VcTGyAIQ4af/v1Jm7auvhoa9RGQJQ8p0wTxCRQfDh+0ZDN9UVQb+zvt86ykc8VXovNKg3+8Ehlc= X-Received: by 2002:a05:6102:214c:b0:34b:b31d:1a50 with SMTP id h12-20020a056102214c00b0034bb31d1a50mr15175372vsg.41.1654978341334; Sat, 11 Jun 2022 13:12:21 -0700 (PDT) MIME-Version: 1.0 References: <20220504002554.654642-1-Liam.Howlett@oracle.com> <20220504011345.662299-1-Liam.Howlett@oracle.com> <20220504011345.662299-13-Liam.Howlett@oracle.com> <20220606161940.fh5edq5nyz4jru2u@revolver> In-Reply-To: From: Yu Zhao Date: Sat, 11 Jun 2022 14:11:45 -0600 Message-ID: Subject: Re: [PATCH v9 28/69] mm/mmap: reorganize munmap to use maple states To: Liam Howlett Cc: Qian Cai , "maple-tree@lists.infradead.org" , "linux-mm@kvack.org" , "linux-kernel@vger.kernel.org" , Andrew Morton Content-Type: text/plain; charset="UTF-8" ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1654978342; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=hrersHGvOicUnlt7OJEv+EsQiBVx9OyQPU1C0m5zTpc=; b=gF9rel9/gwkhlYHyNLfByWsoWQtouRcWfUe/W4Ofk1dqRUu2Fdhz0jxXqMsrq9ZDwFdH7p yqDsqj32PUPG2Qfr+93KQoUEIqrlqejfTOkdCur2qnRVs1xTDcvYlvKQ4XNGzjqDQcEb7a 1epGLMzjeIeCOUK0E31T9AUxHwKqn0E= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1654978342; a=rsa-sha256; cv=none; b=Ghlzk6hKbeopYmeI76TTqiBEysqEG5Mmnqw+Ul7OCNi7ETK/cXmAKXXkd8r3m+uZjgHTEl 2eTSzaqAj1gYB4nLNb3nnGj1GsiaccL/zIF2W9zTnwv8m5g9n+3gTmyNSwg0FX/mFT66ei lmwK1gmHThKf52HxkAyqme469FhpS2U= ARC-Authentication-Results: i=1; imf09.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=C2bvL2cl; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf09.hostedemail.com: domain of yuzhao@google.com designates 209.85.217.44 as permitted sender) smtp.mailfrom=yuzhao@google.com X-Rspamd-Server: rspam11 X-Rspam-User: Authentication-Results: imf09.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=C2bvL2cl; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf09.hostedemail.com: domain of yuzhao@google.com designates 209.85.217.44 as permitted sender) smtp.mailfrom=yuzhao@google.com X-Stat-Signature: ky3ozwn7b1jppdgdzgf1ubnfztanjpbw X-Rspamd-Queue-Id: 3D804140077 X-HE-Tag: 1654978342-737317 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Jun 6, 2022 at 10:40 AM Qian Cai wrote: > > On Mon, Jun 06, 2022 at 04:19:52PM +0000, Liam Howlett wrote: > > Does your syscall fuzzer create a reproducer? This looks like arm64 > > and says 5.18.0-next-20220603 again. Was this bisected to the patch > > above? > > This was triggered by running the fuzzer over the weekend. > > $ trinity -C 160 > > No bisection was done. It was only brought up here because the trace > pointed to do_mas_munmap() which was introduced here. Liam, I'm getting a similar crash on arm64 -- the allocator is madvise(), not mprotect(). Please take a look. Thanks. ================================================================== BUG: KASAN: double-free or invalid-free in kmem_cache_free_bulk+0x230/0x3b0 Pointer tag: [0c], memory tag: [fe] CPU: 2 PID: 8320 Comm: stress-ng Tainted: G B W 5.19.0-rc1-lockdep+ #3 Call trace: dump_backtrace+0x1a0/0x200 show_stack+0x24/0x30 dump_stack_lvl+0x7c/0xa0 print_report+0x15c/0x524 kasan_report_invalid_free+0x64/0x84 ____kasan_slab_free+0x150/0x184 __kasan_slab_free+0x14/0x24 slab_free_freelist_hook+0x100/0x1ac kmem_cache_free_bulk+0x230/0x3b0 mas_destroy+0x10d8/0x1270 mas_store_prealloc+0xb8/0xec do_mas_align_munmap+0x398/0x694 do_mas_munmap+0xf8/0x118 __vm_munmap+0x154/0x1e0 __arm64_sys_munmap+0x44/0x54 el0_svc_common+0xfc/0x1cc do_el0_svc_compat+0x38/0x5c el0_svc_compat+0x68/0xf4 el0t_32_sync_handler+0xc0/0xf0 el0t_32_sync+0x190/0x194 Allocated by task 8437: kasan_set_track+0x4c/0x7c __kasan_slab_alloc+0x84/0xa8 kmem_cache_alloc_bulk+0x300/0x408 mas_alloc_nodes+0x198/0x294 mas_preallocate+0x8c/0x110 __vma_adjust+0x174/0xc88 vma_merge+0x2e4/0x300 do_madvise+0x504/0xd20 __arm64_sys_madvise+0x54/0x64 el0_svc_common+0xfc/0x1cc do_el0_svc_compat+0x38/0x5c el0_svc_compat+0x68/0xf4 el0t_32_sync_handler+0xc0/0xf0 el0t_32_sync+0x190/0x194 Freed by task 8320: kasan_set_track+0x4c/0x7c kasan_set_free_info+0x2c/0x38 ____kasan_slab_free+0x13c/0x184 __kasan_slab_free+0x14/0x24 slab_free_freelist_hook+0x100/0x1ac kmem_cache_free+0x11c/0x264 mt_destroy_walk+0x6d8/0x714 mas_wmb_replace+0x9d4/0xa68 mas_spanning_rebalance+0x1af0/0x1d2c mas_wr_spanning_store+0x908/0x964 mas_wr_store_entry+0x53c/0x5c0 mas_store_prealloc+0x88/0xec do_mas_align_munmap+0x398/0x694 do_mas_munmap+0xf8/0x118 __vm_munmap+0x154/0x1e0 __arm64_sys_munmap+0x44/0x54 el0_svc_common+0xfc/0x1cc do_el0_svc_compat+0x38/0x5c el0_svc_compat+0x68/0xf4 el0t_32_sync_handler+0xc0/0xf0 el0t_32_sync+0x190/0x194 The buggy address belongs to the object at ffffff808b5f0a00 which belongs to the cache maple_node of size 256 The buggy address is located 0 bytes inside of 256-byte region [ffffff808b5f0a00, ffffff808b5f0b00) The buggy address belongs to the physical page: page:fffffffe022d7c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xcffff808b5f0a00 pfn:0x10b5f0 head:fffffffe022d7c00 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x8000000000010200(slab|head|zone=2|kasantag=0x0) raw: 8000000000010200 fffffffe031a8608 fffffffe021a3608 caffff808002c800 raw: 0cffff808b5f0a00 0000000000150013 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffff808b5f0800: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ffffff808b5f0900: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe >ffffff808b5f0a00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ^ ffffff808b5f0b00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ffffff808b5f0c00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ==================================================================