From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3206FC433F5 for ; Fri, 25 Feb 2022 03:49:08 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A84F88D0003; Thu, 24 Feb 2022 22:49:07 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id A326B8D0001; Thu, 24 Feb 2022 22:49:07 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 922088D0003; Thu, 24 Feb 2022 22:49:07 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (relay.hostedemail.com [64.99.140.28]) by kanga.kvack.org (Postfix) with ESMTP id 828DF8D0001 for ; Thu, 24 Feb 2022 22:49:07 -0500 (EST) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay11.hostedemail.com (Postfix) with ESMTP id 4BD3880399 for ; Fri, 25 Feb 2022 03:49:07 +0000 (UTC) X-FDA: 79179921534.05.46DC290 Received: from alexa-out.qualcomm.com (alexa-out.qualcomm.com [129.46.98.28]) by imf06.hostedemail.com (Postfix) with ESMTP id 84A8F180008 for ; Fri, 25 Feb 2022 03:49:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicinc.com; i=@quicinc.com; q=dns/txt; s=qcdkim; t=1645760946; x=1677296946; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=+GmEtbJHUXbE+Po2IsyLyIuclbbwW7xPrf0hGwrDUo0=; b=r2QhA9km++7aZUa0C3RLwFZi4DHhlaXDAZ8auxl6iFD0QfLEoxwojAOD A1G3h5eOEvcIUxYFD/NekLuFKOL5XG3qglmxFRjAQgoBxuObZYbCC/C0g ewwkXo2IIILkpskAveXRA5YuXbCxtJmU/s6VclFPn/0J2deKnTI4zYMOf 4=; Received: from ironmsg09-lv.qualcomm.com ([10.47.202.153]) by alexa-out.qualcomm.com with ESMTP; 24 Feb 2022 19:49:05 -0800 X-QCInternal: smtphost Received: from nasanex01c.na.qualcomm.com ([10.47.97.222]) by ironmsg09-lv.qualcomm.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Feb 2022 19:49:05 -0800 Received: from nalasex01a.na.qualcomm.com (10.47.209.196) by nasanex01c.na.qualcomm.com (10.47.97.222) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.15; Thu, 24 Feb 2022 19:49:03 -0800 Received: from qian (10.80.80.8) by nalasex01a.na.qualcomm.com (10.47.209.196) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.15; Thu, 24 Feb 2022 19:49:02 -0800 Date: Thu, 24 Feb 2022 22:49:00 -0500 From: Qian Cai To: Liam Howlett CC: "maple-tree@lists.infradead.org" , "linux-mm@kvack.org" , "linux-kernel@vger.kernel.org" , Andrew Morton Subject: Re: [PATCH v6 00/71] Introducing the Maple Tree Message-ID: References: <20220215143728.3810954-1-Liam.Howlett@oracle.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline In-Reply-To: <20220215143728.3810954-1-Liam.Howlett@oracle.com> X-Originating-IP: [10.80.80.8] X-ClientProxiedBy: nasanex01b.na.qualcomm.com (10.46.141.250) To nalasex01a.na.qualcomm.com (10.47.209.196) X-Rspamd-Queue-Id: 84A8F180008 X-Stat-Signature: bpp17ff7cbz8afzgratk9655ac4z7pyk X-Rspam-User: Authentication-Results: imf06.hostedemail.com; dkim=pass header.d=quicinc.com header.s=qcdkim header.b=r2QhA9km; spf=pass (imf06.hostedemail.com: domain of quic_qiancai@quicinc.com designates 129.46.98.28 as permitted sender) smtp.mailfrom=quic_qiancai@quicinc.com; dmarc=pass (policy=none) header.from=quicinc.com X-Rspamd-Server: rspam05 X-HE-Tag: 1645760946-89927 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Feb 15, 2022 at 02:37:44PM +0000, Liam Howlett wrote: > The maple tree is an RCU-safe range based B-tree designed to use modern > processor cache efficiently. There are a number of places in the kernel > that a non-overlapping range-based tree would be beneficial, especially > one with a simple interface. The first user that is covered in this > patch set is the vm_area_struct, where three data structures are > replaced by the maple tree: the augmented rbtree, the vma cache, and the > linked list of VMAs in the mm_struct. The long term goal is to reduce > or remove the mmap_sem contention. > > The tree has a branching factor of 10 for non-leaf nodes and 16 for leaf > nodes. With the increased branching factor, it is significantly shorter than > the rbtree so it has fewer cache misses. The removal of the linked list > between subsequent entries also reduces the cache misses and the need to pull > in the previous and next VMA during many tree alterations. > > This patch is based on v5.17-rc4 > > git: https://github.com/oracle/linux-uek/tree/howlett/maple/20220214 Just a heads-up. I noticed an use-after-free in today's linux-next below. I am running out of time to fully triage this, but I noticed this is the only series (not sure which revision) heavily touched mm/mmap.c recently there. BUG: KASAN: use-after-free in move_vma.isra.0 Read of size 8 at addr ffff0009ce752ac8 by task systemd-logind/1280 CPU: 21 PID: 1280 Comm: systemd-logind Not tainted 5.17.0-rc5-next-20220223-dirty #242 Hardware name: MiTAC RAPTOR EV-883832-X3-0001/RAPTOR, BIOS 1.6 06/28/2020 Call trace: dump_backtrace show_stack dump_stack_lvl print_address_description.constprop.0 kasan_report __asan_report_load8_noabort move_vma.isra.0 move_vma at /usr/src/linux-next/mm/mremap.c:714 __do_sys_mremap __arm64_sys_mremap invoke_syscall el0_svc_common.constprop.0 do_el0_svc el0_svc el0t_64_sync_handler el0t_64_sync Allocated by task 1280: kasan_save_stack __kasan_slab_alloc slab_post_alloc_hook kmem_cache_alloc vm_area_alloc vm_area_alloc at /usr/src/linux-next/kernel/fork.c:455 mmap_region mmap_region at /usr/src/linux-next/mm/mmap.c:2585 do_mmap vm_mmap_pgoff ksys_mmap_pgoff __arm64_sys_mmap invoke_syscall el0_svc_common.constprop.0 do_el0_svc el0_svc el0t_64_sync_handler el0t_64_sync Freed by task 1280: kasan_save_stack kasan_set_track kasan_set_free_info __kasan_slab_free kmem_cache_free vm_area_free remove_vma remove_vma at /usr/src/linux-next/mm/mmap.c:187 do_mas_align_munmap.isra.0 remove_mt at /usr/src/linux-next/mm/mmap.c:2176 (inlined by) do_mas_align_munmap at /usr/src/linux-next/mm/mmap.c:2437 do_mas_munmap do_mas_munmap at /usr/src/linux-next/mm/mmap.c:2483 do_munmap move_vma.isra.0 __do_sys_mremap __arm64_sys_mremap invoke_syscall el0_svc_common.constprop.0 do_el0_svc el0_svc el0t_64_sync_handler el0t_64_sync The buggy address belongs to the object at ffff0009ce752aa8 which belongs to the cache vm_area_struct of size 144 The buggy address is located 32 bytes inside of 144-byte region [ffff0009ce752aa8, ffff0009ce752b38) The buggy address belongs to the page: page:fffffc002739d400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xa4e750 head:fffffc002739d400 order:2 compound_mapcount:0 compound_pincount:0 memcg:ffff0009ce456e01 flags: 0xbfffc0000010200(slab|head|node=0|zone=2|lastcpupid=0xffff) raw: 0bfffc0000010200 fffffc002739f108 fffffc00273a3b08 ffff000800f53380 raw: 0000000000000000 0000000000210021 00000001ffffffff ffff0009ce456e01 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0009ce752980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0009ce752a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff0009ce752a80: fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb ^ ffff0009ce752b00: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc ffff0009ce752b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc