Re: [linux-next:master] [mm/vmalloc] ff6f2b81ea: WARNING:at_kernel/fork.c:#vm_area_init_from

[Uladzislau Rezki <urezki@gmail.com>]

Hello, Andrew, Liu Ye.

>
> Hello,
> 
> kernel test robot noticed "WARNING:at_kernel/fork.c:#vm_area_init_from" on:
> 
> commit: ff6f2b81eaa8a9fe5d158c6e7b1e58d3929c32c1 ("mm/vmalloc: move free_vm_area(area) from the __vmalloc_area_node function to the __vmalloc_node_range_noprof function")
> https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
> 
> [test failed on linux-next/master 0a2f889128969dab41861b6e40111aa03dc57014]
> 
> in testcase: trinity
> version: 
> with following parameters:
> 
> 	runtime: 300s
> 	group: group-02
> 	nr_groups: 5
> 
> 
> 
> config: x86_64-randconfig-101-20250306
> compiler: gcc-12
> test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
> 
> (please refer to attached dmesg/kmsg for entire log/backtrace)
> 
> 
> +-------------------------------------------------------------+------------+------------+
> |                                                             | fb8faf4337 | ff6f2b81ea |
> +-------------------------------------------------------------+------------+------------+
> | boot_successes                                              | 9          | 0          |
> | boot_failures                                               | 0          | 6          |
> | WARNING:at_kernel/fork.c:#vm_area_init_from                 | 0          | 6          |
> | RIP:vm_area_init_from                                       | 0          | 6          |
> | BUG:KASAN:slab-use-after-free_in__vmalloc_node_range_noprof | 0          | 5          |
> | WARNING:at_mm/vmalloc.c:#remove_vm_area                     | 0          | 5          |
> | RIP:remove_vm_area                                          | 0          | 5          |
> | kernel_BUG_at_mm/vmalloc.c                                  | 0          | 5          |
> | Oops:invalid_opcode:#[##]PREEMPT_KASAN                      | 0          | 5          |
> | RIP:__vmalloc_node_range_noprof                             | 0          | 5          |
> | Kernel_panic-not_syncing:Fatal_exception                    | 0          | 5          |
> +-------------------------------------------------------------+------------+------------+
> 
The patch that is in question, indeed, looks buggy. At least i can see
how a use-after-free can occur:

<snip>
static void *__vmalloc_area_node(...)
...
fail:
	vfree(area->addr);
	return NULL;
}
<snip>

<snip>
...
ret = __vmalloc_area_node(area, gfp_mask, prot, shift, node);
if (!ret) {
  free_vm_area(area);
  goto fail;
}
...
<snip>

vfree() - __also__ frees "vm_struct" where "area" points to. A NULL is
returned and free_vm_area() is invoked one more time on already freed
"area". 

Probably it is better to drop the below patch:

ff6f2b81eaa8a9fe5d158c6e7b1e58d3929c32c1 ("mm/vmalloc: move free_vm_area(area) from the __vmalloc_area_node function to the __vmalloc_node_range_noprof function")

--
Uladzislau Rezki