From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A1301C282DE for ; Thu, 13 Mar 2025 08:49:05 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id ABF22280004; Thu, 13 Mar 2025 04:49:04 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A6F46280002; Thu, 13 Mar 2025 04:49:04 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 93728280004; Thu, 13 Mar 2025 04:49:04 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 7861F280002 for ; Thu, 13 Mar 2025 04:49:04 -0400 (EDT) Received: from smtpin27.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 48A71161D13 for ; Thu, 13 Mar 2025 08:49:04 +0000 (UTC) X-FDA: 83215903008.27.91C5F58 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.7]) by imf27.hostedemail.com (Postfix) with ESMTP id 85EB240002 for ; Thu, 13 Mar 2025 08:49:01 +0000 (UTC) Authentication-Results: imf27.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=PpF8oZ5h; dmarc=pass (policy=none) header.from=intel.com; spf=none (imf27.hostedemail.com: domain of yi1.lai@linux.intel.com has no SPF policy when checking 192.198.163.7) smtp.mailfrom=yi1.lai@linux.intel.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1741855742; a=rsa-sha256; cv=none; b=QybJ7lsWxn3V+J/0VD2XJ1t+V9TyjzZDCBNY4/ALrP6UFYO1jrPpGOjyCBjjj8l3XPiHSX p6JIcttpQ3QsY0AY4IX1Dqrv1f9NypoHSJTA7m5P1oa2fdujMe3mypjRhf01oS6j6WP0ix ZN7UE/eQnm5saNfxU3Hd7yhkMCDDeiM= ARC-Authentication-Results: i=1; imf27.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=PpF8oZ5h; dmarc=pass (policy=none) header.from=intel.com; spf=none (imf27.hostedemail.com: domain of yi1.lai@linux.intel.com has no SPF policy when checking 192.198.163.7) smtp.mailfrom=yi1.lai@linux.intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1741855742; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=pzBD8SaW2z11YJNkUhi4E3xdXOgt0IVmQPyTkoyEvSY=; b=SHdDZfkfpXtgSAF7hFt+LQpnfOvfyhSm1L1Jv37s6bgD4b3N/qRFTkWtMaXx+YOAinZ/gP g9lcGWPka69GP/k7eSLrcGdK0/eR/iDfM6whctRbwrg3YQI9Fkt9jMo1xtw4dBHsYIaRUR wncgdpT3LWUas4lvlPG9IrOrNWdNNuw= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1741855741; x=1773391741; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=9f0JOqyRUMhXsUhRmX2GVvdZOo3DRyh/LFwUWvB8TxM=; b=PpF8oZ5hgKxd6+HWwJS5rDgurklAU62PyIxbRnlkxbVrrhYrNTQveAnT ObY7knyjVxm7QZ2D7yLsS1OcAPK8q06QCGIolwnQuDtw+VbqNJJfGs42s gFC3CT2GD0VwILJ3d2oeeWQlC586rIc56t8yauflZwOPbVQzZMfhuIB7t ZDj76PF/w61NU8GwZFpXxUbpSc1bNX4a2h8G5beZp4ZdbKwuz8k+vlKbP Idj6t3YMc+KzEzKkSmPAQdjZh4s/jsF8znDlpAuATS3TzAIgdSFDjkXm4 1WMQZPFk/wXvVw9zxAgJueLB35YYUqI7CQtGMt+f8MZYrOPsYnn4dr+9H g==; X-CSE-ConnectionGUID: P4xgf8QRQ1+fMsIho/FIVQ== X-CSE-MsgGUID: +dBowGDwQ0Olwa/atpCyqA== X-IronPort-AV: E=McAfee;i="6700,10204,11371"; a="68316863" X-IronPort-AV: E=Sophos;i="6.14,244,1736841600"; d="scan'208";a="68316863" Received: from orviesa008.jf.intel.com ([10.64.159.148]) by fmvoesa101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 13 Mar 2025 01:48:59 -0700 X-CSE-ConnectionGUID: usuzdrgKRqCI5BX5Ll9AWA== X-CSE-MsgGUID: kZ1hbXwuR66meUsS/FUERg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.14,244,1736841600"; d="scan'208";a="121811468" Received: from ly-workstation.sh.intel.com (HELO ly-workstation) ([10.239.161.23]) by orviesa008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 13 Mar 2025 01:48:57 -0700 Date: Thu, 13 Mar 2025 16:49:19 +0800 From: "Lai, Yi" To: Liu Ye Cc: akpm@linux-foundation.org, urezki@gmail.com, hch@infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, yi1.lai@intel.com, syzkaller-bugs@googlegroups.com Subject: Re: [PATCH] mm/vmalloc: Move free_vm_area(area) from the __vmalloc_area_node function to the __vmalloc_node_range_noprof function Message-ID: References: <20250303015702.319416-1-liuye@kylinos.cn> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20250303015702.319416-1-liuye@kylinos.cn> X-Rspamd-Server: rspam07 X-Rspam-User: X-Stat-Signature: k6ohwsoctyguzg7p8fue8c68gxutf7a5 X-Rspamd-Queue-Id: 85EB240002 X-HE-Tag: 1741855741-325106 X-HE-Meta: U2FsdGVkX1/yomYAJBREjT3KSOHW3tDb6GDs8dhZ46tn28Fpvb4VCRVL0te2C+KLcD+cWnAziRo0ASHHoFOMjI2bPTzTWL2HSNVBlJVe1jmNZyFT79IpARRN/OhpbX6oYeD9nrbGEpp+R+3/nHOVDxunO/kpsZ4COUT3YP9fvUtDIW8Tq5hjEKcpOcYcovMHO+wAEEFzNL2QfhR13BoYVLOinQq0xCuTbz6JACpF7jYEvES1wWMiBtXARWdr/eOJ5B3KCIl5XjkRbW7GLQLmBiEJ2dirQ694vTGBjJnQB4JWwHvBjcdXuh7S8kJf+ZMXL9BRDSCe8H3uhBbEMliM86a2sWyQ5O3E8N/0R0XujAYwP7sb6ekQJ5KvF8hEKhvXEf09i/6E/evg+IhVv24C+Ip8CRVsm97TZxmU2IKMeI3y0Xb0lx/nWEylLaQf/0eWvDbDgsBxuMb3EPfY7DazJsAMp/HhInzNpDB+9grEoIYLY6naGlLMmn948d9Vw7r8VZSbZxTGv9I7ilhUiufjQX72IQ87yOMWCK8pcg8Gn296vJh8N4tpdE4/8zZBPL7Tm65PP35bQAU7yzBmj/jPhikHGDRr0Ep00ZvwSZPDAGGK59BvU04u5T191plrm4S0vF0nYA13Gx6+6NabhRk6t5i1jVutLDSnB2vBCbYIWQQe0r57Jl60Pr7PuqEg23HW/zUazYajJIQwNITu/OxTjcEWM3aqIlSnCd2XmIR2RgZ0kA86KxmKvyJUfwhYHIMYsV73KqBQtLJ1mD3fU7feYGjhseMeQAS6Sces56AgqMOiIBrENTNZN6z5yvhFiq93h9ucW2FaFGLgjHklVlwolFj3+qx5k7IzEn1TA0eN/3AwIGNdS8ErqA9GJZqUE9K+xOusvg2rskblT0y6IShEl44F0WW8ADHPRUholUJmG15AHqkRWBgsAfHOsE5WqSANHIXJcdVN7XecJNUI7uL p1iF9qZM LTk4wUz0dhTD8kZQQ7Yv9i3aNMfiSDExmaUI5vNhY5aZnhmvhrGgIXKi3OrkfH3IRt4Yioyots89oCAkIaKAVt5Kn+gIWrX7xgLjkuNDG82VcsfovbQH/GHvyMJ/dSjRz0mFv0xxWTy59h886bQARuMeVUdaS2hku2MbkNAYc4fzppyoImTYa40XfVis5nxUQ38JxO2p3pOWKPzwDQiihsCBMoCe2uGhv9EOvxJj6cc9FvnLrM3jVs17L5w4uFMpg1vc41seNlszaaq+LH3kmD5qSkRLR+pYMbP+0IVVuKu4bodm71jfsutwsRqjwLkLNpz5rWIQ82VxPn2M= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Mon, Mar 03, 2025 at 09:57:02AM +0800, Liu Ye wrote: > Moved free_vm_area from the __vmalloc_area_node function to the > __vmalloc_node_range_noprof function so that allocation and freeing > of the area can be paired in one function for better readability. > > Signed-off-by: Liu Ye > --- > mm/vmalloc.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/mm/vmalloc.c b/mm/vmalloc.c > index a6e7acebe9ad..dc658d4af181 100644 > --- a/mm/vmalloc.c > +++ b/mm/vmalloc.c > @@ -3651,7 +3651,6 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask, > warn_alloc(gfp_mask, NULL, > "vmalloc error: size %lu, failed to allocated page array size %lu", > nr_small_pages * PAGE_SIZE, array_size); > - free_vm_area(area); > return NULL; > } > > @@ -3844,8 +3843,10 @@ void *__vmalloc_node_range_noprof(unsigned long size, unsigned long align, > > /* Allocate physical pages and map them into vmalloc space. */ > ret = __vmalloc_area_node(area, gfp_mask, prot, shift, node); > - if (!ret) > + if (!ret) { > + free_vm_area(area); > goto fail; > + } > > /* > * Mark the pages as accessible, now that they are mapped. > -- > 2.25.1 > Hi Liu Yue, Greetings! I used Syzkaller and found that there is KASAN: slab-use-after-free Read in iommufd_test in linux-next tag - next-20250311. After bisection and the first bad commit is: " 35388cb1e37e mm/vmalloc: move free_vm_area(area) from the __vmalloc_area_node function to the __vmalloc_node_range_noprof function " All detailed into can be found at: https://github.com/laifryiee/syzkaller_logs/tree/main/250312_233425_iommufd_test Syzkaller repro code: https://github.com/laifryiee/syzkaller_logs/tree/main/250312_233425_iommufd_test/repro.c Syzkaller repro syscall steps: https://github.com/laifryiee/syzkaller_logs/tree/main/250312_233425_iommufd_test/repro.prog Syzkaller report: https://github.com/laifryiee/syzkaller_logs/tree/main/250312_233425_iommufd_test/repro.report Kconfig(make olddefconfig): https://github.com/laifryiee/syzkaller_logs/tree/main/250312_233425_iommufd_test/kconfig_origin Bisect info: https://github.com/laifryiee/syzkaller_logs/tree/main/250312_233425_iommufd_test/bisect_info.log bzImage: https://github.com/laifryiee/syzkaller_logs/raw/refs/heads/main/250312_233425_iommufd_test/bzImage_eea255893718268e1ab852fb52f70c613d109b99 Issue dmesg: https://github.com/laifryiee/syzkaller_logs/blob/main/250312_233425_iommufd_test/eea255893718268e1ab852fb52f70c613d109b99_dmesg.log " [ 22.060519] ? __vmalloc_node_range_noprof+0x1344/0x1420 [ 22.060529] __asan_report_load8_noabort+0x18/0x20 [ 22.060540] __vmalloc_node_range_noprof+0x1344/0x1420 [ 22.060552] ? iommufd_test+0x2d8/0x4b00 [ 22.060565] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 22.060575] ? debug_smp_processor_id+0x20/0x30 [ 22.060588] __kvmalloc_node_noprof+0x2a9/0x6a0 [ 22.060596] ? iommufd_test+0x2d8/0x4b00 [ 22.060603] ? __fget_files+0x204/0x3b0 [ 22.060613] ? iommufd_test+0x2d8/0x4b00 [ 22.060623] iommufd_test+0x2d8/0x4b00 [ 22.060629] ? iommufd_test+0x2d8/0x4b00 [ 22.060637] ? __this_cpu_preempt_check+0x21/0x30 [ 22.060650] ? __pfx_iommufd_test+0x10/0x10 [ 22.060661] ? __might_fault+0xf1/0x1b0 [ 22.060672] ? __sanitizer_cov_trace_const_cmp8+0x1c/0x30 [ 22.060683] iommufd_fops_ioctl+0x38e/0x520 [ 22.060693] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 22.060704] ? __this_cpu_preempt_check+0x21/0x30 [ 22.060713] ? seqcount_lockdep_reader_access.constprop.0+0xb4/0xd0 [ 22.060723] ? lockdep_hardirqs_on+0x89/0x110 [ 22.060734] ? ktime_get_coarse_real_ts64+0xb6/0x100 [ 22.060745] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 22.060754] __x64_sys_ioctl+0x1ba/0x220 [ 22.060764] x64_sys_call+0x1233/0x2150 [ 22.060771] do_syscall_64+0x6d/0x140 [ 22.060780] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 22.060787] RIP: 0033:0x7f60b7c3ee5d [ 22.060793] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 93 af 1b 00 f7 d8 64 89 01 48 [ 22.060800] RSP: 002b:00007ffe0d196758 EFLAGS: 00000213 ORIG_RAX: 0000000000000010 [ 22.060807] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f60b7c3ee5d [ 22.060811] RDX: 0000000020000440 RSI: 0000000000003ba0 RDI: 0000000000000003 [ 22.060815] RBP: 00007ffe0d196770 R08: 00007ffe0d196770 R09: 00007ffe0d196770 [ 22.060820] R10: 00007ffe0d196770 R11: 0000000000000213 R12: 00007ffe0d1968c8 [ 22.060824] R13: 000000000040188f R14: 0000000000403e08 R15: 00007f60b800d000 [ 22.060835] [ 22.060840] [ 22.072913] Allocated by task 1316: [ 22.073094] kasan_save_stack+0x2c/0x60 [ 22.073298] kasan_save_track+0x18/0x40 [ 22.073499] kasan_save_alloc_info+0x3c/0x50 [ 22.073723] __kasan_kmalloc+0x88/0xa0 [ 22.073926] __kmalloc_cache_node_noprof+0x1d0/0x470 [ 22.074179] __get_vm_area_node+0xf7/0x260 [ 22.074391] __vmalloc_node_range_noprof+0x25c/0x1420 [ 22.074650] __kvmalloc_node_noprof+0x2a9/0x6a0 [ 22.074888] iommufd_test+0x2d8/0x4b00 [ 22.075085] iommufd_fops_ioctl+0x38e/0x520 [ 22.075308] __x64_sys_ioctl+0x1ba/0x220 [ 22.075517] x64_sys_call+0x1233/0x2150 [ 22.075719] do_syscall_64+0x6d/0x140 [ 22.075917] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 22.076171] [ 22.076261] Freed by task 1316: [ 22.076428] kasan_save_stack+0x2c/0x60 [ 22.076628] kasan_save_track+0x18/0x40 [ 22.076833] kasan_save_free_info+0x3f/0x60 [ 22.077054] __kasan_slab_free+0x3d/0x60 [ 22.077258] kfree+0x28d/0x440 [ 22.077423] vfree+0x2ce/0x910 [ 22.077590] __vmalloc_node_range_noprof+0xeca/0x1420 [ 22.077854] __kvmalloc_node_noprof+0x2a9/0x6a0 [ 22.078094] iommufd_test+0x2d8/0x4b00 [ 22.078293] iommufd_fops_ioctl+0x38e/0x520 [ 22.078512] __x64_sys_ioctl+0x1ba/0x220 [ 22.078724] x64_sys_call+0x1233/0x2150 [ 22.078931] do_syscall_64+0x6d/0x140 [ 22.079128] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 22.079388] [ 22.079478] The buggy address belongs to the object at ffff88804f5ce500 [ 22.079478] which belongs to the cache kmalloc-64 of size 64 [ 22.080073] The buggy address is located 8 bytes inside of [ 22.080073] freed 64-byte region [ffff88804f5ce500, ffff88804f5ce540) [ 22.080655] [ 22.080744] The buggy address belongs to the physical page: [ 22.081024] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4f5ce [ 22.081415] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) [ 22.081742] page_type: f5(slab) [ 22.081917] raw: 000fffffc0000000 ffff88800d4418c0 dead000000000122 0000000000000000 [ 22.082297] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 22.082678] page dumped because: kasan: bad access detected [ 22.082956] [ 22.083045] Memory state around the buggy address: [ 22.083287] ffff88804f5ce400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 22.083646] ffff88804f5ce480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 22.084004] >ffff88804f5ce500: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 22.084361] ^ [ 22.084542] ffff88804f5ce580: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 22.084903] ffff88804f5ce600: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 22.085263] ================================================================== [ 22.085708] Disabling lock debugging due to kernel taint [ 22.087471] ------------[ cut here ]------------ [ 22.087732] Trying to vfree() bad address (000000006b1be3e6) [ 22.088039] WARNING: CPU: 1 PID: 1317 at mm/vmalloc.c:3231 remove_vm_area+0x1c2/0x220 [ 22.088421] Modules linked in: [ 22.088590] CPU: 1 UID: 0 PID: 1317 Comm: repro Tainted: G B 6.14.0-rc6-next-20250311-eea255893718 #1 [ 22.089126] Tainted: [B]=BAD_PAGE [ 22.089308] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 22.089869] RIP: 0010:remove_vm_area+0x1c2/0x220 [ 22.090112] Code: c3 cc cc cc cc e8 7e e2 a4 ff 49 81 ee 00 10 00 00 e9 51 ff ff ff e8 6d e2 a4 ff 4c 89 e6 48 c7 c7 a0 eb fa 85 e8 ce 71 63 ff <0f> 0b 45 31 ed eb bb 45 31 ed eb b6 e8 ed d2 0f 00 e9 10 ff ff ff [ 22.090996] ------------[ cut here ]------------ [ 22.091042] RSP: 0018:ffff888022b77978 EFLAGS: 00010292 [ 22.091274] Trying to vfree() bad address (00000000e905f2d4) " Hope this cound be insightful to you. Regards, Yi Lai --- If you don't need the following environment to reproduce the problem or if you already have one reproduced environment, please ignore the following information. How to reproduce: git clone https://gitlab.com/xupengfe/repro_vm_env.git cd repro_vm_env tar -xvf repro_vm_env.tar.gz cd repro_vm_env; ./start3.sh // it needs qemu-system-x86_64 and I used v7.1.0 // start3.sh will load bzImage_2241ab53cbb5cdb08a6b2d4688feb13971058f65 v6.2-rc5 kernel // You could change the bzImage_xxx as you want // Maybe you need to remove line "-drive if=pflash,format=raw,readonly=on,file=./OVMF_CODE.fd \" for different qemu version You could use below command to log in, there is no password for root. ssh -p 10023 root@localhost After login vm(virtual machine) successfully, you could transfer reproduced binary to the vm by below way, and reproduce the problem in vm: gcc -pthread -o repro repro.c scp -P 10023 repro root@localhost:/root/ Get the bzImage for target kernel: Please use target kconfig and copy it to kernel_src/.config make olddefconfig make -jx bzImage //x should equal or less than cpu num your pc has Fill the bzImage file into above start3.sh to load the target kernel in vm. Tips: If you already have qemu-system-x86_64, please ignore below info. If you want to install qemu v7.1.0 version: git clone https://github.com/qemu/qemu.git cd qemu git checkout -f v7.1.0 mkdir build cd build yum install -y ninja-build.x86_64 yum -y install libslirp-devel.x86_64 ../configure --target-list=x86_64-softmmu --enable-kvm --enable-vnc --enable-gtk --enable-sdl --enable-usb-redir --enable-slirp make make install