From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23957C282DE for ; Thu, 13 Mar 2025 10:30:53 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 31FC0280003; Thu, 13 Mar 2025 06:30:52 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 2D10A280001; Thu, 13 Mar 2025 06:30:52 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 17086280003; Thu, 13 Mar 2025 06:30:52 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id EE54C280001 for ; Thu, 13 Mar 2025 06:30:51 -0400 (EDT) Received: from smtpin27.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id D80C7121E59 for ; Thu, 13 Mar 2025 10:30:51 +0000 (UTC) X-FDA: 83216159502.27.E7E0664 Received: from mail-lj1-f175.google.com (mail-lj1-f175.google.com [209.85.208.175]) by imf11.hostedemail.com (Postfix) with ESMTP id 8D56940012 for ; Thu, 13 Mar 2025 10:30:49 +0000 (UTC) Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=PWFQdWn8; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf11.hostedemail.com: domain of urezki@gmail.com designates 209.85.208.175 as permitted sender) smtp.mailfrom=urezki@gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1741861849; a=rsa-sha256; cv=none; b=QrI0kTdo+uNMZl7r31TKLQ4DYOlWy4ULzckfX8Pho9kW9yqOw/gx+zarTfd+CZ23FGiohW PK5UugHjMBzM3f4rd4uoW+3R9Qzg15vb3sy7zNRIvCb6NSk+5KLymZflQrvB/f4r2zTO+2 eZDPXgER0S8BOpuljtjS1TBuOwwtLmw= ARC-Authentication-Results: i=1; imf11.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=PWFQdWn8; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf11.hostedemail.com: domain of urezki@gmail.com designates 209.85.208.175 as permitted sender) smtp.mailfrom=urezki@gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1741861849; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=sZjGs0cMXOTlH1YOM8qzHfQxW0vfWGDOskpP04lHGjM=; b=eriDgephga7OehAJ2LEg2R57/m4JVGBzcry04POp2rfn8Mvsyq9w5UvBsLtghkksIQwr5c yfMib0mhjO8Jkf6uaITit5bbz+STYm0bTnR3UqRwJ7pRzEjW5+2gYUohMNdoGE5UZfIWuM DbMS/9shlOooKfCeus6gDwf0jDf0fCM= Received: by mail-lj1-f175.google.com with SMTP id 38308e7fff4ca-30613802a6bso9068101fa.1 for ; Thu, 13 Mar 2025 03:30:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1741861848; x=1742466648; darn=kvack.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:date:from:from:to:cc:subject:date:message-id:reply-to; bh=sZjGs0cMXOTlH1YOM8qzHfQxW0vfWGDOskpP04lHGjM=; b=PWFQdWn8AVmnxUWx9JqV9PfnrDIB9Mv81sr0DvRdkgGA6ufzf2YmiiSY39Z4R0KOAL JCzJLtZMUOSrpojJlZ8Ya1EKi60zjy6ICYBFS4L7r6k4WXAs6k0aO4xOOprZ9t1re5Rx 89wIrlNFjiroIc8cLZ246P5WvGuyae+iGfNqD+K3IN+wJ6ntHlQ+6b8pPexpzfhV/X1X pfBFk2AqfeYmzAoJ3x0bxv4KhM/rKbrs/pUdwtGmV+ibtL815mpLLa3pC0tJuzsS3/2c dI4/RuVbeMaNOEETKRJzORs/iOSTZ1VfV6Gm4dnSUZGbYhgUyJf7OzmeKgMRpqsFyf9s Tb5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1741861848; x=1742466648; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:date:from:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=sZjGs0cMXOTlH1YOM8qzHfQxW0vfWGDOskpP04lHGjM=; b=KRLMQ/PsOp1RZwr6C9Jk2i0XTPeLDIru1aayy2kF32Ytx4sfG3QuUdmSopsvT1aGkQ kxaNKvhujQaN/y+Wyp/2cpIYumZ4ycPWDbKdjm2FLj4xze5mMRBs3WNvWzuuFWdvgXAs PIB9OCuYM1VdNzHWqx0UGs2D37T4OEqyA+n75Fe+646kPQxB8qdVaiL82RzR3HI8FfL2 YRaMwFNFjwHO+HpKwQbb5GBObmUBl5MymJ9NsdG8wp/cIcnaHK9zV9y04t9XzYTqfX1E XUdlESvBYdv1j9ZoDSWy/ASbJ9E6vr4qIDbdmnM/5W2xOuIVZtscsH7+15fFLM5WRn0Y Ha/Q== X-Forwarded-Encrypted: i=1; AJvYcCXlC0vN5sbK+vt8fvEc4DbgukXKg65jnO1VP+Z2GXXUtOmDSHd8GkHcbN+RITIE5gJLzfUAKw/9iQ==@kvack.org X-Gm-Message-State: AOJu0YzhvEtYzpBnRsqLrjHW/Y56s7kcCTIb21a5VyoLtvO62bdnh9RU FXgMOIwxNVR1FBjPbHAoMYMQ8Tq+65tXuypZHUeDTksaXR4NCceu X-Gm-Gg: ASbGnct+AbN182emTmcoUbX9LwkyfYTU4iaKkIRutT4wc6paBbirmM0NUHjsX9hF0dk uNt8ia+hLcCilemlwWGsQcLAT+yOD69+FdiGEMXa8Aazg0kBRb33+zTiBpRTWvhs62i07uXc7QL 7ORikpm3JiyOj6g4om7U/Bq38dZ4bKy9NB1kMdOfM8O8rC1oJ/TVc06Y2wgp4KQcFZ1hOk57r8X L39BXpHabw2QjowKqTwNsssZI1pzxho9RU2Q+1lA1k73AIDIPqAY52JsBB4bzmUTM1aILXynzoR 1toVNlvN3YMrzeXBNXO2JHCLvOw1LmirSkDVmF4k/qJFF7w0W+CwtHjJJ2oEyrwmuGE= X-Google-Smtp-Source: AGHT+IFvvahiEEAW7PjOsHbQgqZManuLHLrrCeGI9E0+NgKOuOh6aEeLF8/6yuAARoWKTyaBazx1RA== X-Received: by 2002:a05:6512:3da4:b0:549:39b1:65c6 with SMTP id 2adb3069b0e04-54990eaa699mr9463192e87.34.1741861847281; Thu, 13 Mar 2025 03:30:47 -0700 (PDT) Received: from pc636 (host-95-203-6-24.mobileonline.telia.com. [95.203.6.24]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-549ba7a81c6sm169596e87.5.2025.03.13.03.30.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Mar 2025 03:30:46 -0700 (PDT) From: Uladzislau Rezki X-Google-Original-From: Uladzislau Rezki Date: Thu, 13 Mar 2025 11:30:44 +0100 To: Dev Jain Cc: "Lai, Yi" , Liu Ye , akpm@linux-foundation.org, urezki@gmail.com, hch@infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, yi1.lai@intel.com Subject: Re: [PATCH] mm/vmalloc: Move free_vm_area(area) from the __vmalloc_area_node function to the __vmalloc_node_range_noprof function Message-ID: References: <20250303015702.319416-1-liuye@kylinos.cn> <76e11ff2-0247-4221-b95a-d73998c8cea7@arm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <76e11ff2-0247-4221-b95a-d73998c8cea7@arm.com> X-Rspamd-Server: rspam07 X-Rspam-User: X-Stat-Signature: 4oaz9g1y4s11r4bazqzmhhz9ntafmdb9 X-Rspamd-Queue-Id: 8D56940012 X-HE-Tag: 1741861849-95287 X-HE-Meta: U2FsdGVkX1/hAX9a0CMtS/z/gq5w/D9MdB+oUBEGiCiozhE8GtPB//xY5V1qaJAHxU1qNlaeXJSuKlZ2j9GIbTIZJ8e7nEJlYvfRPA8MEXqsLPWLxOmdZMe97XKH//AQoQ+A0lTc7pPJWkaAieOs7YIqqEgxq0FMlb8QSLLWhopA9QunXmfTDjZGDOu2FYxhemZAtHKkJXvRycZ3ZSVbx4sDnO6jpv/s3KPzSFCCb9OwNFj2/Cq9LGkz0FFsh3+kLGq7EySM4b5hZ5sqhpQc9Bqivp7PwNPmMKdLgq7adLpBAZAu0tYMJ67MNC5NY8aigMXmIolwWD1P/aqZduiWtJyX+LyftyE9WtQuxIjIhbGbO3i0s4EkEU4VqSacaMx9Tvm6JMiltu+KpsuvG4Cv0sFwwWgtK+vfOttF4FvLLSzzArlYcDAlsFTWQDGBcPYYvp58WOg4qT27bCJFW2GgPqsSmCsCw7By1XXQCbvopdmFEGjG226G8zthMfgBbTY8BO6UarxH8HsujrtCmshk5LgZq0TTAIkR2LCFAkqglGlWUTVb97LHyoROJwqqCghUNIrwJM32Nm2QRgw+s2NHp319w75GKA8nQzjq6mBVMJ48K+TcQFxtm8fMjvMzLe+xw3TrS+6OharOkNgxkyGpqTGT1VlBF5ApV/sSipsqYJX+NmV3REctrQzEOH3jsOUDPypMNeP+/V9FWMVKQlIX6G6bQklj85M9v3Hl+hGzQSzUeIip7ceilAzud6v9iAoHorEB3xc56sagZWIOiKTn4a+oL8WYFsp9Q4Kl+XbMlpu6bixt3P4ieR9HCf1YQW3sSv0cW4M6HrVm+XwJR1qIqUujUiDrcGMZOBbdmmeaJbZAnHG6coHuLECZzqS1AGPKcFcvWTeovZYC7b/7oVKl4RJmRLDhKDX2QBi1aOwCJfO6H1Ljdj6VI/oms7P4jWh6sVe6ZHqYXY591D/zeAp 4CejMH7z QKNQTu9BwzZMe6pBO6v7IvKK8FIGn5rZ0xKPhZ/vnfeclRtcmpuPYipFfFBBCEtPVMpyme6DE6/ZFIwK/rMXzrmMKqRKq3kGKSt1/dm0LSabARnB/cIfCSZkrB0lncPL1t6ZZCB0mfhTyelmgPTuXQ3DY3qCBQfKeEBIdVkNfOtIAWkuYUuPOhDkyc3UAjz4nh5f00G0lcKqT0PFNSas3uxfl6vuU4rs2xYJMba83axaTizZx4Q31bGmiha0zWp2dCwqoILu7vo83hRWvViZNYSQTRWWq2wn2rKAM2SowSuOa2tWFCG1oRX4i3tLndgpkJICO4yRYflTQHt+QDK/zdK8O+eQiUA7/6ZspBU9/aApXOZVDHyC3yL0Po6wUkukCgTGw9/7EbuoGhJ+RAI9E6sJk1XWWqbW5z+7027NfnnDlTGAsreYSbQDnTBOoK/t4QVqSw7G3d4AR6qJyl3gkp8N9nrqLbgmY5O/WnSOFUnyL3GQ= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Thu, Mar 13, 2025 at 03:56:07PM +0530, Dev Jain wrote: > > > On 13/03/25 2:48 pm, Lai, Yi wrote: > > On Mon, Mar 03, 2025 at 09:57:02AM +0800, Liu Ye wrote: > > > Moved free_vm_area from the __vmalloc_area_node function to the > > > __vmalloc_node_range_noprof function so that allocation and freeing > > > of the area can be paired in one function for better readability. > > > > > > Signed-off-by: Liu Ye > > > --- > > > mm/vmalloc.c | 5 +++-- > > > 1 file changed, 3 insertions(+), 2 deletions(-) > > > > > > diff --git a/mm/vmalloc.c b/mm/vmalloc.c > > > index a6e7acebe9ad..dc658d4af181 100644 > > > --- a/mm/vmalloc.c > > > +++ b/mm/vmalloc.c > > > @@ -3651,7 +3651,6 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask, > > > warn_alloc(gfp_mask, NULL, > > > "vmalloc error: size %lu, failed to allocated page array size %lu", > > > nr_small_pages * PAGE_SIZE, array_size); > > > - free_vm_area(area); > > > return NULL; > > > } > > > @@ -3844,8 +3843,10 @@ void *__vmalloc_node_range_noprof(unsigned long size, unsigned long align, > > > /* Allocate physical pages and map them into vmalloc space. */ > > > ret = __vmalloc_area_node(area, gfp_mask, prot, shift, node); > > > - if (!ret) > > > + if (!ret) { > > > + free_vm_area(area); > > > goto fail; > > > + } > > > /* > > > * Mark the pages as accessible, now that they are mapped. > > > -- > > > 2.25.1 > > > > > > > Another issue is also bisected to this commit: there is KASAN: slab-use-after-free Read in io_create_region > > > > > > Syzkaller repro code: > > https://github.com/laifryiee/syzkaller_logs/tree/main/250313_124102_io_create_region/repro.c > > Syzkaller repro syscall steps: > > https://github.com/laifryiee/syzkaller_logs/tree/main/250313_124102_io_create_region/repro.prog > > Syzkaller report: > > https://github.com/laifryiee/syzkaller_logs/tree/main/250313_124102_io_create_region/repro.report > > Issue dmesg: > > https://github.com/laifryiee/syzkaller_logs/blob/main/250313_124102_io_create_region/eea255893718268e1ab852fb52f70c613d109b99_dmesg.log > > > > " > > [ 24.707888] __asan_report_load8_noabort+0x18/0x20 > > [ 24.707895] __vmalloc_node_range_noprof+0x1344/0x1420 > > [ 24.707901] ? __lock_acquire+0x1bad/0x5d60 > > [ 24.707915] ? io_create_region+0x6ca/0xe00 > > [ 24.707933] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 > > [ 24.707940] ? debug_smp_processor_id+0x20/0x30 > > [ 24.707958] __kvmalloc_node_noprof+0x2a9/0x6a0 > > [ 24.707969] ? io_create_region+0x6ca/0xe00 > > [ 24.707979] ? io_create_region+0x6ca/0xe00 > > [ 24.707992] io_create_region+0x6ca/0xe00 > > [ 24.708002] ? io_create_region+0x6ca/0xe00 > > [ 24.708015] ? __pfx_io_create_region+0x10/0x10 > > [ 24.708025] ? __this_cpu_preempt_check+0x21/0x30 > > [ 24.708035] ? lock_release+0x440/0x870 > > [ 24.708046] ? __pfx_lock_release+0x10/0x10 > > [ 24.708056] io_create_region_mmap_safe+0xaf/0x150 > > [ 24.708067] ? __pfx_io_create_region_mmap_safe+0x10/0x10 > > [ 24.708081] ? __sanitizer_cov_trace_const_cmp8+0x1c/0x30 > > [ 24.708096] __do_sys_io_uring_register+0xb90/0x2b10 > > [ 24.708110] ? __pfx___do_sys_io_uring_register+0x10/0x10 > > [ 24.708127] ? trace_hardirqs_on+0x51/0x60 > > [ 24.708145] ? __audit_syscall_entry+0x39c/0x500 > > [ 24.708157] __x64_sys_io_uring_register+0x9f/0x100 > > [ 24.708168] ? syscall_trace_enter+0x14d/0x280 > > [ 24.708179] x64_sys_call+0x1eef/0x2150 > > [ 24.708188] do_syscall_64+0x6d/0x140 > > [ 24.708199] entry_SYSCALL_64_after_hwframe+0x76/0x7e > > [ 24.708206] RIP: 0033:0x7f9276c3ee5d > > [ 24.708217] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 93 af 1b 00 f7 d8 64 89 01 48 > > [ 24.708224] RSP: 002b:00007ffd41ff7c18 EFLAGS: 00000202 ORIG_RAX: 00000000000001ab > > [ 24.708234] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9276c3ee5d > > [ 24.708238] RDX: 0000000020003300 RSI: 0000000000000022 RDI: 0000000000000003 > > [ 24.708242] RBP: 00007ffd41ff7c30 R08: 00007ffd41ff7c30 R09: 00007ffd41ff7c30 > > [ 24.708246] R10: 0000000000000001 R11: 0000000000000202 R12: 00007ffd41ff7d88 > > [ 24.708250] R13: 00000000004017f5 R14: 0000000000403e08 R15: 00007f9276f77000 > > [ 24.708260] > > [ 24.708262] > > [ 24.719961] Allocated by task 1208: > > [ 24.720136] kasan_save_stack+0x2c/0x60 > > [ 24.720336] kasan_save_track+0x18/0x40 > > [ 24.720529] kasan_save_alloc_info+0x3c/0x50 > > [ 24.720744] __kasan_kmalloc+0x88/0xa0 > > [ 24.720933] __kmalloc_cache_node_noprof+0x1d0/0x470 > > [ 24.721174] __get_vm_area_node+0xf7/0x260 > > [ 24.721380] __vmalloc_node_range_noprof+0x25c/0x1420 > > [ 24.721622] __kvmalloc_node_noprof+0x2a9/0x6a0 > > [ 24.721848] io_create_region+0x6ca/0xe00 > > [ 24.722049] io_create_region_mmap_safe+0xaf/0x150 > > [ 24.722291] __do_sys_io_uring_register+0xb90/0x2b10 > > [ 24.722539] __x64_sys_io_uring_register+0x9f/0x100 > > [ 24.722782] x64_sys_call+0x1eef/0x2150 > > [ 24.722976] do_syscall_64+0x6d/0x140 > > [ 24.723159] entry_SYSCALL_64_after_hwframe+0x76/0x7e > > [ 24.723405] > > [ 24.723491] Freed by task 1208: > > [ 24.723648] kasan_save_stack+0x2c/0x60 > > [ 24.723841] kasan_save_track+0x18/0x40 > > [ 24.724035] kasan_save_free_info+0x3f/0x60 > > [ 24.724247] __kasan_slab_free+0x3d/0x60 > > [ 24.724450] kfree+0x28d/0x440 > > [ 24.724610] vfree+0x2ce/0x910 > > [ 24.724769] __vmalloc_node_range_noprof+0xeca/0x1420 > > [ 24.725017] __kvmalloc_node_noprof+0x2a9/0x6a0 > > [ 24.725240] io_create_region+0x6ca/0xe00 > > [ 24.725442] io_create_region_mmap_safe+0xaf/0x150 > > [ 24.725682] __do_sys_io_uring_register+0xb90/0x2b10 > > [ 24.725934] __x64_sys_io_uring_register+0x9f/0x100 > > [ 24.726177] x64_sys_call+0x1eef/0x2150 > > [ 24.726365] do_syscall_64+0x6d/0x140 > > [ 24.726549] entry_SYSCALL_64_after_hwframe+0x76/0x7e > > [ 24.726796] > > [ 24.726882] The buggy address belongs to the object at ffff8880166bfb80 > > [ 24.726882] which belongs to the cache kmalloc-64 of size 64 > > [ 24.727442] The buggy address is located 8 bytes inside of > > [ 24.727442] freed 64-byte region [ffff8880166bfb80, ffff8880166bfbc0) > > [ 24.727990] > > [ 24.728078] The buggy address belongs to the physical page: > > [ 24.728344] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x166bf > > [ 24.728712] anon flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) > > [ 24.729034] page_type: f5(slab) > > [ 24.729196] raw: 000fffffc0000000 ffff88800d4418c0 0000000000000000 dead000000000001 > > [ 24.729562] raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 > > [ 24.729922] page dumped because: kasan: bad access detected > > [ 24.730189] > > [ 24.730274] Memory state around the buggy address: > > [ 24.730503] ffff8880166bfa80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > > [ 24.730839] ffff8880166bfb00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > > [ 24.731179] >ffff8880166bfb80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > > [ 24.731518] ^ > > [ 24.731696] ffff8880166bfc00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > > [ 24.732032] ffff8880166bfc80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc > > [ 24.732369] ================================================================== > > [ 24.732787] Disabling lock debugging due to kernel taint > > [ 24.734673] ------------[ cut here ]------------ > > [ 24.734907] Trying to vfree() bad address (00000000ea48f0e7) > > [ 24.735229] WARNING: CPU: 0 PID: 1207 at mm/vmalloc.c:3231 remove_vm_area+0x1c2/0x220 > > [ 24.735601] Modules linked in: > > [ 24.735760] CPU: 0 UID: 0 PID: 1207 Comm: repro Tainted: G B 6.14.0-rc6-next-20250311-eea255893718 #1 > > [ 24.736307] Tainted: [B]=BAD_PAGE > > [ 24.736477] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 > > [ 24.737002] RIP: 0010:remove_vm_area+0x1c2/0x220 > > [ 24.737230] Code: c3 cc cc cc cc e8 7e e2 a4 ff 49 81 ee 00 10 00 00 e9 51 ff ff ff e8 6d e2 a4 ff 4c 89 e6 48 c7 c7 a0 eb fa 85 e8 ce 71 63 ff <0f> 0b 45 31 ed eb bb 45 31 ed eb b6 e8 ed d2 0f 00 e9 10 ff ff ff > > [ 24.738072] RSP: 0000:ffff88804dbc78b8 EFLAGS: 00010292 > > " > > > > Hope this cound be insightful to you. > > > > Regards, > > Yi Lai > > > > > I guess this trace is something else, butiIf __vmalloc_area_node() fails > while allocating physical memory (after we have allocated the pages array), > you call vfree(area->addr), and then the patch does a free_vm_area() again, > causing a double free. > JFYI: The patch, that moves free_vm_area() has been dropped due to degrade. -- Uladzislau Rezki