From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88CD5C282EC for ; Mon, 17 Mar 2025 18:18:48 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id CE4E5280002; Mon, 17 Mar 2025 14:18:46 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C9302280001; Mon, 17 Mar 2025 14:18:46 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B5BA6280002; Mon, 17 Mar 2025 14:18:46 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 94367280001 for ; Mon, 17 Mar 2025 14:18:46 -0400 (EDT) Received: from smtpin09.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 5B4D01C7DEF for ; Mon, 17 Mar 2025 18:18:47 +0000 (UTC) X-FDA: 83231853894.09.537E697 Received: from out-185.mta0.migadu.com (out-185.mta0.migadu.com [91.218.175.185]) by imf19.hostedemail.com (Postfix) with ESMTP id 7CAEC1A000C for ; Mon, 17 Mar 2025 18:18:45 +0000 (UTC) Authentication-Results: imf19.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=hVDEO61v; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf19.hostedemail.com: domain of yosry.ahmed@linux.dev designates 91.218.175.185 as permitted sender) smtp.mailfrom=yosry.ahmed@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1742235525; a=rsa-sha256; cv=none; b=SYQUgcaoiFQ5OnYKx5Y6jINXEljdxgqQakOJdcBq0Mc3QX5kZd8ETJUcvIj455o2g6Awqf 0thJZoZc/s1VKOP0n35tdTWD3GjcWD5SVe39QcojO1+tFWvDrE05Uxsz+sDWL1vsu8LGRN 1seDJJbpjWNYf2PsgPZ6zDx2poQaaPo= ARC-Authentication-Results: i=1; imf19.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=hVDEO61v; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf19.hostedemail.com: domain of yosry.ahmed@linux.dev designates 91.218.175.185 as permitted sender) smtp.mailfrom=yosry.ahmed@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1742235525; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=LzCRo0knkfJ8o8M5oL/sL88fmyKB4M28RkEky5+ZWrI=; b=IJeTiGQBI7JsQC2/lSqfaTrBUK1b8MAU4HmXbVe2kXNRHraUB89YikwzFlKoyuxzD2K6eP op1ZMLV9VTIaQC8vNXFC5n6a/3BmH4d+lx5mtI8lz/eJrd/hSXG7DXN5p+Jq8qUj+2q2di HJn8WeK9pF2ljZHv6Q9dCn77lxpMTMI= Date: Mon, 17 Mar 2025 18:18:39 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1742235523; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=LzCRo0knkfJ8o8M5oL/sL88fmyKB4M28RkEky5+ZWrI=; b=hVDEO61v7y2gc7S4vBCqSkkkVNYXUx3ECw9zmcBlxnd8cv1Bfna57KycbjgX5l/1m4P87l RlujJH2cqZWkNJVF/sVbY0P9hUwKDSd/9MaFAk4VymW9qJnZMi5LkEMaKG6gsEPuEIIO0n kb6uLH67aiJFdVRQy9MCuSbCQxRAMH8= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Yosry Ahmed To: Chengming Zhou Cc: ffhgfv , hannes , nphamcs , akpm , linux-mm , linux-kernel Subject: Re: Linux6.14-rc5: KASAN: use-after-free Read in zswap_store Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Migadu-Flow: FLOW_OUT X-Stat-Signature: zas1nikfa9a4cpwuynkwzyjgmjkjesrp X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: 7CAEC1A000C X-Rspam-User: X-HE-Tag: 1742235525-768075 X-HE-Meta: U2FsdGVkX1+jyydbDBYTpFd5RTWdZvFUmbrTfSRNk30ezFDN/eMAOik7/UG/itQ1bSGqHzZB+oXCbfO2zHLfKfAYXmaSqoymyvQDb5jXnWlz7GYMpK1My+RuvaXAoE+hDgrDyx0G0nA+hEb95N6EodOR8bHj0MJhY0WLajl8qOYL5o178EELzyroZpQL964yxSOY9xJy8pFkIUsugo2deM+a8hgu+Deg8IxSIZxQsfP0CYPvigQv8DPqkB/JOG8cX3Wmb6/BvxRZz9G0NusBzUSvVtsx93oQ4r4rcYvOZtwhNswEU6B6aRZJoGOboI6qUxBhy9t4epw0+4xX1dYhI7ZiJTfIkecpWwOCDHv0bY8chqw5JBw+WavaylvQ/kxp6nDTq5orRPpwRzC9a5wQcMaqrEBbxE27xoUpTj6lQ6IUl6j9obD4KOGCTkj7xAT7daUR2z0An3uYqWVLqTa8nh78A6QOKEOrO37flbt6yRoYaKzjRyzyQSa1W7ICrPxTjEo9GpsOefiOhNqyl2he+IaFfLjz/l0bLZYk1cSvkerEE7iEl8TP2pK8+C2hH3loeU+u80c3X5qH2v+FNhh/zBe3IHp/bmqvj6gxT6vdKJSudxYWN0q+WssAYA0JmR+ZRiX9t4eM4s/SeqZpWCUxnPkbo+SWM1dPyF74mEAYgjN+1Bs2elMLEkcW1VfewG6O2lIU7q3pRpu5N+4I8wJlGgubROeJ/+g+e7Qqdb5nR60eGM+N3RfM1lscSgFPi8yT3Hl07PQnfrYwi+UwplBAvYN4KdfRhFp80erZ+QMGirrP5N9P/YiFNlfpbUjnvSyUoDUFVUN/9AG/vqFWXrXGGDeRW33JhTATNAhHtQajNGlbRQsfBH5Os0TdrLlvnf0YQLX8UsYYTCIbOC22/BH9Ejv7L8ScY+NHm2NdK29x9DrY71I4jOgWbCXAASucFWmKp34Rkq9NeTXd2pZtgjJ aNB5GoxE 3b5S/UUJdgBWj+vr/laXQoQ0G3bk8/RBt2ppd+NSmnvucNbTEPL/+zhnr48kQNlGZdEK5ngBTGbTBmP5m5Al5tO2xXPpZ44t8ActwFY4ReO8Jrq40Br0sUkPPscaeORRbrygaJBkKc5INjA3x0rrRMZxRlx0zi+XTOQ+3iwkWcHo/38mqR0p5Xlq/JtQx/bLsXcPCDjlywz54tekdhy/f2dhvZACKlx4mAAO8P3aUxyFZjqttLt54ual5WrnZ2Bd9Qil1P5S0n7MFt5kZw54L40xqMzi4yDztu3mxvljNC8t50GEFkfG9EFdlpNMEhujq1jOqTj06AGHjycIbe1WzSlDy7wjNnrOT8jGiFo+T7QCqQ2jLuM7IHfOvFUiCr8NKghojfgGWzLEw/YzszykzUZ1Ztsvy2htThZP6JhDP0WQQeN4= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000193, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Mon, Mar 17, 2025 at 10:33:20AM +0800, Chengming Zhou wrote: > On 2025/3/17 08:13, ffhgfv wrote: > > Hello, I found a bug titled " KASAN: use-after-free Read in zswap_store " with modified syzkaller in the Linux6.14-rc5. > > If you fix this issue, please add the following tag to the commit: Reported-by: Jianzhou Zhao , xingwei lee , Zhizhuo Tang > > > > I use the same kernel as syzbot instance upstream: 7eb172143d5508b4da468ed59ee857c6e5e01da6 > > kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=da4b04ae798b7ef6 > > compiler: gcc version 11.4.0 > > ------------[ cut here ]----------------------------------------- > > TITLE: KASAN: use-after-free Read in zswap_store > > ================================================================== > > ================================================================== > > BUG: KASAN: use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] > > BUG: KASAN: use-after-free in do_raw_spin_lock+0x285/0x2e0 kernel/locking/spinlock_debug.c:115 > > Read of size 4 at addr ffff88804e78e014 by task kswapd0/98 > > > > CPU: 0 UID: 0 PID: 98 Comm: kswapd0 Not tainted 6.14.0-rc5-dirty #11 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 > > Call Trace: > > > > __dump_stack lib/dump_stack.c:94 [inline] > > dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 > > print_address_description mm/kasan/report.c:408 [inline] > > print_report+0xc1/0x630 mm/kasan/report.c:521 > > kasan_report+0x93/0xc0 mm/kasan/report.c:634 > > debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] > > do_raw_spin_lock+0x285/0x2e0 kernel/locking/spinlock_debug.c:115 > > spin_lock include/linux/spinlock.h:351 [inline] > > z3fold_page_lock mm/z3fold.c:223 [inline] > > z3fold_alloc mm/z3fold.c:1060 [inline] > > z3fold_zpool_malloc+0x9b1/0x1410 mm/z3fold.c:1388 > > zswap_compress mm/zswap.c:971 [inline] > > zswap_store_page mm/zswap.c:1462 [inline] > > zswap_store+0xe46/0x41e0 mm/zswap.c:1571 > > swap_writepage+0x3a7/0x1430 mm/page_io.c:278 > > pageout+0x3bf/0xac0 mm/vmscan.c:696 > > shrink_folio_list+0x3509/0x4480 mm/vmscan.c:1402 > > evict_folios+0x849/0x2100 mm/vmscan.c:4660 > > try_to_shrink_lruvec+0x608/0x9b0 mm/vmscan.c:4821 > > shrink_one+0x412/0x7d0 mm/vmscan.c:4866 > > shrink_many mm/vmscan.c:4929 [inline] > > lru_gen_shrink_node mm/vmscan.c:5007 [inline] > > shrink_node+0x2355/0x3c10 mm/vmscan.c:5978 > > kswapd_shrink_node mm/vmscan.c:6807 [inline] > > balance_pgdat+0xa85/0x1740 mm/vmscan.c:6999 > > kswapd+0x4c0/0xbe0 mm/vmscan.c:7264 > > kthread+0x427/0x880 kernel/kthread.c:464 > > ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148 > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 > > > > > > The buggy address belongs to the physical page: > > page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x564c9cd0a pfn:0x4e78e > > flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) > > raw: 04fff00000000000 ffffea000139e508 ffffea000139e248 0000000000000000 > > raw: 0000000564c9cd0a 0000000000000000 00000000ffffffff 0000000000000000 > > page dumped because: kasan: bad access detected > > page_owner tracks the page as freed > > page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12800(GFP_NOWAIT|__GFP_NORETRY), pid 98, tgid 98 (kswapd0), ts 431124924160, free_ts 431131252025 > > set_page_owner include/linux/page_owner.h:32 [inline] > > post_alloc_hook mm/page_alloc.c:1551 [inline] > > prep_new_page+0x1b0/0x1e0 mm/page_alloc.c:1559 > > get_page_from_freelist+0x19a2/0x3250 mm/page_alloc.c:3477 > > __alloc_frozen_pages_noprof+0x324/0x6b0 mm/page_alloc.c:4739 > > alloc_pages_mpol+0x20a/0x550 mm/mempolicy.c:2270 > > alloc_pages_noprof+0x1c/0x250 mm/mempolicy.c:2361 > > z3fold_alloc mm/z3fold.c:1036 [inline] > > z3fold_zpool_malloc+0x7aa/0x1410 mm/z3fold.c:1388 > > zswap_compress mm/zswap.c:971 [inline] > > zswap_store_page mm/zswap.c:1462 [inline] > > zswap_store+0xe46/0x41e0 mm/zswap.c:1571 > > swap_writepage+0x3a7/0x1430 mm/page_io.c:278 > > pageout+0x3bf/0xac0 mm/vmscan.c:696 > > shrink_folio_list+0x3509/0x4480 mm/vmscan.c:1402 > > evict_folios+0x849/0x2100 mm/vmscan.c:4660 > > try_to_shrink_lruvec+0x608/0x9b0 mm/vmscan.c:4821 > > shrink_one+0x412/0x7d0 mm/vmscan.c:4866 > > shrink_many mm/vmscan.c:4929 [inline] > > lru_gen_shrink_node mm/vmscan.c:5007 [inline] > > shrink_node+0x2355/0x3c10 mm/vmscan.c:5978 > > kswapd_shrink_node mm/vmscan.c:6807 [inline] > > balance_pgdat+0xa85/0x1740 mm/vmscan.c:6999 > > kswapd+0x4c0/0xbe0 mm/vmscan.c:7264 > > page last free pid 38 tgid 38 stack trace: > > It looks like the z3fold doesn't handle the migration correctly? > But it's suggested that we should use zsmalloc as zswap allocator, > and the z3fold/zbud will be deleted. Yeah this code should be gone in v6.15.