From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7DFA9EEAA62 for ; Thu, 14 Sep 2023 19:09:12 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id B6B7A8D001C; Thu, 14 Sep 2023 15:09:11 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id B1AD48D0001; Thu, 14 Sep 2023 15:09:11 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A09D18D001C; Thu, 14 Sep 2023 15:09:11 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 918828D0001 for ; Thu, 14 Sep 2023 15:09:11 -0400 (EDT) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 5B5B3C05E7 for ; Thu, 14 Sep 2023 19:09:11 +0000 (UTC) X-FDA: 81236140902.05.B667327 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) by imf13.hostedemail.com (Postfix) with ESMTP id 5A2B620010 for ; Thu, 14 Sep 2023 19:09:08 +0000 (UTC) Authentication-Results: imf13.hostedemail.com; dkim=pass header.d=infradead.org header.s=casper.20170209 header.b=KBQHYU+O; spf=none (imf13.hostedemail.com: domain of willy@infradead.org has no SPF policy when checking 90.155.50.34) smtp.mailfrom=willy@infradead.org; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1694718548; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=7/m3bz/FMIYfip9hzUryY5fsZo8BtjCMUb7iqvvNxc8=; b=czWce9Z3onCTaPbLx3wtBsN2WkbAQMqe/rgJ7eGaJXCtNaTWjmzmNpxff0VoHEqtDbKhqE pXZ9KqBip+NzqXdCc12+jpRSzMzth5fB1l5Y05/AmAlVWax/LDdyIpebkHHy+5NnaLxORI h63iGPIoowZH2479zICCVPw3/gErFFc= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1694718548; a=rsa-sha256; cv=none; b=5tMAGuEm9ERVHBGXEBVX6MIfMK3JFyF5FKG7Yj3FiprGkb0cMVirLQxaeDMnVwXKSxOT/G PKWSdxwhiTbgYo2fq1tSRJv2DZIbtsfIxaasLyCk2A/Bdl1rvIvbDUVvXaNVKinSmcUu8y 1Qh/LBxhXyAuyGIybtqPuHORM++VvYo= ARC-Authentication-Results: i=1; imf13.hostedemail.com; dkim=pass header.d=infradead.org header.s=casper.20170209 header.b=KBQHYU+O; spf=none (imf13.hostedemail.com: domain of willy@infradead.org has no SPF policy when checking 90.155.50.34) smtp.mailfrom=willy@infradead.org; dmarc=none DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=7/m3bz/FMIYfip9hzUryY5fsZo8BtjCMUb7iqvvNxc8=; b=KBQHYU+OC2p0pEcUvBBR0Be/w3 g5TVCjkKEIo7PSyc6KjLHHhobgiWZGpRszgsixVRz3zDMHXAKV/mS7d+r1zhcXJ9tZe+uHIZkPhQQ d79lQHtWTNXPq03Mzly1jE08YbUvHNIdlCpSXW7YefWSf7FUfAJlhPUE5ywPX9XLa+CkYcLoAhLLQ 9nznEIOxVBg5MHP/zQ7eezP0NgPoypT91tJ1RvbOx+4zFvl+KLI7fgLtoxOwp+BOKU/SEfb+gBKnx jxA7Y8l4ORamvaeN2oP5IGzMFtTBu6oLKjHGju9pdfpr1JxSHssXh68Q5y9OjaeFEfoy9CR1wzR5p DCqOIWsw==; Received: from willy by casper.infradead.org with local (Exim 4.94.2 #2 (Red Hat Linux)) id 1qgri3-004eEd-Ck; Thu, 14 Sep 2023 19:09:03 +0000 Date: Thu, 14 Sep 2023 20:09:03 +0100 From: Matthew Wilcox To: Suren Baghdasaryan Cc: syzbot , akpm@linux-foundation.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [mm?] kernel BUG in vma_replace_policy Message-ID: References: <000000000000f392a60604a65085@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Stat-Signature: h85k8spfkqmh4cybhbxb4r64ssbo9sdc X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 5A2B620010 X-Rspam-User: X-HE-Tag: 1694718548-720446 X-HE-Meta: U2FsdGVkX18yASEmI8t3TOLujb8fmW089+H2N8MTESA5yog54o7pmWQVBidhvLl9Ky2J01ASXLZl6r34dHoNzFN66lKwVeSOLCfaLd2a1WhRFtIppivQSFQSghqgKttcpIT2OCRPP/D6q0l3btqsV8WZLMOiV8zegrK9WaIungPo4OiLsKnEyL11fl0KPz5ia5nHe29LTTWi/wxh1uBrTfWUgUbC+u86XQKiHGlFYfuZJK4mCPhvAj+FNScT++ZEGv9sxuqZtmDK0d0wXgLrSNYu0WH1WSPbQaAiOdXHWdLz+fwOyjnLn1xMSy+ZvKrQGN2BYgQa4cCDZ5LIxv/vaHcenNqpQIkqL+KWJ53Jepnvzkx/tTERW/wup0C6wcfT5Wm3lK48w6Ux52gm9vFu4Fqen/dbJ3l/MsaqccK9uyq+yL/JKD620sKqqi1gYr3wmd0vMqPUaM6ZkEO2f/KXVJep1JkA8GmQfW4SnRICwX4BHJm/zMed6DlMD2br2auNtMgAKSPXnXrBExdj0ZtTwmWSZ0XTFZCrZ/6Lo8WRJx3CPrJ+SvdiqLPgwrlXX0182ox4Vhmshs2A5GL5GqkH/yBNHRCl23zog8E8cU9TsPTh/ZlG3c89mk0kgUzjYHFJ1QcBEGfWDM7s2XpPWvWNOPEa06CcCVeWRnfUBaMUUmpFeJ7Hxe9EkUN1ONd9J8bfAPHsK0nDCn0xDU0+dOLV9p1/RA+PwSY8D1+eQjiEIO2kAtBQR351icnb8IneqqVO3v77fBAGxe60dQdoUMNAy9asuiSBPVGi4pWZZyYiK7dTkQuH8Wip8ray+xpRqvenNj7zLwQ794Aq8DlJFXKhHnwXVMJSlNkWK6enP/KnBPip7S4vSMf89xwidKSfdoBUnV6lO11RnJuRt1PGZqdNIBgHQyy7lxwzZXEfDPIVObnD7J4ssASXpeu6v/i1/GGzVL0foTkTVDPN26odVxG wApedmnK YGLtkcNsHA1I6oJVIpgRvq0BmfLPWj+o4bRm9GjT5WsJCGmsWWIlRH5xiNBmmTM5b2a1FeYEEBlvKKQHlwHWA3DG949VnIgLZfndGxzjl7FH5QHQAVbHZZzc/6m+K2RKL6VLZdHS34l1SGh/iPHZrgEhBDQM4ZyfFw2o7WoCIaUpAkGiaibkKEQ13RXy2DaJ7wH8hkd2r0RnJubvBpg9PD7YhLer9uA+F1pLFTfrNEk2RuEz74U7+g6saZYlegBVuhUwu8wnqPVqTfuO+nUU1isJlu3RvP+aV4C9rs3uBQ+D7RTEPG/hPcsToHiY47Qc4mBEF X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Sep 14, 2023 at 06:20:56PM +0000, Suren Baghdasaryan wrote: > I think I found the problem and the explanation is much simpler. While > walking the page range, queue_folios_pte_range() encounters an > unmovable page and queue_folios_pte_range() returns 1. That causes a > break from the loop inside walk_page_range() and no more VMAs get > locked. After that the loop calling mbind_range() walks over all VMAs, > even the ones which were skipped by queue_folios_pte_range() and that > causes this BUG assertion. > > Thinking what's the right way to handle this situation (what's the > expected behavior here)... > I think the safest way would be to modify walk_page_range() and make > it continue calling process_vma_walk_lock() for all VMAs in the range > even when __walk_page_range() returns a positive err. Any objection or > alternative suggestions? So we only return 1 here if MPOL_MF_MOVE* & MPOL_MF_STRICT were specified. That means we're going to return an error, no matter what, and there's no point in calling mbind_range(). Right? +++ b/mm/mempolicy.c @@ -1334,6 +1334,8 @@ static long do_mbind(unsigned long start, unsigned long len, ret = queue_pages_range(mm, start, end, nmask, flags | MPOL_MF_INVERT, &pagelist, true); + if (ret == 1) + ret = -EIO; if (ret < 0) { err = ret; goto up_out; (I don't really understand this code, so it can't be this simple, can it? Why don't we just return -EIO from queue_folios_pte_range() if this is the right answer?)