Re: selftests: cgroup: test_core - Unable to handle kernel NULL pointer dereference at virtual address

Re: selftests: cgroup: test_core - Unable to handle kernel NULL pointer dereference at virtual address

[Roman Gushchin]

On Tue, Oct 10, 2023 at 12:23:06PM +0530, Naresh Kamboju wrote:
> - mailing list.
> [ my two cents ]
> 
> Hi Roman,
> 
> Thanks for fixing the reported issues.
> 
> On Tue, 10 Oct 2023 at 03:13, Roman Gushchin <roman.gushchin@linux.dev> wrote:
> >
> > On Mon, Oct 09, 2023 at 04:08:13PM +0530, Naresh Kamboju wrote:
> > > On Sun, 8 Oct 2023 at 21:09, Roman Gushchin <roman.gushchin@linux.dev> wrote:
> > > >
> > > > On Sun, Oct 08, 2023 at 11:30:52AM +0530, Naresh Kamboju wrote:
> > > > > While running selftests: cgroup: test_kmem on FVP following kernel crash
> > > > > noticed on Linux next 6.6.0-rc4-next-20231006.
> > > >
> > > > Hi Naresh!
> > > >
> > > > Thank you for the report!
> > > >
> > > > I've tried to reproduce it, but wasn't successful so far: I've run test_kmem
> > > > for several hundred times and haven't seen the crash.
> > >
> > > If you look at the problematic test case is
> > > selftests: cgroup: test_core
> >
> > Ah, got it, and immediately reproduced (and fixed).
> > Thank you once again for all your effort!

Hi Naresh!

> Happy to test anytime.
> In addition to that, I am happy to test any series of patches from lore
> or your tree / branch.

I posted v2 yesterday.

> 
> >
> > The problem happens because some kernel allocations happen after
> > mem_cgroup_exit(), which was dropping the reference to task->objcg,
> > but not zeroing the pointer, so it eventually caused a double-free.
> >
> > I gonna post an updated version of my patchset, which introduced the issue,
> > with the fix merged (and some other minor changes).

> 
> Would it be possible to add reported by tags in your patch series / fixes ?
> 
> Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
> Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>

You totally deserve credits in the patchset, however reported-by tag will look
strange in a non-fix commit (given that the fix is merged-in).

This is a common scenario in mm where bugs are discovered and fixed in
mm-unstable, so there are no separate fix commits. So I wonder if we need to
introduce a new tag for this type of contribution.

Andrew (and all other mm* maintainers), what do you think?

Tested-by?
Bugs-found-by?
Stabilized-by?

Thank you!

Re: selftests: cgroup: test_core - Unable to handle kernel NULL pointer dereference at virtual address

[Shakeel Butt]

On Tue, Oct 10, 2023 at 9:16 AM Roman Gushchin <roman.gushchin@linux.dev> wrote:
>
> On Tue, Oct 10, 2023 at 12:23:06PM +0530, Naresh Kamboju wrote:
> > - mailing list.
> > [ my two cents ]
> >
> > Hi Roman,
> >
> > Thanks for fixing the reported issues.
> >
> > On Tue, 10 Oct 2023 at 03:13, Roman Gushchin <roman.gushchin@linux.dev> wrote:
> > >
> > > On Mon, Oct 09, 2023 at 04:08:13PM +0530, Naresh Kamboju wrote:
> > > > On Sun, 8 Oct 2023 at 21:09, Roman Gushchin <roman.gushchin@linux.dev> wrote:
> > > > >
> > > > > On Sun, Oct 08, 2023 at 11:30:52AM +0530, Naresh Kamboju wrote:
> > > > > > While running selftests: cgroup: test_kmem on FVP following kernel crash
> > > > > > noticed on Linux next 6.6.0-rc4-next-20231006.
> > > > >
> > > > > Hi Naresh!
> > > > >
> > > > > Thank you for the report!
> > > > >
> > > > > I've tried to reproduce it, but wasn't successful so far: I've run test_kmem
> > > > > for several hundred times and haven't seen the crash.
> > > >
> > > > If you look at the problematic test case is
> > > > selftests: cgroup: test_core
> > >
> > > Ah, got it, and immediately reproduced (and fixed).
> > > Thank you once again for all your effort!
>
> Hi Naresh!
>
> > Happy to test anytime.
> > In addition to that, I am happy to test any series of patches from lore
> > or your tree / branch.
>
> I posted v2 yesterday.
>
> >
> > >
> > > The problem happens because some kernel allocations happen after
> > > mem_cgroup_exit(), which was dropping the reference to task->objcg,
> > > but not zeroing the pointer, so it eventually caused a double-free.
> > >
> > > I gonna post an updated version of my patchset, which introduced the issue,
> > > with the fix merged (and some other minor changes).
>
> >
> > Would it be possible to add reported by tags in your patch series / fixes ?
> >
> > Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
> > Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
>
> You totally deserve credits in the patchset, however reported-by tag will look
> strange in a non-fix commit (given that the fix is merged-in).
>
> This is a common scenario in mm where bugs are discovered and fixed in
> mm-unstable, so there are no separate fix commits. So I wonder if we need to
> introduce a new tag for this type of contribution.
>
> Andrew (and all other mm* maintainers), what do you think?
>
> Tested-by?
> Bugs-found-by?
> Stabilized-by?
>

"Tested-by:" seems reasonable. Is there some automation looking for
"Reported-by:" for backports or contribution stats?