From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id E39D0CDE006 for ; Thu, 26 Sep 2024 13:39:50 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 78E4E6B008C; Thu, 26 Sep 2024 09:39:50 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 73DC36B0093; Thu, 26 Sep 2024 09:39:50 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 605D16B0096; Thu, 26 Sep 2024 09:39:50 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 428956B008C for ; Thu, 26 Sep 2024 09:39:50 -0400 (EDT) Received: from smtpin21.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id B13E7809A1 for ; Thu, 26 Sep 2024 13:39:49 +0000 (UTC) X-FDA: 82606997298.21.5163057 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by imf15.hostedemail.com (Postfix) with ESMTP id 8B8BDA001B for ; Thu, 26 Sep 2024 13:39:46 +0000 (UTC) Authentication-Results: imf15.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=bNR9EdMj; dmarc=pass (policy=none) header.from=redhat.com; spf=pass (imf15.hostedemail.com: domain of peterx@redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=peterx@redhat.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1727357970; a=rsa-sha256; cv=none; b=g136FiiRrAZDz1T15pdtJqdQ9kfjN8x2OrdQEDr5jDE78SpqzEaO4mekBbC2+hr34gLBv9 AMR9v8VGGBTwcFSA1sWZN+Mxw5YoSC8hA1UbvOpymouc+98jCmWmOTrUd1oO3PUiwqRaH2 j71uwfMCDZY/oE3MXi/+lhVHt+RyLNc= ARC-Authentication-Results: i=1; imf15.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=bNR9EdMj; dmarc=pass (policy=none) header.from=redhat.com; spf=pass (imf15.hostedemail.com: domain of peterx@redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=peterx@redhat.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1727357970; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=NP3xVwUHECq3mYbUhkAhql8+7RvmrTr41ZucVz/QUbY=; b=CY/qRLYicKdUffYA5HDei6B0vLPwZj8jGNzl3q8Hktz62xcS5CvcyCe/UU+5UkNBoOu9tm ssZX6d+5zlgUx80gTh3ZM4CwGrWPxJTnZTKR5cM88HajFMPKPcaIjud9DsSWmULDI3t9X/ VRkX31XPNhAWcNiDSKbxXbv+PZr3HJs= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1727357985; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=NP3xVwUHECq3mYbUhkAhql8+7RvmrTr41ZucVz/QUbY=; b=bNR9EdMjjp9GkbeMo6ecTVUwmyREWWbpWTIN5tW/cZ7ES1vjo+ehs4Q2njGBtl69ougEKA O00XyxOP4yeKlZFytKRyawWj8nxFcNBNfowGqEHqIRiot8WffPWOXSDrmVOxEIm21ThsxS Jm+2Hrz8PbVCYv8gpchG3gwRBb64bA8= Received: from mail-qt1-f199.google.com (mail-qt1-f199.google.com [209.85.160.199]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-214-TOPDbmZ6OcaTklxxjxR2rw-1; Thu, 26 Sep 2024 09:39:44 -0400 X-MC-Unique: TOPDbmZ6OcaTklxxjxR2rw-1 Received: by mail-qt1-f199.google.com with SMTP id d75a77b69052e-4581d15ced1so14432841cf.3 for ; Thu, 26 Sep 2024 06:39:44 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1727357984; x=1727962784; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=NP3xVwUHECq3mYbUhkAhql8+7RvmrTr41ZucVz/QUbY=; b=Be72sWE+E75OptGPuiFzXTDnbs3fpxa02OAsbhvP3KV8L4vMzfAY9q4VAFbrhUb1FA +8+kKuhHGIIeFY5yv4r0ZUuHNbIPfzxqlyAbbSJiyBU01KspyyYuk97iArHHt70Ql/Xu HK0WKXVkXtO8DSpF2mRWpV4Asj7ZS2rjeN7AipFJhHBeiEZylsIxHgOnjdATd/elaW4V 1mDlRN50szlOfTrwYRXEb4kBtnVbQSQrnj5C2STagPYFSsZREDiOFmhfppS/98xkwqMv AwfHakO28PSgsENzjmQ5uJnE+7Wn/4bISKDMQSN+LspKVMPJ2V6AkcuEK7vsZAnZwmhT uEKw== X-Forwarded-Encrypted: i=1; AJvYcCVWQ4dGuI681Q/KO5icPtiU6vaeiLJ9dLVdJcj51lglEu7JvKe1pAU5aw9ifBncl74dgjkKxm538w==@kvack.org X-Gm-Message-State: AOJu0YzygMpRoh939ay6rNJoq3JgmxA68W6Hb+uO/RuLPhsOWnwlZlxj ZA5CjPuKBf4J4b9xTNHF4urChGfQjsNHdh79wZmZJYGzQ2hivTl/y0ahCIkGrr0lQxX6qoiFPQ9 cwakw8d1BoUr9yh2KlaubLzB/9NRq9yEOlMxK6tBuOsOFgV8U X-Received: by 2002:a05:622a:5b8e:b0:458:2b7b:c45c with SMTP id d75a77b69052e-45b5e02c71dmr99988911cf.39.1727357983990; Thu, 26 Sep 2024 06:39:43 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGlgkMdRbCIjZgM2jAU3EsasilPQSNVYQpC12otQiRQwzMqn0cbvcQHcFFaNZ2vnTph4U0i1A== X-Received: by 2002:a05:622a:5b8e:b0:458:2b7b:c45c with SMTP id d75a77b69052e-45b5e02c71dmr99988491cf.39.1727357983497; Thu, 26 Sep 2024 06:39:43 -0700 (PDT) Received: from x1n (pool-99-254-121-117.cpe.net.cable.rogers.com. [99.254.121.117]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-45b526aac64sm25778181cf.92.2024.09.26.06.39.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 26 Sep 2024 06:39:42 -0700 (PDT) Date: Thu, 26 Sep 2024 09:39:39 -0400 From: Peter Xu To: David Hildenbrand Cc: syzbot , akpm@linux-foundation.org, bp@alien8.de, dave.hansen@linux.intel.com, hpa@zytor.com, jgg@ziepe.ca, leitao@debian.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, mingo@redhat.com, rppt@kernel.org, syzkaller-bugs@googlegroups.com, tglx@linutronix.de, x86@kernel.org Subject: Re: [syzbot] [mm?] WARNING in copy_huge_pmd Message-ID: References: <66f15c8d.050a0220.c23dd.000f.GAE@google.com> <4f96130c-12b7-4afa-ada3-bec354576112@redhat.com> <60e29e62-4864-4393-b899-01489ee73b91@redhat.com> MIME-Version: 1.0 In-Reply-To: <60e29e62-4864-4393-b899-01489ee73b91@redhat.com> X-Mimecast-Spam-Score: 1 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=utf-8 Content-Disposition: inline X-Rspam-User: X-Stat-Signature: kdrdfnoouj4ux4q1bg7bdqqt1iaeyhnb X-Rspamd-Queue-Id: 8B8BDA001B X-Rspamd-Server: rspam02 X-HE-Tag: 1727357986-428907 X-HE-Meta: U2FsdGVkX1/2VRmaH92kjBPJ00tKps0T30hmoiE+D7WqQ7AbyZJq95zmYEc8KmW2xW1/+FGvmVIqnUT8k/Q9S9fEBZpEEoVj+bdl7xuiiwaVk4xyy8L7An4xAjrc4+OY0pzHl0J0+iQ/+py/yNWhmLbLWoB917uKUwebzgjbbb1zt1XMRdZvsJE3XO9Kd+aKzZHhCTAhG1jZIuUCRrucRwVQ6MosBvJLnCbLNP2bL83gcO+rokdTWOOAGLGgZSaXqLSzH+kGwfEs0nAmdgY0g82q/YxMFFoaPWkofuC8wpqErIT1QEEsgK1+iHwMCRQDuch529jUC7dAtS6d9LstGObpfPSD6TXXcxueH3XRHtHAhny5QMLP8ZarUUm4R02/EbfKvI0T++7M8NHmL8gRhMdnLA35DbD6qQZ2+yCc9LrYKnrRzsRWxjd5blDdCYRynnCl3XelTKttJ1R35rRJfQ1OvHVMKp8hK4dxIdh1lz15mTsGoz4EZf2FyTG1wpHcdk5SmP39aZKEnZwNHznuo673eYLXAY3dDjpwMKdottMrf5mygDBUiWrKCy+lmeRJLfP+7BGfnqOfWcvn7T+VpZdg0KZVXPIUbo9BRg5bZ2gPIbJ97A7yQG3LVJ5bfGOXoTepjWGSuWpeKiHzg+itu/GUejpmA/YQel5N16yuV5cVZO7kcHtkBTNjoDnQkOHu86u2wontF1YtL1n5/VPgJTkmf8VWwxFevX7yS9cWcaS5oP2mPrm+ZW2g3AZC+IUuLD0grfV1Kdj+EUe7MjmCTo21rquvhmwM7mDR6xa6AkqLHclP8aLapE/EU7PaC/Ibs+WqHgOAYkbgDHhWqJ/PuGXxIxh2zVNiTr9Z71WNPOuoC7CKNUiBfQaxEjv/p94urSEf5OpaD+3wDlg8/VBc3VPAWqEeQLaXsyw3Rngj4xW24+6mr8cFYlMBc9klAGWC5Pm+uDVOkqGhmfLzlxn iSf1CYQD 7CeJIneCcoapLKW37f4mHpRVxcE0feE38pNpO5nAvCvH1g0UTRMFOI72dOxr4OBxTvLBGlDsrR2zH6pIsYBcczeo2Ew6OoI7/+dHjd9FKcJ4yAl6zM1tz+L1DnUg0lR/veNAEph8mzKDcimOlmDoRreh2MpzeAWtqzNGe4OXT9ln85Ex6vLcDrr3XL2rdDiyio9n0DuwjUeH7BzG4bUwFERnrrkBKGpAmVjv51kdxKT8eym2gA9EdBd4gB0PJQ/+2quUdI+gR/xlJr2IXVXAO4TcMwetAVYZLH/cdavl/1LUr9jU4ZHE7bqj3V9BeAS2pdpJhVasX7VcYRrLNbHOAol3mzTFqvOt/e31gw1ffSkoBTRcBWoqMLffNsLK5mxccmvMUGwA0uv0a3NYMzkrJrrSfiE2hZlD85TUvv8NR0+bbDUc2dRBjoCbpzUXOtMcYQSsyX/tc/Y+LX4QeMG/fxG1b6hP1qolPqVSzdYYnvA8Dy++mvn2XvmTBUKVCRcFuNh8Sw8HgaVdGr+eWn09Zf+FCTTif6Nc0PPDekHG8KyrACo62m2goSPhLJ4bi7KW1HSxbQs6FLoU4Xb/3YqvMVvgXSQO97C2g0gUKQYQSrLw8MJ/N4FLeuX2/hFRWL2SMbgRQKToSQUonpbKgGldHy+gkfcJyLSq6IHRibDOaGixtL8PVChqQ/xV9YUcRdWk78Bu2ar1otuqoapbR6bpSlXEYl0yyRLwJ0cJOVjfHevRZA+SO0dlK7P0x22JBZy50HEujqhM9Phe+Agf1rHXHMYXJmyh8pZv4DFNCSJuq9+Ik4dtVdmRK/ivzzCb8ViKxYg/PluwxaqGQJfPA3kBtxFXikbhVMTCdC08kWo9s0IY/yjryjCXMrS3bgWcsw/OTL69D/rM7g5Gdeb66WIwliEecbL4T2zy78WIX5aPqhZiB3ATgDHNPnens+b8J2EZtcH3sox1/Ct1aQJcDvbz3jMSbqRBl n+TRDYRn E+cFsdBVHwZxEH0K3oaOuGE/hVSJoOQuacNVPO+WXug3KBPXNOh9pDBxeHe87xdHLsvgpGDrdAY= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Thu, Sep 26, 2024 at 12:48:19PM +0200, David Hildenbrand wrote: > On 25.09.24 18:59, Peter Xu wrote: > > On Tue, Sep 24, 2024 at 04:45:00PM +0200, David Hildenbrand wrote: > > > On 23.09.24 14:18, syzbot wrote: > > > > Hello, > > > > > > > > syzbot found the following issue on: > > > > > > > > HEAD commit: 88264981f208 Merge tag 'sched_ext-for-6.12' of git://git.k.. > > > > git tree: upstream > > > > console+strace: https://syzkaller.appspot.com/x/log.txt?x=16c36c27980000 > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=e851828834875d6f > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=bf2c35fa302ebe3c7471 > > > > compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12773080580000 > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16ed5e9f980000 > > > > > > > > Downloadable assets: > > > > disk image: https://storage.googleapis.com/syzbot-assets/0e011ac37c93/disk-88264981.raw.xz > > > > vmlinux: https://storage.googleapis.com/syzbot-assets/f5c65577e19e/vmlinux-88264981.xz > > > > kernel image: https://storage.googleapis.com/syzbot-assets/984d963c8ea1/bzImage-88264981.xz > > > > > > > > The issue was bisected to: > > > > > > > > commit 75182022a0439788415b2dd1db3086e07aa506f7 > > > > Author: Peter Xu > > > > Date: Mon Aug 26 20:43:51 2024 +0000 > > > > > > > > mm/x86: support large pfn mappings > > > > > > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17df9c27980000 > > > > final oops: https://syzkaller.appspot.com/x/report.txt?x=143f9c27980000 > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=103f9c27980000 > > > > > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > > > Reported-by: syzbot+bf2c35fa302ebe3c7471@syzkaller.appspotmail.com > > > > Fixes: 75182022a043 ("mm/x86: support large pfn mappings") > > > > > > > > ------------[ cut here ]------------ > > > > WARNING: CPU: 1 PID: 5508 at mm/huge_memory.c:1602 copy_huge_pmd+0x102c/0x1c60 mm/huge_memory.c:1602 > > > > > > This is the > > > > > > VM_WARN_ON_ONCE(is_cow_mapping(src_vma->vm_flags) && pmd_write(pmd)) > > > > > > So we have a special-marked PMD in a COW mapping. > > > > > > The reproducer seems to involve fuse, but not sure if that makes a > > > difference here. > > > > That chunk of code seems to be there only making sure the test won't get > > blocked due to any fused based fs being stuck, via writting to the "abort" > > file: > > > > snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", > > ent->d_name); > > int fd = open(abort, O_WRONLY); > > if (fd == -1) { > > continue; > > } > > if (write(fd, abort, 1) < 0) { > > } > > close(fd); > > > > So far looks not relevant to this issue indeed. > > > > Unfortunately I cannot reproduce it even with the reproducer. So this one > > is a bit tricky.. > > > > What confuses me yet is how that special bit is set, if it's only used so > > far with vfio-pci, and this test doesn't seem to have it involved. > > > > The test keeps invoking processes, then threads, doing concurrent accesses > > over a few stuff (madvise, mremap, migrate_pages, munmap, etc.) on the > > pre-mapped areas, but none of them seem to create new memory that can > > provide hint on how special bit can start to occur. > > > > I wonder if some of these operations can race in a way that mm can wrongly > > create the special bit (alone with it being writable).. and then it could > > be a historical bug, only captured by this patchset due to the newly added > > WARN_ON_ONCE somehow, then it could mean that it's not the WRITE bit that > > is not intended, but the SPECIAL bit altogether. > > I assume you are missing a check for present/non-swap pmds. Assume you have > a migration entry and end up using the special bit -- which is perfectly > fine -- your code would assume it's a present PMD with the special bit set. > > Maybe for the time being something like: > > diff --git a/mm/huge_memory.c b/mm/huge_memory.c > index 0580ac9e47b9..e55efcad1e6c 100644 > --- a/mm/huge_memory.c > +++ b/mm/huge_memory.c > @@ -1586,7 +1586,7 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct > mm_struct *src_mm, > int ret = -ENOMEM; > > pmd = pmdp_get_lockless(src_pmd); > - if (unlikely(pmd_special(pmd))) { > + if (unlikely(pmd_present(pmd) && pmd_special(pmd))) { > dst_ptl = pmd_lock(dst_mm, dst_pmd); > src_ptl = pmd_lockptr(src_mm, src_pmd); > spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING); Good catch! I definitely overlooked it, and I did check the config has THP_MIGRATION set indeed. So it's very possible relevant. Do you want to send a formal patch? You can also push a branch with "#syz test", looks like syzbot can constantly reproduce. Thanks! -- Peter Xu