From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 32697C47DDF for ; Tue, 30 Jan 2024 11:34:44 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id B941B6B0082; Tue, 30 Jan 2024 06:34:43 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id B1CD96B0085; Tue, 30 Jan 2024 06:34:43 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 996776B0087; Tue, 30 Jan 2024 06:34:43 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 825486B0082 for ; Tue, 30 Jan 2024 06:34:43 -0500 (EST) Received: from smtpin21.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 5A4F8140AC3 for ; Tue, 30 Jan 2024 11:34:43 +0000 (UTC) X-FDA: 81735770046.21.5C8D9B5 Received: from out-170.mta0.migadu.com (out-170.mta0.migadu.com [91.218.175.170]) by imf01.hostedemail.com (Postfix) with ESMTP id 4E5654000F for ; Tue, 30 Jan 2024 11:34:41 +0000 (UTC) Authentication-Results: imf01.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=AEleoigv; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf01.hostedemail.com: domain of yajun.deng@linux.dev designates 91.218.175.170 as permitted sender) smtp.mailfrom=yajun.deng@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1706614481; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=NlRfnSMqOvhV+BAgFr8AU/OvJG8/tFH2Xkf3J/HgD5U=; b=1RTBUgnafhKx1qhFtbjIAJMHfE4j0BTAqlaF9QJrSG32H5xnm1pkOQXn6EEphyFFtsD/A1 2rJ0C/FowtrCrgT+fU5y5qNCv/dDJIeMGoGdtGrSbwBuU36PCLDrCX2rc6xdbZtOwr2diG uZj32BeUmK8t/CvaLxHLpMNS8nYRd7I= ARC-Authentication-Results: i=1; imf01.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=AEleoigv; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf01.hostedemail.com: domain of yajun.deng@linux.dev designates 91.218.175.170 as permitted sender) smtp.mailfrom=yajun.deng@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1706614481; a=rsa-sha256; cv=none; b=zwclcOUnnZN7d+SGRjIvlpSoDHj+df88yl2KIz1CYoN2xMESBKRq3ieaAaAYV6T9U1dAOm mhuS9HMdYMGBRXAItA/2T0/SoQ2XyfDX7Fi8X1R+EeHwDITwg2enO/eck7DJjToQxJfu+Q bCm6lYgwQ6WBsi2ZbdT/mGSgFxN4P2I= Message-ID: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1706614478; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=NlRfnSMqOvhV+BAgFr8AU/OvJG8/tFH2Xkf3J/HgD5U=; b=AEleoigvZylC5iMtnDISwpvJkun6asvmifCl8LrqeLcH0IRWHv1+uOCXValgjmzgJBW0Vx 9vRnJbma61zfl6vN5PzoyoTFWO5S3frTqccTiQlBRHZcaR0EF2GSriDxuRxn1KqDXKAhOs Qm12+NCJlhIPm49NVY6XCQq/3C0hRwI= Date: Tue, 30 Jan 2024 19:34:29 +0800 MIME-Version: 1.0 Subject: Re: [syzbot] [mm?] kernel BUG in validate_mm (3) Content-Language: en-US To: "Liam R. Howlett" , syzbot , akpm@linux-foundation.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com References: <20240129152251.mf52xjxf54umijwy@revolver> X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Yajun Deng In-Reply-To: <20240129152251.mf52xjxf54umijwy@revolver> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT X-Rspamd-Queue-Id: 4E5654000F X-Rspam-User: X-Rspamd-Server: rspam04 X-Stat-Signature: 4qricqqwfh1mtn18uciba5ng8rir1m5o X-HE-Tag: 1706614481-662064 X-HE-Meta: U2FsdGVkX1/+AI2QCS0P9nx3iY0+Sy0mbkiCEcsEOXMkce2FakalVlyY0mw6j+l6RpAxzCt7mZncCdlZ7kF9w/qSbJdjzcJatINxuG9mww5PsE5Rtd8OtAV5wElF+G7S3muF/V5OyL0hJnZwh3HFbG0eBMpx9KyLJy6tG3F6kCJZKAVr/HKqytvmJ3wxxiCnIDUzasFqv5JptbXXAJAWzT3L+BqGCO5Vu5+Z+uAGMVR6IK2iQ55KzzZFq4X0fFGYmWmyWEsdcAAcsTwdDOfLZLoem6r2VHrFSIHffn5B0BvZahsU/YLM9vCFQrAbJLHxVVl9EO3vq7WcT6bjuFZJD2rg9zudpvdu7QaMflLKdwj7W8nOJ7Mgx0GNWkv7t0psGxXyPUu/mJ0vEB7iJEKn/GnhmcGIUIqzAZisRUGY7+MgAOzN8+hMSZevMZrDSQwIV2WIcVRlI++fq5i2OstgSkl0v8qQ8124/60iMZMFz4SeyWd1MNLbQpY902uZoIEkjhYZrT/kyof6iSNK0o1u2154d1JjopzK9o75jv00exl8F8a0yBOeIKk/n8LI2+j0mo8A5KQuteLRleBv2mBcFwyMBhBFiSpwleRf2Q3KT8Vb3q+XQmX3GCWyT4JRAz8ngNfN8uNCBnfDGYPHOtjyLuP6R0Sd7KTjsswXm7OItLIPelHZx6dptaOYX4C3g+sbyuWPXC0mfDy4L12LWbuloJnlGLM8lA6A+NfLe8pT9uqFqe7fMuChg2q5OGfDRdDK+RlTXmv/oU1sZNFc3asRdAau+UNBCBpseFugd1jSwJ+y6C667JsWoarRJyANyQ/fBbOTtgeUXZ0YARJr3LGpY0JPmv6pHGTAWeAQbV7FDnvu4JdBi2adOHQM7f4HO3kfbtipY0BM/2ISX6mI8HyDG21+l0Iz72QDckVzQZ9VoVk4tlwg3jgBq8vUk0lbyVYtZHp0uM6Kkbqdg0HxfWu h/tCfcba aMBCKxaiUye7Is4mK2gVP0aSiHvKy8CDtgDvovHMw34zI85U7B+VA15ZEIK073/jhHtt2jY7xwNLn8ubAH6kr12cat2aokDctW7ZC7yh47puA9IdbVOHw4Uao+3QkFrHBplc+YaL6Hel4w7+JYFuyonACWs5e5+Vsx5FfvjbEoIij7f34/WYPyoKUv1wfD7JRvB5srq1RG+l2doCY4nivMCv2izzKJFhOi9/Eat2IIzLQYyFkJZ+QrKqBhRPqfeltC0g57xB+UJ4iJwtBfvAPkLn3s5vf2atEkDnhnkFRJXk9XQGIv7QtdPwpUKsaDXOGnpIDcIf+OLipxdT7wB0tljOe+BAMJ2RWP4TK3x21vWo1dyK03VGIakVYr23rTK2Ps1LoTyowuxx4UKUXhJXFBzY46MNPTsaLm0Zc/zBCWVdmeNluqJgXQfhV39crzhY7xvfggYkr1pQE3UNCEKHMnsp/+ZKrvac9dEzUGGLB280ayCA+p4ye2ZUdkxg6mNNKQhPne8wzhUHAs7RZbwSZwBre0gKFUHZIe7y9rv9xYBv7aJkwkVLdtpnlGJz35nF1IJyhWCousVMlbKNBvkHNqsGIIrhMBY+u0ql6dE4yssVQ6qgrThJ5InLRMz11ur831AvICdHhAYsr6dB7yxNlgr4Cug4ogeweSwewr3zbDp+noG74ZLqt4O0yMw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 2024/1/29 23:22, Liam R. Howlett wrote: > Yajun, > > > * syzbot [240129 06:15]: >> Hello, >> >> syzbot found the following issue on: >> >> HEAD commit: 596764183be8 Add linux-next specific files for 20240129 >> git tree: linux-next >> console+strace: https://syzkaller.appspot.com/x/log.txt?x=142042f3e80000 >> kernel config: https://syzkaller.appspot.com/x/.config?x=584144ad19f381aa >> dashboard link: https://syzkaller.appspot.com/bug?extid=39a72b995ba73633c1a7 >> compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 >> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11844ba7e80000 >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15bd01efe80000 >> >> Downloadable assets: >> disk image: https://storage.googleapis.com/syzbot-assets/b647c038857b/disk-59676418.raw.xz >> vmlinux: https://storage.googleapis.com/syzbot-assets/729e26c3ac55/vmlinux-59676418.xz >> kernel image: https://storage.googleapis.com/syzbot-assets/15aa5e287059/bzImage-59676418.xz >> >> IMPORTANT: if you fix the issue, please add the following tag to the commit: >> Reported-by: syzbot+39a72b995ba73633c1a7@syzkaller.appspotmail.com >> >> arg_start 7fffd9277efb arg_end 7fffd9277f14 env_start 7fffd9277f14 env_end 7fffd9277fdf >> binfmt ffffffff8d9c5c00 flags 80007fd >> ioctx_table 0000000000000000 >> owner ffff88802c0cda00 exe_file ffff88801ff60500 >> notifier_subscriptions 0000000000000000 >> numa_next_scan 0 numa_scan_offset 0 numa_scan_seq 0 >> tlb_flush_pending 0 >> def_flags: 0x0() >> ------------[ cut here ]------------ >> kernel BUG at mm/mmap.c:328! >> invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI >> CPU: 1 PID: 5058 Comm: syz-executor310 Not tainted 6.8.0-rc1-next-20240129-syzkaller #0 >> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 >> RIP: 0010:validate_mm+0x3f3/0x4b0 mm/mmap.c:328 >> Code: 0f 84 a4 fd ff ff e9 47 ff ff ff e8 77 91 b9 ff 44 89 f2 89 de 48 c7 c7 e0 af 19 8b e8 56 69 9b ff 4c 89 ff e8 ce c4 fa ff 90 <0f> 0b e8 56 91 b9 ff 0f b6 15 1f dd b1 0d 31 ff 89 d6 88 14 24 e8 >> RSP: 0018:ffffc900035df958 EFLAGS: 00010282 >> RAX: 000000000000032a RBX: 000000000000000d RCX: ffffffff816e2f59 >> RDX: 0000000000000000 RSI: ffffffff816eb7e6 RDI: 0000000000000005 >> RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000000 >> R10: 0000000080000000 R11: 0000000000000001 R12: 00007fffd92ff000 >> R13: 0000000000000000 R14: 000000000000000e R15: ffff88802c6b8000 >> FS: 0000555557046380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 >> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >> CR2: 00007f10ada208a0 CR3: 000000007b434000 CR4: 00000000003506f0 >> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 >> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 >> Call Trace: >> >> vma_merge+0x16a9/0x3d70 mm/mmap.c:1033 >> vma_merge_new_vma mm/mmap.c:2465 [inline] >> mmap_region+0x206b/0x2760 mm/mmap.c:2841 >> do_mmap+0x8ae/0xf10 mm/mmap.c:1380 >> vm_mmap_pgoff+0x1ab/0x3c0 mm/util.c:573 >> ksys_mmap_pgoff+0x425/0x5b0 mm/mmap.c:1426 >> __do_sys_mmap arch/x86/kernel/sys_x86_64.c:93 [inline] >> __se_sys_mmap arch/x86/kernel/sys_x86_64.c:86 [inline] >> __x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:86 >> do_syscall_x64 arch/x86/entry/common.c:52 [inline] >> do_syscall_64+0xd2/0x260 arch/x86/entry/common.c:83 >> entry_SYSCALL_64_after_hwframe+0x6d/0x75 > I just tested the reproducer against linux-next with and without your > patch [1], and confirmed that is the cause of this validation failure. > > The validation code is seeing an extra vma in the tree compared to the > vma count: > > [ 57.065418] mmap: map_count 24 vma iterator 25 > > There is a C reproducer from the bot. Can you please have a look to > figure out what is missing? It shoud be like this:                                    ******                      PPPPP             NNNNN But it was treated as:                                    ******                      PPPPPCCCCCNNNNN I haven't found something that should be added to the check yet. I'll continue tomorrow. > > It would really help if you had that complicated if statement expanded > with comments: > > if (prev == curr || /* ??? */ > addr != curr->vm_start....... > > > Thanks, > Liam > > [1]. https://lore.kernel.org/linux-mm/20240125034922.1004671-3-yajun.deng@linux.dev/