From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7203EC28B2F for ; Mon, 17 Mar 2025 02:34:14 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 563E8280002; Sun, 16 Mar 2025 22:34:12 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 4FA72280001; Sun, 16 Mar 2025 22:34:12 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3B548280002; Sun, 16 Mar 2025 22:34:12 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 1B25F280001 for ; Sun, 16 Mar 2025 22:34:12 -0400 (EDT) Received: from smtpin20.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 0F97B56F61 for ; Mon, 17 Mar 2025 02:34:13 +0000 (UTC) X-FDA: 83229473586.20.90B5513 Received: from out-181.mta1.migadu.com (out-181.mta1.migadu.com [95.215.58.181]) by imf15.hostedemail.com (Postfix) with ESMTP id 4BF5BA0009 for ; Mon, 17 Mar 2025 02:34:11 +0000 (UTC) Authentication-Results: imf15.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=A84Kgl5w; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf15.hostedemail.com: domain of chengming.zhou@linux.dev designates 95.215.58.181 as permitted sender) smtp.mailfrom=chengming.zhou@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1742178851; a=rsa-sha256; cv=none; b=Yf1DnREymwDDHu3aP8MmQXgRrn9vudWPSbjumWTzwNifiFgLr16OFAbBxXSjO45z53SMoK kffYdTtyhMSDHuO8rS6k1OUdYlEZFEj8dnsBD2SSpcniRuUrGI+kTQXcLTvAkdcYRvsUMV Dn/EVQI3095s7Qnaa4FRWQVr8sh7gVM= ARC-Authentication-Results: i=1; imf15.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=A84Kgl5w; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf15.hostedemail.com: domain of chengming.zhou@linux.dev designates 95.215.58.181 as permitted sender) smtp.mailfrom=chengming.zhou@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1742178851; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=B1BtYu1DSI8lISxQbWnsSvvbQXjtPK+aRa7qKTFZoxc=; b=kfDQlLR84/h+R+McqlRj0sou31MbIJZ41OHguzDqVXoWeOZhQ7th7XKS4IcnV6+IpsY1pQ KPxd49w69klqBcAZ2+I0sEAuA4FppCjJ2c91BdjwkEZRid/l8jDJHNpGDhdCBl8U4siPxD ZP+mFSFMx9dm/c2qN7khLEsHXFRA0g4= Message-ID: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1742178849; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=B1BtYu1DSI8lISxQbWnsSvvbQXjtPK+aRa7qKTFZoxc=; b=A84Kgl5w9n3BzV9edm/ttONFdXH+h8EK/6OFwSjEOl4Q4LpN9xT/h7UMbUxTK6CqmZLo1G 2vY3BQ7I35qinp65gFQN6OW7EySsZ60Xx3oY1IP9BJ0q5YrqxAYGvV68PnAnOiodhWarYi K0gaBjkb8iXGe2qPBX9AgHtwU+inmAM= Date: Mon, 17 Mar 2025 10:33:20 +0800 MIME-Version: 1.0 Subject: Re: Linux6.14-rc5: KASAN: use-after-free Read in zswap_store To: ffhgfv , hannes , "yosry.ahmed" , nphamcs , akpm Cc: linux-mm , linux-kernel References: X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Chengming Zhou In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Migadu-Flow: FLOW_OUT X-Rspam-User: X-Rspamd-Queue-Id: 4BF5BA0009 X-Rspamd-Server: rspam05 X-Stat-Signature: xnexy43uqjeedwq1won3cz1hkd58ydnf X-HE-Tag: 1742178851-512518 X-HE-Meta: U2FsdGVkX1/VLFAm8BXny3T/2VsP6YY9yjUwvbBNqckYPuTe7LQ4N8fKi5sSbZUUzIeWaWiYxVegncEGM48z2FzzgTGXz7HCMJk334fCrtyNN07X0PaOAkmhKX4ui+bvQcJUGRjErLHtHiaUiQCcRv0Fhz0X1G0oojjSHMXADL40H2LEBofnspz36NnpvzrxBpVKldMcnh+MjTyA6SLPWiNYeLCgqw4tEKLrfnHfVbJSi3++lWrDZANhm+u54QdxkWiyvt0y6nqY8WaBcfrO3gj8W6NSh/N4pIukSwZqZLg1wt2IiYG40v3DIPxwDe0WNEDHnO1Y9vfMoJwwUlEhezWrjfaHM25UdgVuX8g2O310nemsIbMXG7xG9vbAdhCR4IB1qETh5Xa30SProT6Srqv66FM8gi0ibq/6XJ7W4kh7sXp2Q1ekI2qyyROkZlW408tKReEwoNO0gcOzVAiVFgZindDKyymfoEH7SsqZ71RPzH4jLJU4f37hSX6jDD2KQr0RTi6rjcQYp0c+CVd/mMcm60H/pAZPmb/t7WrXWkjRWTI1Bajh0HTwDgN0BNzVmkT3uldcLkmQp1hDiE4uPKajk8qyzN8yRBw6bOizgfwTmp2ZdUIAl5Z/PSLlwBYcpADSlnzV5FfJvA5Puu5/IXBFVfP3vV5u5Zt++f2A9nVnaky/n3gmETij5toS2eihV7/LD5mKdsEDopMgGFwyb7cUmFjKxuDTzL6IuZDf9OFD/czT5BD/5gctjes2JwylRHvRJczTHt84BJFNwAX87zRb/mlToDBdE+ciAHMJQV5DrToIcmXec/ov60UhOoXzfyJqk8jYsyyTOMc8rf6aCQ3tCia8CCFQZMXfeFrFWe8wpR2LQDhGXzOEAncn0PEPVPonxJTf4XLUTCNR+go6Cl5sqS6GgEjlrDguF545mK9vks7W1EGZiocUdfa7OZOqNmNgwaH+BIR1IWHCJ09 Cb+6i4zl U4xPOYYk1qI18jiLgm6JVVNhe6VL04rISZdTJfYdOjECV69z6Mi7rG0c9PPnguN2lvGMocr5OEXp4uPPyihEDUHtpgSdVkGWOaNmWCKXpTMIsP56IY8XTcbYEsiBulesD7uDi07bMoL9CMH0pY7Vb4nrQsAuaFmRJhp8jIU8RkdC2hIxw6QJnLWwPbjC9XZuagNUNSWHQGjgHqxeUIuo34kWvFO5RAgLuYO2uUzFiiz335w3a5z679oI/p9lecT5+WJypH+Yx4CyfKwf5k2fPzi+tjCoPiSHFxw0wISEPj9HSRdhtEOT3IaxCdR8vtNOHNGz8534zjbB12JOqzKbKPoseXz++tt903aYr39HpSnB0yhZGnL/yIzLs1SFHWId9hUIJP1uSYgZlEwU= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000004, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 2025/3/17 08:13, ffhgfv wrote: > Hello, I found a bug titled " KASAN: use-after-free Read in zswap_store " with modified syzkaller in the Linux6.14-rc5. > If you fix this issue, please add the following tag to the commit: Reported-by: Jianzhou Zhao , xingwei lee , Zhizhuo Tang > > I use the same kernel as syzbot instance upstream: 7eb172143d5508b4da468ed59ee857c6e5e01da6 > kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=da4b04ae798b7ef6 > compiler: gcc version 11.4.0 > ------------[ cut here ]----------------------------------------- > TITLE: KASAN: use-after-free Read in zswap_store > ================================================================== > ================================================================== > BUG: KASAN: use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] > BUG: KASAN: use-after-free in do_raw_spin_lock+0x285/0x2e0 kernel/locking/spinlock_debug.c:115 > Read of size 4 at addr ffff88804e78e014 by task kswapd0/98 > > CPU: 0 UID: 0 PID: 98 Comm: kswapd0 Not tainted 6.14.0-rc5-dirty #11 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 > Call Trace: > > __dump_stack lib/dump_stack.c:94 [inline] > dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 > print_address_description mm/kasan/report.c:408 [inline] > print_report+0xc1/0x630 mm/kasan/report.c:521 > kasan_report+0x93/0xc0 mm/kasan/report.c:634 > debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] > do_raw_spin_lock+0x285/0x2e0 kernel/locking/spinlock_debug.c:115 > spin_lock include/linux/spinlock.h:351 [inline] > z3fold_page_lock mm/z3fold.c:223 [inline] > z3fold_alloc mm/z3fold.c:1060 [inline] > z3fold_zpool_malloc+0x9b1/0x1410 mm/z3fold.c:1388 > zswap_compress mm/zswap.c:971 [inline] > zswap_store_page mm/zswap.c:1462 [inline] > zswap_store+0xe46/0x41e0 mm/zswap.c:1571 > swap_writepage+0x3a7/0x1430 mm/page_io.c:278 > pageout+0x3bf/0xac0 mm/vmscan.c:696 > shrink_folio_list+0x3509/0x4480 mm/vmscan.c:1402 > evict_folios+0x849/0x2100 mm/vmscan.c:4660 > try_to_shrink_lruvec+0x608/0x9b0 mm/vmscan.c:4821 > shrink_one+0x412/0x7d0 mm/vmscan.c:4866 > shrink_many mm/vmscan.c:4929 [inline] > lru_gen_shrink_node mm/vmscan.c:5007 [inline] > shrink_node+0x2355/0x3c10 mm/vmscan.c:5978 > kswapd_shrink_node mm/vmscan.c:6807 [inline] > balance_pgdat+0xa85/0x1740 mm/vmscan.c:6999 > kswapd+0x4c0/0xbe0 mm/vmscan.c:7264 > kthread+0x427/0x880 kernel/kthread.c:464 > ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148 > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 > > > The buggy address belongs to the physical page: > page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x564c9cd0a pfn:0x4e78e > flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) > raw: 04fff00000000000 ffffea000139e508 ffffea000139e248 0000000000000000 > raw: 0000000564c9cd0a 0000000000000000 00000000ffffffff 0000000000000000 > page dumped because: kasan: bad access detected > page_owner tracks the page as freed > page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12800(GFP_NOWAIT|__GFP_NORETRY), pid 98, tgid 98 (kswapd0), ts 431124924160, free_ts 431131252025 > set_page_owner include/linux/page_owner.h:32 [inline] > post_alloc_hook mm/page_alloc.c:1551 [inline] > prep_new_page+0x1b0/0x1e0 mm/page_alloc.c:1559 > get_page_from_freelist+0x19a2/0x3250 mm/page_alloc.c:3477 > __alloc_frozen_pages_noprof+0x324/0x6b0 mm/page_alloc.c:4739 > alloc_pages_mpol+0x20a/0x550 mm/mempolicy.c:2270 > alloc_pages_noprof+0x1c/0x250 mm/mempolicy.c:2361 > z3fold_alloc mm/z3fold.c:1036 [inline] > z3fold_zpool_malloc+0x7aa/0x1410 mm/z3fold.c:1388 > zswap_compress mm/zswap.c:971 [inline] > zswap_store_page mm/zswap.c:1462 [inline] > zswap_store+0xe46/0x41e0 mm/zswap.c:1571 > swap_writepage+0x3a7/0x1430 mm/page_io.c:278 > pageout+0x3bf/0xac0 mm/vmscan.c:696 > shrink_folio_list+0x3509/0x4480 mm/vmscan.c:1402 > evict_folios+0x849/0x2100 mm/vmscan.c:4660 > try_to_shrink_lruvec+0x608/0x9b0 mm/vmscan.c:4821 > shrink_one+0x412/0x7d0 mm/vmscan.c:4866 > shrink_many mm/vmscan.c:4929 [inline] > lru_gen_shrink_node mm/vmscan.c:5007 [inline] > shrink_node+0x2355/0x3c10 mm/vmscan.c:5978 > kswapd_shrink_node mm/vmscan.c:6807 [inline] > balance_pgdat+0xa85/0x1740 mm/vmscan.c:6999 > kswapd+0x4c0/0xbe0 mm/vmscan.c:7264 > page last free pid 38 tgid 38 stack trace: It looks like the z3fold doesn't handle the migration correctly? But it's suggested that we should use zsmalloc as zswap allocator, and the z3fold/zbud will be deleted. Thanks. > reset_page_owner include/linux/page_owner.h:25 [inline] > free_pages_prepare mm/page_alloc.c:1127 [inline] > free_frozen_pages+0x7aa/0x1290 mm/page_alloc.c:2660 > __folio_put+0x304/0x3d0 mm/swap.c:112 > folio_put include/linux/mm.h:1489 [inline] > migrate_folio_done+0x29b/0x340 mm/migrate.c:1180 > migrate_folio_move mm/migrate.c:1402 [inline] > migrate_folios_move mm/migrate.c:1712 [inline] > migrate_pages_batch+0x1c0b/0x2f30 mm/migrate.c:1959 > migrate_pages_sync+0x110/0x8d0 mm/migrate.c:1989 > migrate_pages+0x1b19/0x22d0 mm/migrate.c:2098 > compact_zone+0x1b40/0x3ed0 mm/compaction.c:2663 > compact_node+0x19c/0x2d0 mm/compaction.c:2932 > kcompactd+0x328/0x940 mm/compaction.c:3226 > kthread+0x427/0x880 kernel/kthread.c:464 > ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148 > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 > > Memory state around the buggy address: > ffff88804e78df00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ffff88804e78df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >ffff88804e78e000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff > ^ > ffff88804e78e080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff > ffff88804e78e100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff > ================================================================== > > > I hope it helps. > Best regards > Jianzhou Zhao