* [syzbot] kernel BUG in remove_inode_hugepages
@ 2021-08-17 2:07 ` syzbot
0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2021-08-17 2:07 UTC (permalink / raw)
To: linux-kernel, linux-mm, mike.kravetz, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: a2824f19e606 Merge tag 'mtd/fixes-for-5.14-rc7' of git://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=110d54ee300000
kernel config: https://syzkaller.appspot.com/x/.config?x=96f0602203250753
dashboard link: https://syzkaller.appspot.com/bug?extid=67654e51e54455f1c585
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12eeb6a6300000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13515779300000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+67654e51e54455f1c585@syzkaller.appspotmail.com
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffedef26928 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 000000000043f589
RDX: 000000000000effd RSI: 0000000020000680 RDI: 0000000000000003
RBP: 00007ffedef26930 R08: 0000000000000001 R09: 0000000000400034
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
R13: 0000000000000000 R14: 00000000004ad018 R15: 0000000000400488
------------[ cut here ]------------
kernel BUG at fs/hugetlbfs/inode.c:532!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8445 Comm: syz-executor211 Not tainted 5.14.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:remove_inode_hugepages+0x52f/0xa90 fs/hugetlbfs/inode.c:532
Code: ff e8 d5 f2 4c ff 48 89 ef e8 3d c3 70 ff e9 17 ff ff ff e8 c3 f2 4c ff 48 89 ef e8 cb 50 71 ff e9 1a fe ff ff e8 b1 f2 4c ff <0f> 0b e8 aa f2 4c ff 49 83 ed 01 e9 d5 fd ff ff e8 9c f2 4c ff 48
RSP: 0018:ffffc900017afa30 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888017093880 RSI: ffffffff8228b64f RDI: 0000000000000003
RBP: ffffea0000a48000 R08: 0000000000000000 R09: ffffea0000a4802f
R10: ffffffff8228b4a7 R11: 0000000000000000 R12: 7fffffffffffffff
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004801c0 CR3: 0000000029917000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
hugetlbfs_evict_inode+0x1f/0x70 fs/hugetlbfs/inode.c:557
evict+0x2ed/0x6b0 fs/inode.c:584
iput_final fs/inode.c:1660 [inline]
iput.part.0+0x539/0x850 fs/inode.c:1686
iput+0x58/0x70 fs/inode.c:1676
dentry_unlink_inode+0x2b1/0x3d0 fs/dcache.c:376
__dentry_kill+0x3c0/0x640 fs/dcache.c:582
dentry_kill fs/dcache.c:708 [inline]
dput+0x73a/0xbc0 fs/dcache.c:888
__fput+0x3ae/0x920 fs/file_table.c:293
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xbd4/0x2a60 kernel/exit.c:825
do_group_exit+0x125/0x310 kernel/exit.c:922
__do_sys_exit_group kernel/exit.c:933 [inline]
__se_sys_exit_group kernel/exit.c:931 [inline]
__x64_sys_exit_group+0x3a/0x50 kernel/exit.c:931
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x43e289
Code: Unable to access opcode bytes at RIP 0x43e25f.
RSP: 002b:00007ffedef26908 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00000000004af3b0 RCX: 000000000043e289
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000400034
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004af3b0
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
Modules linked in:
---[ end trace b9c8e89a63f407f9 ]---
RIP: 0010:remove_inode_hugepages+0x52f/0xa90 fs/hugetlbfs/inode.c:532
Code: ff e8 d5 f2 4c ff 48 89 ef e8 3d c3 70 ff e9 17 ff ff ff e8 c3 f2 4c ff 48 89 ef e8 cb 50 71 ff e9 1a fe ff ff e8 b1 f2 4c ff <0f> 0b e8 aa f2 4c ff 49 83 ed 01 e9 d5 fd ff ff e8 9c f2 4c ff 48
RSP: 0018:ffffc900017afa30 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888017093880 RSI: ffffffff8228b64f RDI: 0000000000000003
RBP: ffffea0000a48000 R08: 0000000000000000 R09: ffffea0000a4802f
R10: ffffffff8228b4a7 R11: 0000000000000000 R12: 7fffffffffffffff
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004801c0 CR3: 0000000029917000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 28 c3 sub %al,%bl
2: e8 2a 14 00 00 callq 0x1431
7: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
e: 00 00 00
11: 48 89 f8 mov %rdi,%rax
14: 48 89 f7 mov %rsi,%rdi
17: 48 89 d6 mov %rdx,%rsi
1a: 48 89 ca mov %rcx,%rdx
1d: 4d 89 c2 mov %r8,%r10
20: 4d 89 c8 mov %r9,%r8
23: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9
28: 0f 05 syscall
2a: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 01 jae 0x33
32: c3 retq
33: 48 c7 c1 c0 ff ff ff mov $0xffffffffffffffc0,%rcx
3a: f7 d8 neg %eax
3c: 64 89 01 mov %eax,%fs:(%rcx)
3f: 48 rex.W
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 5+ messages in thread
* [syzbot] kernel BUG in remove_inode_hugepages
@ 2021-08-17 2:07 ` syzbot
0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2021-08-17 2:07 UTC (permalink / raw)
To: linux-kernel, linux-mm, mike.kravetz, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: a2824f19e606 Merge tag 'mtd/fixes-for-5.14-rc7' of git://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=110d54ee300000
kernel config: https://syzkaller.appspot.com/x/.config?x=96f0602203250753
dashboard link: https://syzkaller.appspot.com/bug?extid=67654e51e54455f1c585
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12eeb6a6300000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13515779300000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+67654e51e54455f1c585@syzkaller.appspotmail.com
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffedef26928 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 000000000043f589
RDX: 000000000000effd RSI: 0000000020000680 RDI: 0000000000000003
RBP: 00007ffedef26930 R08: 0000000000000001 R09: 0000000000400034
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
R13: 0000000000000000 R14: 00000000004ad018 R15: 0000000000400488
------------[ cut here ]------------
kernel BUG at fs/hugetlbfs/inode.c:532!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8445 Comm: syz-executor211 Not tainted 5.14.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:remove_inode_hugepages+0x52f/0xa90 fs/hugetlbfs/inode.c:532
Code: ff e8 d5 f2 4c ff 48 89 ef e8 3d c3 70 ff e9 17 ff ff ff e8 c3 f2 4c ff 48 89 ef e8 cb 50 71 ff e9 1a fe ff ff e8 b1 f2 4c ff <0f> 0b e8 aa f2 4c ff 49 83 ed 01 e9 d5 fd ff ff e8 9c f2 4c ff 48
RSP: 0018:ffffc900017afa30 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888017093880 RSI: ffffffff8228b64f RDI: 0000000000000003
RBP: ffffea0000a48000 R08: 0000000000000000 R09: ffffea0000a4802f
R10: ffffffff8228b4a7 R11: 0000000000000000 R12: 7fffffffffffffff
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004801c0 CR3: 0000000029917000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
hugetlbfs_evict_inode+0x1f/0x70 fs/hugetlbfs/inode.c:557
evict+0x2ed/0x6b0 fs/inode.c:584
iput_final fs/inode.c:1660 [inline]
iput.part.0+0x539/0x850 fs/inode.c:1686
iput+0x58/0x70 fs/inode.c:1676
dentry_unlink_inode+0x2b1/0x3d0 fs/dcache.c:376
__dentry_kill+0x3c0/0x640 fs/dcache.c:582
dentry_kill fs/dcache.c:708 [inline]
dput+0x73a/0xbc0 fs/dcache.c:888
__fput+0x3ae/0x920 fs/file_table.c:293
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xbd4/0x2a60 kernel/exit.c:825
do_group_exit+0x125/0x310 kernel/exit.c:922
__do_sys_exit_group kernel/exit.c:933 [inline]
__se_sys_exit_group kernel/exit.c:931 [inline]
__x64_sys_exit_group+0x3a/0x50 kernel/exit.c:931
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x43e289
Code: Unable to access opcode bytes at RIP 0x43e25f.
RSP: 002b:00007ffedef26908 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00000000004af3b0 RCX: 000000000043e289
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000400034
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004af3b0
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
Modules linked in:
---[ end trace b9c8e89a63f407f9 ]---
RIP: 0010:remove_inode_hugepages+0x52f/0xa90 fs/hugetlbfs/inode.c:532
Code: ff e8 d5 f2 4c ff 48 89 ef e8 3d c3 70 ff e9 17 ff ff ff e8 c3 f2 4c ff 48 89 ef e8 cb 50 71 ff e9 1a fe ff ff e8 b1 f2 4c ff <0f> 0b e8 aa f2 4c ff 49 83 ed 01 e9 d5 fd ff ff e8 9c f2 4c ff 48
RSP: 0018:ffffc900017afa30 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888017093880 RSI: ffffffff8228b64f RDI: 0000000000000003
RBP: ffffea0000a48000 R08: 0000000000000000 R09: ffffea0000a4802f
R10: ffffffff8228b4a7 R11: 0000000000000000 R12: 7fffffffffffffff
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004801c0 CR3: 0000000029917000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 28 c3 sub %al,%bl
2: e8 2a 14 00 00 callq 0x1431
7: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
e: 00 00 00
11: 48 89 f8 mov %rdi,%rax
14: 48 89 f7 mov %rsi,%rdi
17: 48 89 d6 mov %rdx,%rsi
1a: 48 89 ca mov %rcx,%rdx
1d: 4d 89 c2 mov %r8,%r10
20: 4d 89 c8 mov %r9,%r8
23: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9
28: 0f 05 syscall
2a: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 01 jae 0x33
32: c3 retq
33: 48 c7 c1 c0 ff ff ff mov $0xffffffffffffffc0,%rcx
3a: f7 d8 neg %eax
3c: 64 89 01 mov %eax,%fs:(%rcx)
3f: 48 rex.W
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] kernel BUG in remove_inode_hugepages
2021-08-17 2:07 ` syzbot
(?)
@ 2021-08-18 2:35 ` Mike Kravetz
2021-08-18 4:11 ` syzbot
-1 siblings, 1 reply; 5+ messages in thread
From: Mike Kravetz @ 2021-08-18 2:35 UTC (permalink / raw)
To: syzbot, linux-kernel, linux-mm, syzkaller-bugs
On 8/16/21 7:07 PM, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: a2824f19e606 Merge tag 'mtd/fixes-for-5.14-rc7' of git://g..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=110d54ee300000
> kernel config: https://syzkaller.appspot.com/x/.config?x=96f0602203250753
> dashboard link: https://syzkaller.appspot.com/bug?extid=67654e51e54455f1c585
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12eeb6a6300000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13515779300000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+67654e51e54455f1c585@syzkaller.appspotmail.com
>
> Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffedef26928 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
> RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 000000000043f589
> RDX: 000000000000effd RSI: 0000000020000680 RDI: 0000000000000003
> RBP: 00007ffedef26930 R08: 0000000000000001 R09: 0000000000400034
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005
> R13: 0000000000000000 R14: 00000000004ad018 R15: 0000000000400488
> ------------[ cut here ]------------
> kernel BUG at fs/hugetlbfs/inode.c:532!
Let's me see if I can get syzbot to test it:
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git a2824f19e6065a0d3735acd9fe7155b104e7edf5
From 39f8d6a86215f980ba27a9618b8ec2eed4d9a963 Mon Sep 17 00:00:00 2001
From: Mike Kravetz <mike.kravetz@oracle.com>
Date: Tue, 17 Aug 2021 18:59:58 -0700
Subject: [PATCH] hugetlb: don't pass page cache pages to
restore_reserve_on_error
syzbot hit kernel BUG at fs/hugetlbfs/inode.c:532. This BUG triggers if
the HPageRestoreReserve flag is set on a page in the page cache. It
should never be set, and the routine huge_add_to_page_cache explicitly
clears the flag after adding to the page cache.
The only code other than huge page allocation which sets the flag is
restore_reserve_on_error. It will potentially set the flag in rare out
of memory conditions. syzbot was injecting errors to cause memory
allocation errors in this specific path.
The code in restore_reserve_on_error is doing the right thing. However,
there are instances where pages in the page cache were being passed to
restore_reserve_on_error. This is incorrect, as once a page goes into
the cache reservation information is correct. Even in the case of
error, the page will remain in the cache and no reservation adjustment
is needed.
Modify routines that potentially call restore_reserve_on_error with a
page cache page to no longer do so.
Note on fixes tag:
Prior to commit 846be08578ed ("mm/hugetlb: expand restore_reserve_on_error
functionality") the routine would not process page cache pages because
the HPageRestoreReserve flag is not set on such pages. Therefore, this
issue could not be trigggered. The code added by commit 846be08578ed
("mm/hugetlb: expand restore_reserve_on_error functionality") is needed
and correct. It exposed incorrect calls to restore_reserve_on_error which
is the root cause addressed by this commit.
Fixes: 846be08578ed ("mm/hugetlb: expand restore_reserve_on_error functionality")
Reported-by: syzbot+67654e51e54455f1c585@syzkaller.appspotmail.com
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
---
mm/hugetlb.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index dfc940d5221d..8ea35ba6699f 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2476,7 +2476,7 @@ void restore_reserve_on_error(struct hstate *h, struct vm_area_struct *vma,
if (!rc) {
/*
* This indicates there is an entry in the reserve map
- * added by alloc_huge_page. We know it was added
+ * not added by alloc_huge_page. We know it was added
* before the alloc_huge_page call, otherwise
* HPageRestoreReserve would be set on the page.
* Remove the entry so that a subsequent allocation
@@ -4660,7 +4660,9 @@ static vm_fault_t hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
spin_unlock(ptl);
mmu_notifier_invalidate_range_end(&range);
out_release_all:
- restore_reserve_on_error(h, vma, haddr, new_page);
+ /* No restore in case of successful pagetable update (Break COW) */
+ if (new_page != old_page)
+ restore_reserve_on_error(h, vma, haddr, new_page);
put_page(new_page);
out_release_old:
put_page(old_page);
@@ -4776,7 +4778,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm,
pte_t new_pte;
spinlock_t *ptl;
unsigned long haddr = address & huge_page_mask(h);
- bool new_page = false;
+ bool new_page, new_pagecache_page = false;
/*
* Currently, we are forced to kill the process in the event the
@@ -4799,6 +4801,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm,
goto out;
retry:
+ new_page = false;
page = find_lock_page(mapping, idx);
if (!page) {
/* Check for page in userfault range */
@@ -4842,6 +4845,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm,
goto retry;
goto out;
}
+ new_pagecache_page = true;
} else {
lock_page(page);
if (unlikely(anon_vma_prepare(vma))) {
@@ -4926,7 +4930,9 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm,
spin_unlock(ptl);
backout_unlocked:
unlock_page(page);
- restore_reserve_on_error(h, vma, haddr, page);
+ /* restore reserve for newly allocated pages not in page cache */
+ if (new_page && !new_pagecache_page)
+ restore_reserve_on_error(h, vma, haddr, page);
put_page(page);
goto out;
}
@@ -5135,6 +5141,7 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
int ret = -ENOMEM;
struct page *page;
int writable;
+ bool new_pagecache_page = false;
if (is_continue) {
ret = -EFAULT;
@@ -5228,6 +5235,7 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
ret = huge_add_to_page_cache(page, mapping, idx);
if (ret)
goto out_release_nounlock;
+ new_pagecache_page = true;
}
ptl = huge_pte_lockptr(h, dst_mm, dst_pte);
@@ -5291,7 +5299,8 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
if (vm_shared || is_continue)
unlock_page(page);
out_release_nounlock:
- restore_reserve_on_error(h, dst_vma, dst_addr, page);
+ if (!new_pagecache_page)
+ restore_reserve_on_error(h, dst_vma, dst_addr, page);
put_page(page);
goto out;
}
--
2.31.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [syzbot] kernel BUG in remove_inode_hugepages
2021-08-18 2:35 ` Mike Kravetz
@ 2021-08-18 4:11 ` syzbot
0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2021-08-18 4:11 UTC (permalink / raw)
To: linux-kernel, linux-mm, mike.kravetz, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+67654e51e54455f1c585@syzkaller.appspotmail.com
Tested on:
commit: a2824f19 Merge tag 'mtd/fixes-for-5.14-rc7' of git://g..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config: https://syzkaller.appspot.com/x/.config?x=96f0602203250753
dashboard link: https://syzkaller.appspot.com/bug?extid=67654e51e54455f1c585
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
patch: https://syzkaller.appspot.com/x/patch.diff?x=128e12c5300000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] kernel BUG in remove_inode_hugepages
@ 2021-08-18 4:11 ` syzbot
0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2021-08-18 4:11 UTC (permalink / raw)
To: linux-kernel, linux-mm, mike.kravetz, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+67654e51e54455f1c585@syzkaller.appspotmail.com
Tested on:
commit: a2824f19 Merge tag 'mtd/fixes-for-5.14-rc7' of git://g..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config: https://syzkaller.appspot.com/x/.config?x=96f0602203250753
dashboard link: https://syzkaller.appspot.com/bug?extid=67654e51e54455f1c585
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
patch: https://syzkaller.appspot.com/x/patch.diff?x=128e12c5300000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-08-18 4:11 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-17 2:07 [syzbot] kernel BUG in remove_inode_hugepages syzbot
2021-08-17 2:07 ` syzbot
2021-08-18 2:35 ` Mike Kravetz
2021-08-18 4:11 ` syzbot
2021-08-18 4:11 ` syzbot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.