Re: BUG: using smp_processor_id() in preemptible code in radix_tree_node_alloc

From: Eric Biggers <ebiggers@kernel.org>
To: Matthew Wilcox <willy@infradead.org>
Cc: syzbot <syzbot+3eec59e770685e3dc879@syzkaller.appspotmail.com>,
	bjorn.andersson@linaro.org, davem@davemloft.net, kuba@kernel.org,
	linux-kernel@vger.kernel.org, manivannan.sadhasivam@linaro.org,
	netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: BUG: using smp_processor_id() in preemptible code in radix_tree_node_alloc
Date: Fri, 5 Jun 2020 09:11:21 -0700	[thread overview]
Message-ID: <20200605161121.GC1373@sol.localdomain> (raw)
In-Reply-To: <20200605112922.GB19604@bombadil.infradead.org>

On Fri, Jun 05, 2020 at 04:29:22AM -0700, Matthew Wilcox wrote:
> On Thu, Jun 04, 2020 at 08:55:55PM -0700, Eric Biggers wrote:
> > Possibly a bug in lib/radix-tree.c?  this_cpu_ptr() in radix_tree_node_alloc()
> > can be reached without a prior preempt_disable().  Or is the caller of
> > idr_alloc() doing something wrong?
> 
> Yes, the idr_alloc() call is plainly wrong:
> 
>         mutex_lock(&qrtr_port_lock);
>         if (!*port) {
>                 rc = idr_alloc(&qrtr_ports, ipc,
>                                QRTR_MIN_EPH_SOCKET, QRTR_MAX_EPH_SOCKET + 1,
>                                GFP_ATOMIC);
> 
> If we can take a mutex lock, there's no excuse to be using GFP_ATOMIC.
> That (and the call slightly lower in the function) should be GFP_KERNEL
> as the minimal fix (below).  I'll send a followup patch which converts
> this IDR to the XArray instead.

I did see that the GFP_ATOMIC was unnecessary, but it wasn't obvious to me that
it was actually *wrong*.

Shouldn't this requirement be documented for the @gfp argument to idr_alloc()?

- Eric