From: Yu Zhao <yuzhao@google.com>
To: Liam Howlett <liam.howlett@oracle.com>
Cc: Qian Cai <quic_qiancai@quicinc.com>,
"maple-tree@lists.infradead.org" <maple-tree@lists.infradead.org>,
"linux-mm@kvack.org" <linux-mm@kvack.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Andrew Morton <akpm@linux-foundation.org>
Subject: Re: [PATCH v9 28/69] mm/mmap: reorganize munmap to use maple states
Date: Sat, 11 Jun 2022 14:11:45 -0600 [thread overview]
Message-ID: <CAOUHufZk+3xCqK38CuVdWg_ZiWaLyke+Y+=CYJpraET6nKQ=yQ@mail.gmail.com> (raw)
In-Reply-To: <Yp4uD8uWB3rit/Ee@qian>
On Mon, Jun 6, 2022 at 10:40 AM Qian Cai <quic_qiancai@quicinc.com> wrote:
>
> On Mon, Jun 06, 2022 at 04:19:52PM +0000, Liam Howlett wrote:
> > Does your syscall fuzzer create a reproducer? This looks like arm64
> > and says 5.18.0-next-20220603 again. Was this bisected to the patch
> > above?
>
> This was triggered by running the fuzzer over the weekend.
>
> $ trinity -C 160
>
> No bisection was done. It was only brought up here because the trace
> pointed to do_mas_munmap() which was introduced here.
Liam,
I'm getting a similar crash on arm64 -- the allocator is madvise(),
not mprotect(). Please take a look.
Thanks.
==================================================================
BUG: KASAN: double-free or invalid-free in kmem_cache_free_bulk+0x230/0x3b0
Pointer tag: [0c], memory tag: [fe]
CPU: 2 PID: 8320 Comm: stress-ng Tainted: G B W
5.19.0-rc1-lockdep+ #3
Call trace:
dump_backtrace+0x1a0/0x200
show_stack+0x24/0x30
dump_stack_lvl+0x7c/0xa0
print_report+0x15c/0x524
kasan_report_invalid_free+0x64/0x84
____kasan_slab_free+0x150/0x184
__kasan_slab_free+0x14/0x24
slab_free_freelist_hook+0x100/0x1ac
kmem_cache_free_bulk+0x230/0x3b0
mas_destroy+0x10d8/0x1270
mas_store_prealloc+0xb8/0xec
do_mas_align_munmap+0x398/0x694
do_mas_munmap+0xf8/0x118
__vm_munmap+0x154/0x1e0
__arm64_sys_munmap+0x44/0x54
el0_svc_common+0xfc/0x1cc
do_el0_svc_compat+0x38/0x5c
el0_svc_compat+0x68/0xf4
el0t_32_sync_handler+0xc0/0xf0
el0t_32_sync+0x190/0x194
Allocated by task 8437:
kasan_set_track+0x4c/0x7c
__kasan_slab_alloc+0x84/0xa8
kmem_cache_alloc_bulk+0x300/0x408
mas_alloc_nodes+0x198/0x294
mas_preallocate+0x8c/0x110
__vma_adjust+0x174/0xc88
vma_merge+0x2e4/0x300
do_madvise+0x504/0xd20
__arm64_sys_madvise+0x54/0x64
el0_svc_common+0xfc/0x1cc
do_el0_svc_compat+0x38/0x5c
el0_svc_compat+0x68/0xf4
el0t_32_sync_handler+0xc0/0xf0
el0t_32_sync+0x190/0x194
Freed by task 8320:
kasan_set_track+0x4c/0x7c
kasan_set_free_info+0x2c/0x38
____kasan_slab_free+0x13c/0x184
__kasan_slab_free+0x14/0x24
slab_free_freelist_hook+0x100/0x1ac
kmem_cache_free+0x11c/0x264
mt_destroy_walk+0x6d8/0x714
mas_wmb_replace+0x9d4/0xa68
mas_spanning_rebalance+0x1af0/0x1d2c
mas_wr_spanning_store+0x908/0x964
mas_wr_store_entry+0x53c/0x5c0
mas_store_prealloc+0x88/0xec
do_mas_align_munmap+0x398/0x694
do_mas_munmap+0xf8/0x118
__vm_munmap+0x154/0x1e0
__arm64_sys_munmap+0x44/0x54
el0_svc_common+0xfc/0x1cc
do_el0_svc_compat+0x38/0x5c
el0_svc_compat+0x68/0xf4
el0t_32_sync_handler+0xc0/0xf0
el0t_32_sync+0x190/0x194
The buggy address belongs to the object at ffffff808b5f0a00
which belongs to the cache maple_node of size 256
The buggy address is located 0 bytes inside of
256-byte region [ffffff808b5f0a00, ffffff808b5f0b00)
The buggy address belongs to the physical page:
page:fffffffe022d7c00 refcount:1 mapcount:0 mapping:0000000000000000
index:0xcffff808b5f0a00 pfn:0x10b5f0
head:fffffffe022d7c00 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x8000000000010200(slab|head|zone=2|kasantag=0x0)
raw: 8000000000010200 fffffffe031a8608 fffffffe021a3608 caffff808002c800
raw: 0cffff808b5f0a00 0000000000150013 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffffff808b5f0800: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
ffffff808b5f0900: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
>ffffff808b5f0a00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
^
ffffff808b5f0b00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
ffffff808b5f0c00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
==================================================================
next prev parent reply other threads:[~2022-06-11 20:12 UTC|newest]
Thread overview: 83+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-04 0:26 [PATCH 0/1] Prepare for maple tree Liam Howlett
2022-05-04 0:26 ` [PATCH 1/1] mips: rename mt_init to mips_mt_init Liam Howlett
2022-05-12 9:54 ` David Hildenbrand
2022-05-04 1:12 ` [PATCH v9 15/69] damon: Convert __damon_va_three_regions to use the VMA iterator Liam Howlett
2022-05-10 10:44 ` SeongJae Park
2022-05-10 16:27 ` Liam Howlett
2022-05-10 19:13 ` Andrew Morton
2022-05-04 1:13 ` [PATCH v9 16/69] proc: remove VMA rbtree use from nommu Liam Howlett
2022-05-04 1:13 ` [PATCH v9 17/69] mm: remove rb tree Liam Howlett
2022-05-04 1:13 ` [PATCH v9 19/69] xen: use vma_lookup() in privcmd_ioctl_mmap() Liam Howlett
2022-05-04 1:13 ` [PATCH v9 20/69] mm: optimize find_exact_vma() to use vma_lookup() Liam Howlett
2022-05-04 1:13 ` [PATCH v9 18/69] mmap: change zeroing of maple tree in __vma_adjust() Liam Howlett
2022-05-04 1:13 ` [PATCH v9 23/69] mm: use maple tree operations for find_vma_intersection() Liam Howlett
2022-05-04 1:13 ` [PATCH v9 21/69] mm/khugepaged: optimize collapse_pte_mapped_thp() by using vma_lookup() Liam Howlett
2022-05-04 1:13 ` [PATCH v9 22/69] mm/mmap: change do_brk_flags() to expand existing VMA and add do_brk_munmap() Liam Howlett
2022-05-04 1:13 ` [PATCH v9 24/69] mm/mmap: use advanced maple tree API for mmap_region() Liam Howlett
2022-05-04 1:13 ` [PATCH v9 25/69] mm: remove vmacache Liam Howlett
2022-05-04 1:13 ` [PATCH v9 27/69] mm/mmap: move mmap_region() below do_munmap() Liam Howlett
2022-05-04 1:13 ` [PATCH v9 26/69] mm: convert vma_lookup() to use mtree_load() Liam Howlett
2022-05-04 1:13 ` [PATCH v9 28/69] mm/mmap: reorganize munmap to use maple states Liam Howlett
2022-06-06 12:09 ` Qian Cai
2022-06-06 16:19 ` Liam Howlett
2022-06-06 16:40 ` Qian Cai
2022-06-11 20:11 ` Yu Zhao [this message]
2022-06-11 21:49 ` Yu Zhao
2022-06-12 1:09 ` Liam Howlett
2022-06-15 14:25 ` Liam Howlett
2022-06-15 18:07 ` Yu Zhao
2022-06-15 18:55 ` Liam Howlett
2022-06-15 19:05 ` Yu Zhao
2022-06-15 21:16 ` Yu Zhao
2022-06-16 1:50 ` Liam Howlett
2022-06-16 1:58 ` Yu Zhao
2022-06-16 2:56 ` Liam Howlett
2022-06-16 3:02 ` Yu Zhao
2022-06-16 5:45 ` Yu Zhao
2022-06-16 5:55 ` Yu Zhao
2022-06-16 18:26 ` Liam Howlett
2022-06-16 18:34 ` Yu Zhao
2022-06-17 13:49 ` Liam Howlett
2022-05-04 1:13 ` [PATCH v9 29/69] mm/mmap: change do_brk_munmap() to use do_mas_align_munmap() Liam Howlett
2022-05-04 1:13 ` [PATCH v9 30/69] arm64: remove mmap linked list from vdso Liam Howlett
2022-05-04 1:13 ` [PATCH v9 31/69] arm64: Change elfcore for_each_mte_vma() to use VMA iterator Liam Howlett
2022-05-04 1:13 ` [PATCH v9 33/69] powerpc: remove mmap linked list walks Liam Howlett
2022-05-04 1:13 ` [PATCH v9 32/69] parisc: remove mmap linked list from cache handling Liam Howlett
2022-05-04 1:13 ` [PATCH v9 35/69] x86: remove vma linked list walks Liam Howlett
2022-05-04 1:13 ` [PATCH v9 36/69] xtensa: " Liam Howlett
2022-05-04 1:13 ` [PATCH v9 34/69] s390: " Liam Howlett
2022-05-04 1:13 ` [PATCH v9 38/69] optee: remove vma linked list walk Liam Howlett
2022-05-04 1:13 ` [PATCH v9 39/69] um: " Liam Howlett
2022-05-04 1:13 ` [PATCH v9 37/69] cxl: " Liam Howlett
2022-05-04 1:13 ` [PATCH v9 40/69] coredump: " Liam Howlett
2022-05-04 1:13 ` [PATCH v9 41/69] exec: use VMA iterator instead of linked list Liam Howlett
2022-05-04 1:13 ` [PATCH v9 42/69] fs/proc/base: use maple tree iterators in place " Liam Howlett
2022-05-04 1:13 ` [PATCH v9 43/69] fs/proc/task_mmu: stop using linked list and highest_vm_end Liam Howlett
2022-05-04 1:13 ` [PATCH v9 45/69] ipc/shm: use VMA iterator instead of linked list Liam Howlett
2022-05-04 1:13 ` [PATCH v9 44/69] userfaultfd: use maple tree iterator to iterate VMAs Liam Howlett
2022-05-04 1:14 ` [PATCH v9 47/69] perf: use VMA iterator Liam Howlett
2022-05-04 1:14 ` [PATCH v9 46/69] acct: use VMA iterator instead of linked list Liam Howlett
2022-05-04 1:14 ` [PATCH v9 48/69] sched: use maple tree iterator to walk VMAs Liam Howlett
2022-05-04 1:14 ` [PATCH v9 50/69] bpf: remove VMA linked list Liam Howlett
2022-05-04 1:14 ` [PATCH v9 49/69] fork: use VMA iterator Liam Howlett
2022-05-04 1:14 ` [PATCH v9 52/69] mm/khugepaged: stop using vma linked list Liam Howlett
2022-05-04 1:14 ` [PATCH v9 51/69] mm/gup: use maple tree navigation instead of " Liam Howlett
2022-05-04 1:14 ` [PATCH v9 53/69] mm/ksm: use vma iterators instead of vma " Liam Howlett
2022-05-04 1:14 ` [PATCH v9 54/69] mm/madvise: use vma_find() " Liam Howlett
2022-05-04 1:14 ` [PATCH v9 55/69] mm/memcontrol: stop using mm->highest_vm_end Liam Howlett
2022-05-04 1:14 ` [PATCH v9 56/69] mm/mempolicy: use vma iterator & maple state instead of vma linked list Liam Howlett
2022-05-04 1:14 ` [PATCH v9 59/69] mm/mremap: use vma_find_intersection() " Liam Howlett
2022-05-04 1:14 ` [PATCH v9 57/69] mm/mlock: use vma iterator and maple state " Liam Howlett
2022-05-04 1:14 ` [PATCH v9 58/69] mm/mprotect: use maple tree navigation " Liam Howlett
2022-05-04 1:14 ` [PATCH v9 60/69] mm/msync: use vma_find() " Liam Howlett
2022-05-04 1:14 ` [PATCH v9 61/69] mm/oom_kill: use maple tree iterators " Liam Howlett
2022-05-04 1:14 ` [PATCH v9 62/69] mm/pagewalk: use vma_find() " Liam Howlett
2022-05-04 1:14 ` [PATCH v9 63/69] mm/swapfile: use vma iterator " Liam Howlett
2022-05-04 1:14 ` [PATCH v9 65/69] nommu: remove uses of VMA " Liam Howlett
2022-05-04 1:14 ` [PATCH v9 64/69] i915: use the VMA iterator Liam Howlett
2022-05-04 1:14 ` [PATCH v9 66/69] riscv: use vma iterator for vdso Liam Howlett
2022-05-04 1:14 ` [PATCH v9 68/69] mm/mmap: drop range_has_overlap() function Liam Howlett
2022-05-04 1:14 ` [PATCH v9 67/69] mm: remove the vma linked list Liam Howlett
2022-05-13 13:30 ` Qian Cai
2022-05-13 14:17 ` Liam Howlett
2022-05-04 1:14 ` [PATCH v9 69/69] mm/mmap.c: pass in mapping to __vma_link_file() Liam Howlett
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAOUHufZk+3xCqK38CuVdWg_ZiWaLyke+Y+=CYJpraET6nKQ=yQ@mail.gmail.com' \
--to=yuzhao@google.com \
--cc=akpm@linux-foundation.org \
--cc=liam.howlett@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=maple-tree@lists.infradead.org \
--cc=quic_qiancai@quicinc.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.