* [syzbot] kernel BUG in remove_inode_hugepages @ 2021-08-17 2:07 syzbot 2021-08-18 2:35 ` Mike Kravetz 0 siblings, 1 reply; 3+ messages in thread From: syzbot @ 2021-08-17 2:07 UTC (permalink / raw) To: linux-kernel, linux-mm, mike.kravetz, syzkaller-bugs Hello, syzbot found the following issue on: HEAD commit: a2824f19e606 Merge tag 'mtd/fixes-for-5.14-rc7' of git://g.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=110d54ee300000 kernel config: https://syzkaller.appspot.com/x/.config?x=96f0602203250753 dashboard link: https://syzkaller.appspot.com/bug?extid=67654e51e54455f1c585 compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12eeb6a6300000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13515779300000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+67654e51e54455f1c585@syzkaller.appspotmail.com Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffedef26928 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 000000000043f589 RDX: 000000000000effd RSI: 0000000020000680 RDI: 0000000000000003 RBP: 00007ffedef26930 R08: 0000000000000001 R09: 0000000000400034 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 R13: 0000000000000000 R14: 00000000004ad018 R15: 0000000000400488 ------------[ cut here ]------------ kernel BUG at fs/hugetlbfs/inode.c:532! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 8445 Comm: syz-executor211 Not tainted 5.14.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:remove_inode_hugepages+0x52f/0xa90 fs/hugetlbfs/inode.c:532 Code: ff e8 d5 f2 4c ff 48 89 ef e8 3d c3 70 ff e9 17 ff ff ff e8 c3 f2 4c ff 48 89 ef e8 cb 50 71 ff e9 1a fe ff ff e8 b1 f2 4c ff <0f> 0b e8 aa f2 4c ff 49 83 ed 01 e9 d5 fd ff ff e8 9c f2 4c ff 48 RSP: 0018:ffffc900017afa30 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff888017093880 RSI: ffffffff8228b64f RDI: 0000000000000003 RBP: ffffea0000a48000 R08: 0000000000000000 R09: ffffea0000a4802f R10: ffffffff8228b4a7 R11: 0000000000000000 R12: 7fffffffffffffff R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004801c0 CR3: 0000000029917000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: hugetlbfs_evict_inode+0x1f/0x70 fs/hugetlbfs/inode.c:557 evict+0x2ed/0x6b0 fs/inode.c:584 iput_final fs/inode.c:1660 [inline] iput.part.0+0x539/0x850 fs/inode.c:1686 iput+0x58/0x70 fs/inode.c:1676 dentry_unlink_inode+0x2b1/0x3d0 fs/dcache.c:376 __dentry_kill+0x3c0/0x640 fs/dcache.c:582 dentry_kill fs/dcache.c:708 [inline] dput+0x73a/0xbc0 fs/dcache.c:888 __fput+0x3ae/0x920 fs/file_table.c:293 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0xbd4/0x2a60 kernel/exit.c:825 do_group_exit+0x125/0x310 kernel/exit.c:922 __do_sys_exit_group kernel/exit.c:933 [inline] __se_sys_exit_group kernel/exit.c:931 [inline] __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:931 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x43e289 Code: Unable to access opcode bytes at RIP 0x43e25f. RSP: 002b:00007ffedef26908 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00000000004af3b0 RCX: 000000000043e289 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000400034 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004af3b0 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 Modules linked in: ---[ end trace b9c8e89a63f407f9 ]--- RIP: 0010:remove_inode_hugepages+0x52f/0xa90 fs/hugetlbfs/inode.c:532 Code: ff e8 d5 f2 4c ff 48 89 ef e8 3d c3 70 ff e9 17 ff ff ff e8 c3 f2 4c ff 48 89 ef e8 cb 50 71 ff e9 1a fe ff ff e8 b1 f2 4c ff <0f> 0b e8 aa f2 4c ff 49 83 ed 01 e9 d5 fd ff ff e8 9c f2 4c ff 48 RSP: 0018:ffffc900017afa30 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff888017093880 RSI: ffffffff8228b64f RDI: 0000000000000003 RBP: ffffea0000a48000 R08: 0000000000000000 R09: ffffea0000a4802f R10: ffffffff8228b4a7 R11: 0000000000000000 R12: 7fffffffffffffff R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004801c0 CR3: 0000000029917000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 28 c3 sub %al,%bl 2: e8 2a 14 00 00 callq 0x1431 7: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1) e: 00 00 00 11: 48 89 f8 mov %rdi,%rax 14: 48 89 f7 mov %rsi,%rdi 17: 48 89 d6 mov %rdx,%rsi 1a: 48 89 ca mov %rcx,%rdx 1d: 4d 89 c2 mov %r8,%r10 20: 4d 89 c8 mov %r9,%r8 23: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9 28: 0f 05 syscall 2a: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction 30: 73 01 jae 0x33 32: c3 retq 33: 48 c7 c1 c0 ff ff ff mov $0xffffffffffffffc0,%rcx 3a: f7 d8 neg %eax 3c: 64 89 01 mov %eax,%fs:(%rcx) 3f: 48 rex.W --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [syzbot] kernel BUG in remove_inode_hugepages 2021-08-17 2:07 [syzbot] kernel BUG in remove_inode_hugepages syzbot @ 2021-08-18 2:35 ` Mike Kravetz 2021-08-18 4:11 ` syzbot 0 siblings, 1 reply; 3+ messages in thread From: Mike Kravetz @ 2021-08-18 2:35 UTC (permalink / raw) To: syzbot, linux-kernel, linux-mm, syzkaller-bugs On 8/16/21 7:07 PM, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: a2824f19e606 Merge tag 'mtd/fixes-for-5.14-rc7' of git://g.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=110d54ee300000 > kernel config: https://syzkaller.appspot.com/x/.config?x=96f0602203250753 > dashboard link: https://syzkaller.appspot.com/bug?extid=67654e51e54455f1c585 > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12eeb6a6300000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13515779300000 > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+67654e51e54455f1c585@syzkaller.appspotmail.com > > Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 > RSP: 002b:00007ffedef26928 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 > RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 000000000043f589 > RDX: 000000000000effd RSI: 0000000020000680 RDI: 0000000000000003 > RBP: 00007ffedef26930 R08: 0000000000000001 R09: 0000000000400034 > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 > R13: 0000000000000000 R14: 00000000004ad018 R15: 0000000000400488 > ------------[ cut here ]------------ > kernel BUG at fs/hugetlbfs/inode.c:532! Let's me see if I can get syzbot to test it: #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git a2824f19e6065a0d3735acd9fe7155b104e7edf5 From 39f8d6a86215f980ba27a9618b8ec2eed4d9a963 Mon Sep 17 00:00:00 2001 From: Mike Kravetz <mike.kravetz@oracle.com> Date: Tue, 17 Aug 2021 18:59:58 -0700 Subject: [PATCH] hugetlb: don't pass page cache pages to restore_reserve_on_error syzbot hit kernel BUG at fs/hugetlbfs/inode.c:532. This BUG triggers if the HPageRestoreReserve flag is set on a page in the page cache. It should never be set, and the routine huge_add_to_page_cache explicitly clears the flag after adding to the page cache. The only code other than huge page allocation which sets the flag is restore_reserve_on_error. It will potentially set the flag in rare out of memory conditions. syzbot was injecting errors to cause memory allocation errors in this specific path. The code in restore_reserve_on_error is doing the right thing. However, there are instances where pages in the page cache were being passed to restore_reserve_on_error. This is incorrect, as once a page goes into the cache reservation information is correct. Even in the case of error, the page will remain in the cache and no reservation adjustment is needed. Modify routines that potentially call restore_reserve_on_error with a page cache page to no longer do so. Note on fixes tag: Prior to commit 846be08578ed ("mm/hugetlb: expand restore_reserve_on_error functionality") the routine would not process page cache pages because the HPageRestoreReserve flag is not set on such pages. Therefore, this issue could not be trigggered. The code added by commit 846be08578ed ("mm/hugetlb: expand restore_reserve_on_error functionality") is needed and correct. It exposed incorrect calls to restore_reserve_on_error which is the root cause addressed by this commit. Fixes: 846be08578ed ("mm/hugetlb: expand restore_reserve_on_error functionality") Reported-by: syzbot+67654e51e54455f1c585@syzkaller.appspotmail.com Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com> --- mm/hugetlb.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index dfc940d5221d..8ea35ba6699f 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -2476,7 +2476,7 @@ void restore_reserve_on_error(struct hstate *h, struct vm_area_struct *vma, if (!rc) { /* * This indicates there is an entry in the reserve map - * added by alloc_huge_page. We know it was added + * not added by alloc_huge_page. We know it was added * before the alloc_huge_page call, otherwise * HPageRestoreReserve would be set on the page. * Remove the entry so that a subsequent allocation @@ -4660,7 +4660,9 @@ static vm_fault_t hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma, spin_unlock(ptl); mmu_notifier_invalidate_range_end(&range); out_release_all: - restore_reserve_on_error(h, vma, haddr, new_page); + /* No restore in case of successful pagetable update (Break COW) */ + if (new_page != old_page) + restore_reserve_on_error(h, vma, haddr, new_page); put_page(new_page); out_release_old: put_page(old_page); @@ -4776,7 +4778,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, pte_t new_pte; spinlock_t *ptl; unsigned long haddr = address & huge_page_mask(h); - bool new_page = false; + bool new_page, new_pagecache_page = false; /* * Currently, we are forced to kill the process in the event the @@ -4799,6 +4801,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, goto out; retry: + new_page = false; page = find_lock_page(mapping, idx); if (!page) { /* Check for page in userfault range */ @@ -4842,6 +4845,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, goto retry; goto out; } + new_pagecache_page = true; } else { lock_page(page); if (unlikely(anon_vma_prepare(vma))) { @@ -4926,7 +4930,9 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, spin_unlock(ptl); backout_unlocked: unlock_page(page); - restore_reserve_on_error(h, vma, haddr, page); + /* restore reserve for newly allocated pages not in page cache */ + if (new_page && !new_pagecache_page) + restore_reserve_on_error(h, vma, haddr, page); put_page(page); goto out; } @@ -5135,6 +5141,7 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm, int ret = -ENOMEM; struct page *page; int writable; + bool new_pagecache_page = false; if (is_continue) { ret = -EFAULT; @@ -5228,6 +5235,7 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm, ret = huge_add_to_page_cache(page, mapping, idx); if (ret) goto out_release_nounlock; + new_pagecache_page = true; } ptl = huge_pte_lockptr(h, dst_mm, dst_pte); @@ -5291,7 +5299,8 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm, if (vm_shared || is_continue) unlock_page(page); out_release_nounlock: - restore_reserve_on_error(h, dst_vma, dst_addr, page); + if (!new_pagecache_page) + restore_reserve_on_error(h, dst_vma, dst_addr, page); put_page(page); goto out; } -- 2.31.1 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [syzbot] kernel BUG in remove_inode_hugepages 2021-08-18 2:35 ` Mike Kravetz @ 2021-08-18 4:11 ` syzbot 0 siblings, 0 replies; 3+ messages in thread From: syzbot @ 2021-08-18 4:11 UTC (permalink / raw) To: linux-kernel, linux-mm, mike.kravetz, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-and-tested-by: syzbot+67654e51e54455f1c585@syzkaller.appspotmail.com Tested on: commit: a2824f19 Merge tag 'mtd/fixes-for-5.14-rc7' of git://g.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git kernel config: https://syzkaller.appspot.com/x/.config?x=96f0602203250753 dashboard link: https://syzkaller.appspot.com/bug?extid=67654e51e54455f1c585 compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1 patch: https://syzkaller.appspot.com/x/patch.diff?x=128e12c5300000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-08-18 4:11 UTC | newest] Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-08-17 2:07 [syzbot] kernel BUG in remove_inode_hugepages syzbot 2021-08-18 2:35 ` Mike Kravetz 2021-08-18 4:11 ` syzbot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).