linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Matthew Wilcox <willy@infradead.org>
To: Wei Yang <richard.weiyang@gmail.com>
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 5/9] XArray: entry in last level is not expected to be a node
Date: Sun, 5 Apr 2020 14:56:36 -0700	[thread overview]
Message-ID: <20200405215636.GW21484@bombadil.infradead.org> (raw)
In-Reply-To: <20200405110743.bzpvz4jzwr4kharr@master>

On Sun, Apr 05, 2020 at 11:07:43AM +0000, Wei Yang wrote:
> Occasionally, I see this error message without my change on 5.6.

I've never seen this one before.  Maybe my test machine is insufficient ...

> random seed 1586068185
> running tests
> XArray: 21151201 of 21151201 tests passed
> =================================================================
> ==6040==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0031bce81 at pc 0x00000040b4b3 bp 0x7f95e87f9bb0 sp 0x7f95e87f9ba0
> READ of size 1 at 0x60c0031bce81 thread T11
>     #0 0x40b4b2 in xas_find_marked ../../../lib/xarray.c:1182
>     #1 0x45318e in tagged_iteration_fn /root/git/linux/tools/testing/radix-tree/iteration_check.c:77
>     #2 0x7f95ef2464e1 in start_thread (/lib64/libpthread.so.0+0x94e1)
>     #3 0x7f95ee8026d2 in clone (/lib64/libc.so.6+0x1016d2)
> 
> 0x60c0031bce81 is located 1 bytes inside of 128-byte region [0x60c0031bce80,0x60c0031bcf00)
> freed by thread T1 here:
>     #0 0x7f95ef36c91f in __interceptor_free (/lib64/libasan.so.5+0x10d91f)
>     #1 0x43e4ba in kmem_cache_free /root/git/linux/tools/testing/radix-tree/linux.c:64
> 
> previously allocated by thread T13 here:
>     #0 0x7f95ef36cd18 in __interceptor_malloc (/lib64/libasan.so.5+0x10dd18)
>     #1 0x43e1af in kmem_cache_alloc /root/git/linux/tools/testing/radix-tree/linux.c:44
> 
> Thread T11 created by T0 here:
>     #0 0x7f95ef299955 in pthread_create (/lib64/libasan.so.5+0x3a955)
>     #1 0x454862 in iteration_test /root/git/linux/tools/testing/radix-tree/iteration_check.c:178
> 
> Thread T1 created by T0 here:
>     #0 0x7f95ef299955 in pthread_create (/lib64/libasan.so.5+0x3a955)
>     #1 0x7f95ef235b89  (/lib64/liburcu.so.6+0x3b89)
> 
> Thread T13 created by T0 here:
>     #0 0x7f95ef299955 in pthread_create (/lib64/libasan.so.5+0x3a955)
>     #1 0x4548a4 in iteration_test /root/git/linux/tools/testing/radix-tree/iteration_check.c:186
> 
> This is not always like this. Didn't figure out the reason yet. Hope you many
> have some point.

How often are you seeing it?

T1 (the thread which frees the memory) is the RCU thread, so the freeing
went through RCU.  For some reason, T11 (the iterating thread) isn't
preventing the freeing by its use of the RCU read lock.

  reply	other threads:[~2020-04-05 21:56 UTC|newest]

Thread overview: 41+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-03-30 12:36 [PATCH 0/9] XArray: several cleanups Wei Yang
2020-03-30 12:36 ` [PATCH 1/9] XArray: fix comment on Zero/Retry entry Wei Yang
2020-03-30 12:46   ` Matthew Wilcox
2020-03-30 13:42     ` Wei Yang
2020-03-30 12:36 ` [PATCH 2/9] XArray: simplify the calculation of shift Wei Yang
2020-03-30 13:20   ` Matthew Wilcox
2020-03-30 14:07     ` Wei Yang
2020-03-30 12:36 ` [PATCH 3/9] XArray: handle a NULL head by itself Wei Yang
2020-03-30 12:36 ` [PATCH 4/9] XArray: don't expect to have more nr_values than count Wei Yang
2020-03-30 12:36 ` [PATCH 5/9] XArray: entry in last level is not expected to be a node Wei Yang
2020-03-30 12:48   ` Matthew Wilcox
2020-03-30 14:15     ` Wei Yang
2020-03-30 14:28       ` Matthew Wilcox
2020-03-30 22:10         ` Wei Yang
2020-03-31 13:42         ` Wei Yang
2020-03-31 16:42           ` Matthew Wilcox
2020-03-31 22:04             ` Wei Yang
2020-03-31 23:59               ` Matthew Wilcox
2020-04-01 22:10                 ` Wei Yang
2020-04-01 22:20                   ` Matthew Wilcox
2020-04-02 12:36                     ` Wei Yang
2020-04-03 22:39                     ` Wei Yang
2020-04-04 15:37                       ` Matthew Wilcox
2020-04-05 11:07                     ` Wei Yang
2020-04-05 21:56                       ` Matthew Wilcox [this message]
2020-04-06  1:14                         ` Wei Yang
2020-04-06  1:24     ` Wei Yang
2020-04-11 13:56       ` Wei Yang
2020-04-28 21:24     ` Wei Yang
2020-03-30 12:36 ` [PATCH 6/9] XArray: internal node is a xa_node when it is bigger than XA_ZERO_ENTRY Wei Yang
2020-03-30 12:50   ` Matthew Wilcox
2020-03-30 13:45     ` Wei Yang
2020-03-30 13:49       ` Matthew Wilcox
2020-03-30 14:13         ` Wei Yang
2020-03-30 14:27           ` Matthew Wilcox
2020-03-30 22:20             ` Wei Yang
2020-03-31  0:06               ` Matthew Wilcox
2020-03-31 13:40                 ` Wei Yang
2020-03-30 12:36 ` [PATCH 7/9] XArray: the NULL xa_node condition is handled in xas_top Wei Yang
2020-03-30 12:36 ` [PATCH 8/9] XArray: take xas_error() handling for clearer logic Wei Yang
2020-03-30 12:36 ` [PATCH 9/9] XArray: adjust xa_offset till it gets the correct node Wei Yang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200405215636.GW21484@bombadil.infradead.org \
    --to=willy@infradead.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=richard.weiyang@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).