Re: [syzbot] general protection fault in list_lru_add

[Muchun Song <songmuchun@bytedance.com>]

[-- Attachment #1: Type: text/plain, Size: 998 bytes --]

On Fri, Mar 25, 2022 at 3:47 AM Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> On Thu, Mar 24, 2022 at 12:45 PM Linus Torvalds
> <torvalds@linux-foundation.org> wrote:
> >
> > On Thu, Mar 24, 2022 at 12:41 PM syzbot
> > <syzbot+f8c45ccc7d5d45fc5965@syzkaller.appspotmail.com> wrote:
> > >
> > > syzbot has tested the proposed patch and the reproducer did not trigger any issue:
> >
> > Heh, well that's unfortunate.
> >
> > I think the issue is that it triggered a new BUG() that didn't match
> > the previous NULL pointer dereference, so it thinks things are
> > "fixed".
>
> Oh, no, it's because it used the truncated patch that didn't do anything:
>
> > patch:          https://syzkaller.appspot.com/x/patch.diff?x=1208043d700000
>
> and maybe (due to the racy nature) nothing actually happened.
>

It is not easy to reproduce. I'm also trying to reproduce locally.

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
5abc1e37afa0335c52608d640fd30910b2eeda21

[-- Attachment #2: test.patch --]
[-- Type: application/octet-stream, Size: 798 bytes --]

diff --git a/mm/list_lru.c b/mm/list_lru.c
index fc938d8ff48f..885ae5d77002 100644
--- a/mm/list_lru.c
+++ b/mm/list_lru.c
@@ -76,6 +76,7 @@ list_lru_from_kmem(struct list_lru *lru, int nid, void *ptr,
 	struct list_lru_node *nlru = &lru->node[nid];
 	struct list_lru_one *l = &nlru->lru;
 	struct mem_cgroup *memcg = NULL;
+	int kmemcg_id;
 
 	if (!lru->mlrus)
 		goto out;
@@ -84,7 +85,12 @@ list_lru_from_kmem(struct list_lru *lru, int nid, void *ptr,
 	if (!memcg)
 		goto out;
 
-	l = list_lru_from_memcg_idx(lru, nid, memcg_cache_id(memcg));
+	kmemcg_id = memcg_kmem_id(memcg);
+	l = list_lru_from_memcg_idx(lru, nid, kmemcg_id);
+	if (!l) {
+		pr_info("BUG: the memcg(%px)->objcg(%px), kmemcg_id: %d\n",
+			memcg, memcg->objcg, kmemcg_id);
+	}
 out:
 	if (memcg_ptr)
 		*memcg_ptr = memcg;