From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A30BC54E5D for ; Mon, 18 Mar 2024 21:37:47 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id B35066B0096; Mon, 18 Mar 2024 17:37:46 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id AE58A6B0099; Mon, 18 Mar 2024 17:37:46 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9AD316B009A; Mon, 18 Mar 2024 17:37:46 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 8C8936B0096 for ; Mon, 18 Mar 2024 17:37:46 -0400 (EDT) Received: from smtpin22.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 5D28DA08FC for ; Mon, 18 Mar 2024 21:37:46 +0000 (UTC) X-FDA: 81911472132.22.5FCAC77 Received: from mail-vk1-f178.google.com (mail-vk1-f178.google.com [209.85.221.178]) by imf06.hostedemail.com (Postfix) with ESMTP id A83E118001B for ; Mon, 18 Mar 2024 21:37:44 +0000 (UTC) Authentication-Results: imf06.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=gobbzsIb; spf=pass (imf06.hostedemail.com: domain of 21cnbao@gmail.com designates 209.85.221.178 as permitted sender) smtp.mailfrom=21cnbao@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1710797864; a=rsa-sha256; cv=none; b=nZ4mDazaOquKh9pvX4y7JuamRWWMzbjzMPBNF4bpNSVZkKHcYHHFB5ZpFvXUVfA731EFqN MEXs0J8kq72khqvjozP+740iV28uorZ5DqFOAR8nCz4ByXwIAb4WOkeK6M00Sj0Bg3kGgP xbUjQTnBodJ0bvMSA4ST/A9ipdHoEV8= ARC-Authentication-Results: i=1; imf06.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=gobbzsIb; spf=pass (imf06.hostedemail.com: domain of 21cnbao@gmail.com designates 209.85.221.178 as permitted sender) smtp.mailfrom=21cnbao@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1710797864; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=ISfCadt2VgNt6/h3A04UiF5MTEGK7Lrl50I2y0DXkrU=; b=fGKyygSF6vxVXjXz11rF67SYYU+swKFEz1yxFAg8pYM4ZIlddEp6QsvAf11SR2UYBu7+Lw EFAHKA1kihTs5UWexiisQCEZnKfh+AE9blN9ctHJ/IdSUrp7vwkn8WWeHjpD5fWn5OYXOP HTwmlL9IpU9lRtvGe4pJ/dKrLVPht+8= Received: by mail-vk1-f178.google.com with SMTP id 71dfb90a1353d-4d44f565284so293045e0c.2 for ; Mon, 18 Mar 2024 14:37:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1710797864; x=1711402664; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=ISfCadt2VgNt6/h3A04UiF5MTEGK7Lrl50I2y0DXkrU=; b=gobbzsIbY3KJfh45eJrJyehWOLSoaJHDLDQ6QK7s2iIhItv1iPfYUTXkZHQvv3ULBy 7u8dIsy3t+XjI3XB6VCTMutTd6YQPeg/gQSR7akrToz/Fp5GscORLAd4qccRcnxy5/Y7 aQghz0iMxbC8sy6HBCi6FBEATQNVMC16A+Hqdv87IK3RyChGbUk+kLdTi0e81XrXhIEN GrOORunAthaPjeApwjKU9Y8F8dETce9vZzHqxywxrWt0erNux0exaujxnK5QlW5upqlM aciCoNFTuvbGI5YvpSeeFb6076TRZR1/RJFFkujCzJcUlo14YimV+CX2sr3KPS8oqVFm gVhw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710797864; x=1711402664; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ISfCadt2VgNt6/h3A04UiF5MTEGK7Lrl50I2y0DXkrU=; b=h1ms26yVxYjRD1zq850i44mgQTjnE8zMK7SEuEcpbN3ujuWYGnawODtgJvch6ew87m 7XM+MNk4l0hd8C0aqX/FB3blE1YmE5nNbXKPXz4wPZhD/ZqLGB9nKF9R/LOZCYdwWmc6 Pzw4pfuiuDetUarvroUPgz0QgFTcpGobV8BU+x+o5meCiJm21DbhAMJ0xV1fQESUpHL2 +xzAv/vEQdjuMR/gEd7D5Ut72s0FHLo0fQEZpxGT5kYZI5DFxCtA6IH7c1gEInBYoPK4 C/UVOWaFIgxAVz/bZTMC+6EzuCj5+8pG2qf/nStTWXhYrtqIgmYE/pp6Ose2Mx6/Dp/9 CnRw== X-Forwarded-Encrypted: i=1; AJvYcCXJ4P55YuxDgsCcEUxscpzNnuOnXtua8HoSYqv04he0xfv2gc4RIUxQtZC2cv96r4+YZDLUdBO3VhhTZrqZlhsZQqc= X-Gm-Message-State: AOJu0Yy8IeJXAKwgFcI6j/rNerUq1l+rW+2dNJiOGESok9hOoehAWLDo pOxuCowI45q9zNV7vZBhfzihHHTi3CcibvDfqILf/Nys1NkN1dX/rYnw1X2zknTqUwl/+j6/l55 /6cjkZm58LAkYStv7bDV/pzUchyY= X-Google-Smtp-Source: AGHT+IHVV+/P3FdLgHRN+PA5jA0FdCHz88S9BLXeFMBXLcJyCCwZCcVjA4rK5rWQARJf1YBUg6qAI8+atuOMy3WNLz4= X-Received: by 2002:a1f:f446:0:b0:4c8:ee1:5a0b with SMTP id s67-20020a1ff446000000b004c80ee15a0bmr9876864vkh.15.1710797863691; Mon, 18 Mar 2024 14:37:43 -0700 (PDT) MIME-Version: 1.0 References: <000000000000bbb3d80613f243a6@google.com> <20240318210917.GA4210@cmpxchg.org> <20240318213257.GB4210@cmpxchg.org> In-Reply-To: <20240318213257.GB4210@cmpxchg.org> From: Barry Song <21cnbao@gmail.com> Date: Tue, 19 Mar 2024 10:37:32 +1300 Message-ID: Subject: Re: [syzbot] [mm?] kernel BUG in sg_init_one To: Johannes Weiner Cc: Yosry Ahmed , Nhat Pham , syzbot , akpm@linux-foundation.org, chengming.zhou@linux.dev, linux-kernel@vger.kernel.org, linux-mm@kvack.org, syzkaller-bugs@googlegroups.com, Barry Song Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: A83E118001B X-Stat-Signature: 1crnddpe8tq5nitqbq7py8ncw96un1ge X-Rspam-User: X-HE-Tag: 1710797864-348892 X-HE-Meta: U2FsdGVkX19L6rYwZhY+M4QvvQrekViYdV03hbztcVS0iRfnCXL6kSrtHuEHDLDmDx8xv6nur09Hqg7Ruz2P/MRpDdu60b1E49qXGZ/COC5UYyThM2/01PRpJ4WRTGEoSxT/mtPJfiJqUOkv05mSi4urrQtyRJtP8JkwpK6lrQ6GIsWExSfjqP8XNvYow8FeC/cCN8Y3YOp3cXY5K5A6X0/NdxUV1GB1DAf4xJ2cPZy44wzNW4i7P1Nnum3aMXv9LekStSRx2lvAZ31C2Z+jnjvbgEhSPAiLOgZJQQPzaDixUwMVLAecdEYatqN1gN6MisdzS5xGYbCc7Tdqm7U10Q4jjuTu2cC26kVB4OqVSDE/cb5DbVkmBKsOwQbyMatv+0xE22lCoTvLsJBlh9XG0WWQUaa2hfsNmTSAKThQ3rVe2pQMc6cnSYH6xwGAbHKg/tH10KpXmQ3sE2Wp4+gr5+vtdFZlhi0kUjrdaYxdtkn4MmbB9QYSyOxGdUI7VkPRdigGZjdHR4hrq/a4kyy+2Lr09KUsyFzjIqU0UNFOQ4AHl54SPVtMzfjFMAAOz3XHqJ3ylCHk19V4r6rB1EEQ11QPXJRYEVlY9cQeaNgOB71+FazGKlV4OfCsvjp4WPyp1DME/Y58FSZN1wf9HkBkUh4QbrBZRdsbjK3Ybho6qykQ3tEPzmpLNnagzlIct7dSZA7YFdGZQa88/DS5U+ye4WBrljbZK2PDadUDJf24j61mNNuuIe3/5Cz5WaNIU1Oq7RBFM0LYP8tWuH6Y5zsmmM+93WGgXTu9pZU3E0CbcljGQIzLNdzub4QjoG2PTSuvOXHNzbpMaheg0vwR1MD34utsZRggczo0xVNnuDVqvAvtXIO+y+NL1BOzckMq4aIWz16hHa2bZPh1HrWQAqlKR45tQoTsAV9nQA61v2NWWXUcU8tErJjK02BYEZ8D3yyKIeFJ3eBkzWlv5xlx+Jo jKQSoz/P DIWZVawOBLGBa/LQVkaDxCVwOVb7HMIEwgDmvM3KfziI9xu7/ua7ZIU4QrYU/QDS/wRcZP90aqtcm/h2BRH+naWovHEJs2vAQr9X46cJFG+5b9W58A3tRK0ajRZ4wW3oJWPGdCxUW6SEjFL6owx4yhhj/hpUKEMNWjx8mXJC7iXG3p90R80kGYHYPpM4/Q51kwuHLA/YTomuk/FDIsCqeHrV/ZW0GObiYP2/m8IKRraxjHRGg1M32YHpPYtE4rTHrmUdNHwOUBFF96pucLcqf+8+VWSgDmzAd1j3sLTreLJRwwFj4YEGxe4OWOQepQvCNKwj5sBbEXNZEp/uQRRUh+OoDGg== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Tue, Mar 19, 2024 at 10:33=E2=80=AFAM Johannes Weiner wrote: > > On Tue, Mar 19, 2024 at 10:15:43AM +1300, Barry Song wrote: > > On Tue, Mar 19, 2024 at 10:10=E2=80=AFAM Johannes Weiner wrote: > > > > > > On Mon, Mar 18, 2024 at 01:17:19PM -0700, Yosry Ahmed wrote: > > > > On Mon, Mar 18, 2024 at 11:00=E2=80=AFAM Nhat Pham wrote: > > > > > > > > > > On Mon, Mar 18, 2024 at 9:58=E2=80=AFAM syzbot > > > > > wrote: > > > > > > > > > > > > Hello, > > > > > > > > > > > > syzbot found the following issue on: > > > > > > > > > > > > HEAD commit: e5eb28f6d1af Merge tag 'mm-nonmm-stable-2024-03= -14-09-36' .. > > > > > > git tree: upstream > > > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=3D130= 43abe180000 > > > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=3D19b= b57c23dffc38e > > > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=3Dadbc9= 83a1588b7805de3 > > > > > > compiler: arm-linux-gnueabi-gcc (Debian 12.2.0-14) 12.2.0= , GNU ld (GNU Binutils for Debian) 2.40 > > > > > > userspace arch: arm > > > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=3D1= 706d231180000 > > > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=3D13b= a7959180000 > > > > > > > > > > > > Downloadable assets: > > > > > > disk image (non-bootable): https://storage.googleapis.com/syzbo= t-assets/8ead8862021c/non_bootable_disk-e5eb28f6.raw.xz > > > > > > vmlinux: https://storage.googleapis.com/syzbot-assets/0a7371c63= ff2/vmlinux-e5eb28f6.xz > > > > > > kernel image: https://storage.googleapis.com/syzbot-assets/7539= 441b4add/zImage-e5eb28f6.xz > > > > > > > > > > > > IMPORTANT: if you fix the issue, please add the following tag t= o the commit: > > > > > > Reported-by: syzbot+adbc983a1588b7805de3@syzkaller.appspotmail.= com > > > > > > > > > > > > ------------[ cut here ]------------ > > > > > > kernel BUG at include/linux/scatterlist.h:187! > > > > > > > > > > Looks like the provided buffer is invalid: > > > > > > > > > > #ifdef CONFIG_DEBUG_SG > > > > > BUG_ON(!virt_addr_valid(buf)); > > > > > #endif > > > > > > > > > > which is "src" from: > > > > > > > > > > sg_init_one(&input, src, entry->length); > > > > > > > > > > Looking at the surrounding code and recent history, there's this > > > > > commit that stands out: > > > > > > > > > > mm/zswap: remove the memcpy if acomp is not sleepable > > > > > (sha: 270700dd06ca41a4779c19eb46608f076bb7d40e) > > > > > > > > > > which has the effect of, IIUC, using the zpool mapped memory dire= ctly > > > > > as src, instead of acomp_ctx->buffer (which was previously the ca= se, > > > > > as zsmalloc was not sleepable). > > > > > > > > > > This might not necessarily be a bug with that commit itself, but = might > > > > > have revealed another bug elsewhere. > > > > > > > > > > Anyway, cc-ing the author, Barry Song, to fact check me :) Will t= ake a > > > > > closer look later. > > > > > > > > I am not a highmem expert, but the reproducer has CONFIG_HIGHMEM=3D= y, > > > > and it seems like zs_map_object() may return a highmem address if t= he > > > > compressed object is entirely in a single page to avoid copying to = a > > > > buffer: > > > > > > > > if (off + class->size <=3D PAGE_SIZE) { > > > > /* this object is contained entirely within a page */ > > > > area->vm_addr =3D kmap_atomic(page); > > > > ret =3D area->vm_addr + off; > > > > goto out; > > > > } > > > > > > > > The virt_addr_valid() check seems to indicate that we expect a dire= ct > > > > map address in sg_init_one(), right? > > > > > > If the page is highmem, kmap_atomic() establishes a temporary mapping > > > to it in the direct map, such that we have a legit kernel pointer to > > > the memory. Otherwise the memcpy() in zswap also wouldn't work... Am = I > > > missing something? > > > > Right, we built a map but it is not a linear mapping. so we can't use > > virt_to_page > > on this kind of non-linear mapping. > > kmap_to_page can handle both linear and non-linear, but Ira's commit > > added a WARN_ON_ONCE in it for non-linear mapping case. > > Ah, I misread what virt_addr_valid() does. It actually excludes > kmap. Which, yes, makes sense, if the next line does virt_to_page()... > > Sorry about the noise. no worries. I just wonder why Ira's commit ef6e06b2ef870 has added a WARN_ON_ONCE in kmap_to_page() given we still have many users :-) drivers/fpga/fpga-mgr.c: pages[index] =3D kmap_to_page((void *)p); drivers/spi/spi.c: vm_page =3D kmap_to_page(bu= f); drivers/vfio/pci/pds/lm.c: pages[i] =3D kmap_to_page((void *)p); fs/erofs/data.c: .page =3D kmap_to_page(ptr), fs/smb/server/transport_rdma.c: page =3D kmap_to_page(buf); net/9p/trans_virtio.c: (*pages)[index] =3D kmap_to_page(p);