Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
From:   Jens Axboe <axboe@kernel.dk>
Mime-Version: 1.0 (1.0)
Subject: Re: [PATCH 0/2] mm: Two small fixes for recent syzbot reports
Date:   Mon, 13 Apr 2020 22:31:08 -0600
Message-Id: <1B14A912-22E9-434E-A7D4-079090C630B6@kernel.dk>
References: <20200414040717.22040-1-hdanton@sina.com>
Cc:     Qian Cai <cai@lca.pw>, LKML <linux-kernel@vger.kernel.org>,
        Linux-MM <linux-mm@kvack.org>
In-Reply-To: <20200414040717.22040-1-hdanton@sina.com>
To:     Hillf Danton <hdanton@sina.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


> On Apr 13, 2020, at 10:07 PM, Hillf Danton <hdanton@sina.com> wrote:
>=20
> =EF=BB=BF
>> On Mon, 13 Apr 2020 18:06:21 -0400 Qian Cai wrote:
>>=20
>> BTW, I=3DE2=3D80=3D99ll be adding fuzzers to my daily linux-next routines=
 =3D
>> where it triggers this
>> io_uring/scheduler bug almost immediately, so hopefully would buy syzbot =3D=

>> some
>> time to resume on linux-next.
>>=20
>> [67493.516737][T211750] BUG: unable to handle page fault for address: =3D=

>> ffffffffffffffe8
>> [67493.557315][T211750] #PF: supervisor read access in kernel mode
>> [67493.586726][T211750] #PF: error_code(0x0000) - not-present page
>> [67493.614434][T211750] PGD f96e17067 P4D f96e17067 PUD f96e19067 PMD 0=3D=
20=3D
>>=20
>> [67493.644846][T211750] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
>> [67493.674127][T211750] CPU: 55 PID: 211750 Comm: trinity-c127 Tainted: =3D=

>> G    B        L    5.7.0-rc1-next-20200413 #4
>> [67493.722516][T211750] Hardware name: HP ProLiant DL380 Gen9/ProLiant =3D=

>> DL380 Gen9, BIOS P89 04/12/2017
>> [67493.764925][T211750] RIP: 0010:__wake_up_common+0x98/0x290
>> __wake_up_common at kernel/sched/wait.c:87
>> [67493.790675][T211750] Code: 40 4d 8d 78 e8 49 8d 7f 18 49 39 fd 0f 84 =3D=

>> 80 00 00 00 e8 6b bd 2b 00 49 8b 5f 18 45 31 e4 48 83 eb 18 4c 89 ff e8 =3D=

>> 08 bc 2b 00 <45> 8b 37 41 f6 c6 04 75 71 49 8d 7f 10 e8 46 bd 2b 00 49 =3D=

>> 8b 47 10
>> [67493.881650][T211750] RSP: 0018:ffffc9000adbfaf0 EFLAGS: 00010046
>> [67493.909854][T211750] RAX: 0000000000000000 RBX: ffffffffffffffe8 RCX: =3D=

>> ffffffffaa9636b8
>> [67493.947131][T211750] RDX: 0000000000000003 RSI: dffffc0000000000 RDI: =3D=

>> ffffffffffffffe8
>> [67493.983829][T211750] RBP: ffffc9000adbfb40 R08: fffffbfff582c5fd R09: =3D=

>> fffffbfff582c5fd
>> [67494.020861][T211750] R10: ffffffffac162fe3 R11: fffffbfff582c5fc R12: =3D=

>> 0000000000000000
>> [67494.059249][T211750] R13: ffff888ef82b0960 R14: ffffc9000adbfb80 R15: =3D=

>> ffffffffffffffe8
>> [67494.099699][T211750] FS:  00007fdcba4c4740(0000) =3D
>> GS:ffff889033780000(0000) knlGS:0000000000000000
>> [67494.141858][T211750] CS:  0010 DS: 0000 ES: 0000 CR0: =3D
>> 0000000080050033
>> [67494.172660][T211750] CR2: ffffffffffffffe8 CR3: 0000000f776a0004 CR4: =3D=

>> 00000000001606e0
>> [67494.209760][T211750] Call Trace:
>> [67494.224720][T211750]  __wake_up_common_lock+0xea/0x150
>> (inlined by) __wake_up_common_lock at kernel/sched/wait.c:124
>> [67494.248753][T211750]  ? __wake_up_common+0x290/0x290
>> [67494.272014][T211750]  ? lockdep_hardirqs_on+0x16/0x2c0
>> [67494.296139][T211750]  __wake_up+0x13/0x20
>> [67494.314946][T211750]  io_cqring_ev_posted+0x75/0xe0
>> (inlined by) io_cqring_ev_posted at fs/io_uring.c:1160
>> [67494.337726][T211750]  io_ring_ctx_wait_and_kill+0x1c0/0x2f0
>> io_ring_ctx_wait_and_kill at fs/io_uring.c:7305
>> [67494.363840][T211750]  io_uring_create+0xa8d/0x13b0
>> [67494.386526][T211750]  ? io_req_defer_prep+0x990/0x990
>> [67494.410119][T211750]  ? __kasan_check_write+0x14/0x20
>> [67494.433646][T211750]  io_uring_setup+0xb8/0x130
>> [67494.454870][T211750]  ? io_uring_create+0x13b0/0x13b0
>> [67494.478342][T211750]  ? check_flags.part.28+0x220/0x220
>> [67494.502947][T211750]  ? lockdep_hardirqs_on+0x16/0x2c0
>> [67494.526965][T211750]  __x64_sys_io_uring_setup+0x31/0x40
>> [67494.551820][T211750]  do_syscall_64+0xcc/0xaf0
>> [67494.574829][T211750]  ? syscall_return_slowpath+0x580/0x580
>> [67494.604591][T211750]  ? lockdep_hardirqs_off+0x1f/0x140
>> [67494.628901][T211750]  ? entry_SYSCALL_64_after_hwframe+0x3e/0xb3
>> [67494.657616][T211750]  ? trace_hardirqs_off_caller+0x3a/0x150
>> [67494.683999][T211750]  ? trace_hardirqs_off_thunk+0x1a/0x1c
>> [67494.709982][T211750]  entry_SYSCALL_64_after_hwframe+0x49/0xb3
>=20
>=20
> See if it makes your fuzzers happy.

It will, and we should probably do that separately too. I already posted ano=
ther fix that avoids the posted call that triggers it.

=E2=80=94=20
Jens Axboe