Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
From:   Liam Howlett <liam.howlett@oracle.com>
To:     Qian Cai <quic_qiancai@quicinc.com>
CC:     "maple-tree@lists.infradead.org" <maple-tree@lists.infradead.org>,
        "linux-mm@kvack.org" <linux-mm@kvack.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        Yu Zhao <yuzhao@google.com>
Subject: Re: [PATCH v8 00/70] Introducing the Maple Tree
Thread-Topic: [PATCH v8 00/70] Introducing the Maple Tree
Thread-Index: AQHYWX8vSnmCSFccn0+psIQVsVvpYa0D76aAgAALhwA=
Date:   Wed, 27 Apr 2022 16:51:50 +0000
Message-ID: <20220427165139.5s3qcj2u5vqrvwlc@revolver>
References: <20220426150616.3937571-1-Liam.Howlett@oracle.com>
 <20220427161033.GA1935@qian>
In-Reply-To: <20220427161033.GA1935@qian>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?LK0v7OCCJvv3qhD1pW0XNpUHCOgGGsC2TFxHuozoKFnnggEygTzHm123Fsu+?=
 =?us-ascii?Q?0qOFxgN2Gr1KQrvZvA1vgi9mfCUBBkNhmPBDB6peSMLLHPo0ql/7vi0/eqMx?=
 =?us-ascii?Q?HSoriqrkBS/MNoKjo0VJ/VVy0rz0RQ1bv6rFOdi02reyvMk3wScKHR//DEIP?=
 =?us-ascii?Q?YFb9IvfwGfMGuLPKdZvKQnzbNVU324Vwk55Gg1alfdfwhv6R/NbYmIhcShOo?=
 =?us-ascii?Q?eqfnSMmsB2S9MoSoNlXBd140KkS0MjJKwTgZv5a4IsIFoOseQK5XP895R28q?=
 =?us-ascii?Q?etHYis6JSs5u4/jsx94NBjSR3DL4cp+dTflKNQ1YzWlT0YyjeXqofGBn2L3m?=
 =?us-ascii?Q?OUKrycw2tElsHxsyzhj6jCju085ocjiZQ2hMLnO/ZQOKi9s7Bq5sgZM/5Z4S?=
 =?us-ascii?Q?qJq9yJig6MNjUgtR8QvFgNVPag3Ns+82f3fUHVJ/BpVIH1lV45yGa80zjg0a?=
 =?us-ascii?Q?XeXgUcFQ6IYpYvWnfa3u/iNxWk8sIaWCQ7rTIoV5TGfiXHezLh/LN/AX7Rfp?=
 =?us-ascii?Q?OaZ69pmRqiHAHXbNK0Du/VYeLI0VzqqUNTWEujbDvVxsWEB++79d0vZ32NDH?=
 =?us-ascii?Q?jln41jEnWswhBAstwI9ay243AiZ2P7FNq0NvQvin+kLD5K8gATbO1ZSPsFMy?=
 =?us-ascii?Q?Yovk9XRy7jHzt80YAceikJjeRgUnLrDqVKZcjiRMIVWZpseL9KLfiTzPWBw+?=
 =?us-ascii?Q?JpU7ok4s0OH9iU8fLbMVztgqqF08lQpljnctJfCjJNFuvWa/1ZGyEy7HEOXg?=
 =?us-ascii?Q?DCZNNdmyh5+BNyiCuqm+ZBH3A+qHS7kyizJkcC847ZrA56BdCGzmV4leaOxd?=
 =?us-ascii?Q?OrfCvMrzTO6WZUAx9SSLa19DRzan9dzpDOoq7t8S/YH97WXP4UWt6CnVOqBd?=
 =?us-ascii?Q?AZdNGhgSpNUwQyGWdsqGQEBcTLWh+ymaC6EdHEj06S1GJr2lKEK+EgEd6QU4?=
 =?us-ascii?Q?iwq3oo4Jlk0aLK/GAbH0VwTWml8AL4x9k5Psv83ZQBGmjTEUh4yddFfATynY?=
 =?us-ascii?Q?C8SvaKLN31QHr3MsWmn8wlvf+FaUUxIIbNBtjuw4FWq9dYyf8FrgoqbtUhIn?=
 =?us-ascii?Q?KH87MnC1rI0H6yd44F7Hh6yO0ID8salqSxjEuolvQzoETLsAku+Qbla/NS1G?=
 =?us-ascii?Q?zkWNNNrnX/4Tacs4HrPTkuElOq0bBRGk54ajvEHxSnAnpj1vF3FO65WL5TXM?=
 =?us-ascii?Q?11Exd8zRGuso5/3BW686tjzph2feVqs5JsDiDTPPVl3ixam3ZzMtkul0HKkP?=
 =?us-ascii?Q?fbEfwlc8EI5CL4Yx21e1gaET9OsULBwEH6lL8OSLI+V31SlHAZHrm7dBVfs1?=
 =?us-ascii?Q?XAmVb+i1l+hg226bXYeHpfYwRPy0kuwcY5n1gts+CFPOmj9RW8P3laQZUy0a?=
 =?us-ascii?Q?UmGyZT2mIIljcPBX8hlRcBcYmE2mGHo1ZQsJnwzfDRJWMA20WwWzCAYPaCvL?=
 =?us-ascii?Q?QD48fYLwAV4SflNLS4DR/IYwakPb6u3FyJ7aiO4WVV3UP+r6GNbJulCld8Q/?=
 =?us-ascii?Q?HBYCWlLAsRopLA1B0isV20ZDqzGfKIVno4AySFVmYkS3VZCTNISi7E7nj4jA?=
 =?us-ascii?Q?qNXpy0aJLcV8HT8AfxXLXSKIJTxkgQaB+26WUQmUcK1tvaeoaXx+PBpzqWLK?=
 =?us-ascii?Q?yYcJ8cFqPR3luJgk+7eIVBIGlIKf2NPOQdFrEb6oOGruM51+rkpSJPYZBslU?=
 =?us-ascii?Q?Br73+8xyCQCcFrmAYED80uUGgpBklnvqBNZ0uCRbPEqewyJtIPOOobhZF9lz?=
 =?us-ascii?Q?S7jcs4CcBWdXj1Ov+mj+8+4t9JLUGtI=3D?=
Content-Type: multipart/mixed;
        boundary="_002_202204271651395s3qcj2u5vqrvwlcrevolver_"
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 0817ec48-ec4a-48cc-a82b-08da286e39d8
X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Apr 2022 16:51:50.8047
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: M2YmkjreA7kPl3lehF37SDcBjAW6yB6Ig6fkIat1k3mVzdpZyvh1V/7GLKWMrY/aD/3H3/Q0pR8vH3GSe/zu1g==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLAPR10MB5300
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.486,18.0.858
 definitions=2022-04-27_04:2022-04-27,2022-04-27 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 mlxlogscore=999 mlxscore=0
 suspectscore=0 malwarescore=0 spamscore=0 adultscore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000
 definitions=main-2204270105
X-Proofpoint-GUID: XXogk7oGvrnPGTo_MhlMPx3faE_rYjaD
X-Proofpoint-ORIG-GUID: XXogk7oGvrnPGTo_MhlMPx3faE_rYjaD
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE autolearn=no
	autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
	lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

--_002_202204271651395s3qcj2u5vqrvwlcrevolver_
Content-Type: text/plain; charset="us-ascii"
Content-ID: <44BBF39BB18BEE4081EB32E9D90044B8@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable

* Qian Cai <quic_qiancai@quicinc.com> [220427 12:10]:
> On Tue, Apr 26, 2022 at 03:06:19PM +0000, Liam Howlett wrote:
> > Andrew,
> >=20
> > Please replace the patches in your mglru-maple branch with this set.  I=
t should
> > be a drop in replacement for my patch range with the fixes into these
> > patches.  Adding the preallocation to work around the fs-reclaim LOCKDE=
P
> > issue caused enough changes to the patches to warrant a respin.
> >=20
> > The last patch on the branch is still needed to fix vmscan after mglru
> > is applied.  ee4b1fc24f30 "mm/vmscan: Use VMA_ITERATOR in
> > get_next_vma()"
> >=20
> >=20
> > Here is the pretty cover letter you requested last time.
> >=20
> > ------------------------------------
> >=20
> > The maple tree is an RCU-safe range based B-tree designed to use modern
> > processor cache efficiently.  There are a number of places in the kerne=
l
> > that a non-overlapping range-based tree would be beneficial, especially
> > one with a simple interface.  The first user that is covered in this
> > patch set is the vm_area_struct, where three data structures are
> > replaced by the maple tree: the augmented rbtree, the vma cache, and th=
e
> > linked list of VMAs in the mm_struct.  The long term goal is to reduce
> > or remove the mmap_sem contention.
> >=20
> > The tree has a branching factor of 10 for non-leaf nodes and 16 for lea=
f
> > nodes.  With the increased branching factor, it is significantly shorte=
r than
> > the rbtree so it has fewer cache misses.  The removal of the linked lis=
t
> > between subsequent entries also reduces the cache misses and the need t=
o pull
> > in the previous and next VMA during many tree alterations.
> >=20
> > This patch set is based on v5.18-rc2
> >=20
> > git: https://github.com/oracle/linux-uek/tree/howlett/maple/20220426
> >=20
> > v8 changes:
> >  - Added preallocations before any potential edits to the tree when hol=
ding the
> > i_mmap_lock to avoid fs-reclaim issues on extreme memory pressure.
> >  - Fixed issue in mempolicy mas_for_each() loop.
> >  - Moved static definitions inside ifdef for DEBUG_MAPLE
> >  - Fixed compile warnings reported by build bots
> >  - Moved mas_dfs_preorder() to testing code
> >  - Changed __vma_adjust() to record the highest vma in case 6 instead o=
f
> > finding it twice.
> >  - Fixed locking issue in exit_mmap()
> >  - Fixed up from/s-o-b ordering
>=20
> Running some syscall fuzzer would trigger a crash.
>=20
>  BUG: KASAN: use-after-free in mas_find
>  ma_dead_node at lib/maple_tree.c:532
>  (inlined by) mas_next_entry at lib/maple_tree.c:4637
>  (inlined by) mas_find at lib/maple_tree.c:5869
>  Read of size 8 at addr ffff88811c5e9c00 by task trinity-c0/1351
>=20
>  CPU: 5 PID: 1351 Comm: trinity-c0 Not tainted 5.18.0-rc4-next-20220427 #=
3
>  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-5.fc3=
5 04/01/2014
>  Call Trace:
>   <TASK>
>   dump_stack_lvl
>   print_address_description.constprop.0.cold
>   print_report.cold
>   kasan_report
>   mas_find
>   apply_mlockall_flags


Thanks.  This is indeed an issue with 0d43186b36c1 (mm/mlock: use vma
iterator and instead of vma linked list)                                   =
             =20

Andrew, Please include this patch as a fix.

Thanks,
Liam

--_002_202204271651395s3qcj2u5vqrvwlcrevolver_
Content-Type: text/x-diff;
	name="0001-mm-mlock-Use-maple-state-in-apply_mlockall_flags.patch"
Content-Description: 
 0001-mm-mlock-Use-maple-state-in-apply_mlockall_flags.patch
Content-Disposition: attachment;
	filename="0001-mm-mlock-Use-maple-state-in-apply_mlockall_flags.patch";
	size=1576; creation-date="Wed, 27 Apr 2022 16:51:50 GMT";
	modification-date="Wed, 27 Apr 2022 16:51:50 GMT"
Content-ID: <2EF9DC2C01AD494CB855382BA09F5E2C@namprd10.prod.outlook.com>
Content-Transfer-Encoding: base64

RnJvbSA2MmM1MGI5NjgzZDEwY2NhYTBiNjg5NDU5ZWZhYTQxNzk0ZGIxMjliIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQ0KRnJvbTogIkxpYW0gUi4gSG93bGV0dCIgPExpYW0uSG93bGV0dEBvcmFj
bGUuY29tPg0KRGF0ZTogV2VkLCAyNyBBcHIgMjAyMiAxMjo0NjowNCAtMDQwMA0KU3ViamVjdDog
W1BBVENIXSBtbS9tbG9jazogIFVzZSBtYXBsZSBzdGF0ZSBpbiBhcHBseV9tbG9ja2FsbF9mbGFn
cygpDQoNClRoZSB2bWEgaXRlcmF0b3IgaXMgZm9yIHNpbXBsZSBjYXNlcy4gIFNpbmNlIG1sb2Nr
X2ZpeHVwKCkgY2FuIGNhdXNlIHRoZQ0KdHJlZSB0byBjaGFuZ2UgYW5kIHRodXMgcmVxdWlyZXMg
dGhlIG1hcGxlIHN0YXRlIHRvIGJlIHJlc2V0LA0KYXBwbHlfbWxvY2thbGxfZmxhZ3MoKSBpcyBu
b3QgYSBzaW1wbGUgY2FzZS4gIFVzZSBhIG1hcGxlIHN0YXRlIGFuZA0KY2FsbCBtYXNfcGF1c2Uo
KSBpbnN0ZWFkLg0KDQpGaXhlczogMGQ0MzE4NmIzNmMxIChtbS9tbG9jazogdXNlIHZtYSBpdGVy
YXRvciBhbmQgaW5zdGVhZCBvZiB2bWENCmxpbmtlZCBsaXN0KQ0KU2lnbmVkLW9mZi1ieTogTGlh
bSBSLiBIb3dsZXR0IDxMaWFtLkhvd2xldHRAb3JhY2xlLmNvbT4NCi0tLQ0KIG1tL21sb2NrLmMg
fCA1ICsrKy0tDQogMSBmaWxlIGNoYW5nZWQsIDMgaW5zZXJ0aW9ucygrKSwgMiBkZWxldGlvbnMo
LSkNCg0KZGlmZiAtLWdpdCBhL21tL21sb2NrLmMgYi9tbS9tbG9jay5jDQppbmRleCBkODU0OWIz
ZGNiNTkuLmM0MTYwNGJhNTE5NyAxMDA2NDQNCi0tLSBhL21tL21sb2NrLmMNCisrKyBiL21tL21s
b2NrLmMNCkBAIC02NjAsNyArNjYwLDcgQEAgU1lTQ0FMTF9ERUZJTkUyKG11bmxvY2ssIHVuc2ln
bmVkIGxvbmcsIHN0YXJ0LCBzaXplX3QsIGxlbikNCiAgKi8NCiBzdGF0aWMgaW50IGFwcGx5X21s
b2NrYWxsX2ZsYWdzKGludCBmbGFncykNCiB7DQotCVZNQV9JVEVSQVRPUih2bWksIGN1cnJlbnQt
Pm1tLCAwKTsNCisJTUFfU1RBVEUobWFzLCAmY3VycmVudC0+bW0tPm1tX210LCAwLCAwKTsNCiAJ
c3RydWN0IHZtX2FyZWFfc3RydWN0ICp2bWEsICpwcmV2ID0gTlVMTDsNCiAJdm1fZmxhZ3NfdCB0
b19hZGQgPSAwOw0KIA0KQEAgLTY4MSw3ICs2ODEsNyBAQCBzdGF0aWMgaW50IGFwcGx5X21sb2Nr
YWxsX2ZsYWdzKGludCBmbGFncykNCiAJCQl0b19hZGQgfD0gVk1fTE9DS09ORkFVTFQ7DQogCX0N
CiANCi0JZm9yX2VhY2hfdm1hKHZtaSwgdm1hKSB7DQorCW1hc19mb3JfZWFjaCgmbWFzLCB2bWEs
IFVMT05HX01BWCkgew0KIAkJdm1fZmxhZ3NfdCBuZXdmbGFnczsNCiANCiAJCW5ld2ZsYWdzID0g
dm1hLT52bV9mbGFncyAmIFZNX0xPQ0tFRF9DTEVBUl9NQVNLOw0KQEAgLTY4OSw2ICs2ODksNyBA
QCBzdGF0aWMgaW50IGFwcGx5X21sb2NrYWxsX2ZsYWdzKGludCBmbGFncykNCiANCiAJCS8qIEln
bm9yZSBlcnJvcnMgKi8NCiAJCW1sb2NrX2ZpeHVwKHZtYSwgJnByZXYsIHZtYS0+dm1fc3RhcnQs
IHZtYS0+dm1fZW5kLCBuZXdmbGFncyk7DQorCQltYXNfcGF1c2UoJm1hcyk7DQogCQljb25kX3Jl
c2NoZWQoKTsNCiAJfQ0KIG91dDoNCi0tIA0KMi4zNS4xDQoNCg==

--_002_202204271651395s3qcj2u5vqrvwlcrevolver_--