Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Liam Howlett <liam.howlett@oracle.com>
To:     Andrew Morton <akpm@linux-foundation.org>,
        syzbot <syzbot+7728e4ab5371cebc9c00@syzkaller.appspotmail.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-mm@kvack.org" <linux-mm@kvack.org>,
        "syzkaller-bugs@googlegroups.com" <syzkaller-bugs@googlegroups.com>,
        Peter Xu <peterx@redhat.com>,
        Qian Cai <quic_qiancai@quicinc.com>
Subject: Re: [syzbot] WARNING in vma_merge
Thread-Topic: [syzbot] WARNING in vma_merge
Thread-Index: AQHYWjRmy9YwbzHJ/0e8lY/ldotJ+K0DvUcAgABEggCAAAjgAIAAFLIA
Date:   Wed, 27 Apr 2022 19:06:30 +0000
Message-ID: <20220427190622.wgoxjjbmphdo3xxw@revolver>
References: <000000000000a23c8505dda227eb@google.com>
 <000000000000f28f0005dda29992@google.com>
 <20220427102032.5a87283eb64d06c1a6d682fd@linux-foundation.org>
 <20220427175218.cazytgdlpc6lpn45@revolver>
In-Reply-To: <20220427175218.cazytgdlpc6lpn45@revolver>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?87sjV7XuYIhMUX4Ar42XmpZgAWS9NB5k0l097pzSYsAGaNDTmmdajFDXASIG?=
 =?us-ascii?Q?kn9dOHB0Ts+Q5GA/raORNo9WINn4928ko88Am/vUiuD+b1WJFW8RLO2dSm1i?=
 =?us-ascii?Q?LHuZCjUlq/Xto0/WW28ECzsFOejIoOM8CTy1V3SrFwvPdLzJA8JQz2f0CAAT?=
 =?us-ascii?Q?Rj8ffxidGDJKmhGB9KgetB3s6vOpBgmOU0FMTvGmMqvkOjGScSQy4qAJ2kRf?=
 =?us-ascii?Q?AcYFbtPltSDnXLxSq7hGNT8XVyvSU9YXOz/c+bwIZPIWnZsn3ZkBY8A0VrFm?=
 =?us-ascii?Q?17UsrGC6E+NBDcyvuFpbnv4MZsjnHk2/TRDnz6mOyi9RzvsTFvG0DhnUiy7Z?=
 =?us-ascii?Q?DUPpqkqTOXEB1nPSrx0y09ZqiUM6zVqP0c5BFFJ8s43AET1UbtCt/HRJHCRp?=
 =?us-ascii?Q?KdMakxLXY9PZGkzox3NVuezO5xQGQSueMTBgaKrmhSRs0K/vUZD5YC3qI+jl?=
 =?us-ascii?Q?D5QoPDKAX89qXF4cW1nRzxT0qmEmTPMLYpIzM0dHuHxngOWQwDcqY4+u7EaV?=
 =?us-ascii?Q?nnrX8dLXqZIzuQeJGHfPqN2+5HYso3rnGCBao1CtaR3JNpDGouizNtIspJ2Q?=
 =?us-ascii?Q?TYadwx4SbWR7I1b3TFBjMO6l9kU11Ce4yr3zNCLsb6WKIued+f38P4JhZTuU?=
 =?us-ascii?Q?JTZvFnLd0MtPqFNfsLiMI34w/MtGNtoMHE82FKq+x6ZNu/4pJ5GLuZr7Cj4O?=
 =?us-ascii?Q?8yldQeixRZk1BoiGv6e7OIecyMdG+bG15W7ONd/YmnRoC1cpn0NCOIeYaVb/?=
 =?us-ascii?Q?zl2yWv8Ug8hfbqeaqGCG5KpMRI27ejXKmIKGqaeah5bk8kSlJkU4rQ4HxGQf?=
 =?us-ascii?Q?QetgABjeOQg19wswpxuoNgCrA9gUi+a8gKgSh+4ACniKQSOyNIhWWghcegAA?=
 =?us-ascii?Q?JvmV034oBVNkb5veGrj654yp2S8XDETNQI1Zq3lyfZ9LqConKmxuoLE64DD1?=
 =?us-ascii?Q?KDxGV9a39i4OELXbKn9iFIh0xP1V6KcuKaDV27lfFCyjUR5m8bW+9oDQt7fb?=
 =?us-ascii?Q?My3o2QTOQs1iX4xfnVZJ+B+G/Tks/+rsNVpi2Xd5CTQMQpMiiweZ/UJjgocy?=
 =?us-ascii?Q?lPKbL6LjSzMoqg3uHQ2kPttfWpjzY5ZVLEvQbpnKxAel/eHJDiiQgZmg3wO/?=
 =?us-ascii?Q?OS6WmUWV/mEj/C42FlKv8+KSTHXUgIao2tIPzjklMBX+IM8c2O6MMSGnqTUJ?=
 =?us-ascii?Q?0u8IgtQ05HHKk14UQxun6yLfbdNIBanu3dytggH21bU939WDC7UCjSfR9ooC?=
 =?us-ascii?Q?JsTJeEIcWRuW7utIPECqRMO3Khd/r1BhOc3L7P2Jz9DAWnQNuXinePzxKw/o?=
 =?us-ascii?Q?CzKiKQH5d529IS7LjnIoJ2t+fV+DYf7y9QXBueD0T8BajRi65nDxqWY3M/Mv?=
 =?us-ascii?Q?0RJ6kxyHjcGNCjRxuUZL2Ys1dhssdc4Qt/x+V/v5SpRXpfSOHOfzLOZQ6vRT?=
 =?us-ascii?Q?YrKAANL/RBmSX8B2sRXdgBawcCx4h9MvTDWUUE0+8BLvfsmF4PlpKiZ88+JB?=
 =?us-ascii?Q?gqvF8tMUo2gMcJpBuGye2b3a4Kd4pY4dewMMz9JZM5BUxv4TPG7veEjexBpD?=
 =?us-ascii?Q?GuG5pPRgRdx6oDIw/DWodVRvObkaaZ9QmRVfAezwnYQKxChfBMzd05Qj36+g?=
 =?us-ascii?Q?cAy/wVQUKtwng+2PHjgiWeul7gITIf89kyQTQSCvieBLP5567WmhXml09REF?=
 =?us-ascii?Q?aIWahcanlLTfSmlFrI4MRexzBPQ3LLw3fOYyqS9YUfCpETKHhg4TO3QacHsP?=
 =?us-ascii?Q?ySXVrdC0a6UPkha+AzeKaoGapJXOXIM=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <656234611C030C4F847A4F0C11434E13@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: de56beaa-583b-46a2-9bca-08da2881099a
X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Apr 2022 19:06:30.3209
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: vWJ1AEXF+WbU+PX5vAaF+hPfHq6OcKG4+OwdWtfZhIFYXWBLWM/kbSYi47537RZsPLdTJI07VHBP0xgUMQ25Tw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4527
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.486,18.0.858
 definitions=2022-04-27_04:2022-04-27,2022-04-27 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 spamscore=0 adultscore=0
 mlxscore=0 bulkscore=0 suspectscore=0 malwarescore=0 mlxlogscore=999
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000
 definitions=main-2204270119
X-Proofpoint-ORIG-GUID: 2rDahGICLYyB3ODGhqTSkg4KkgCLcMv3
X-Proofpoint-GUID: 2rDahGICLYyB3ODGhqTSkg4KkgCLcMv3
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE,
        SPF_NONE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

* Liam R. Howlett <Liam.Howlett@Oracle.com> [220427 13:52]:
> * Andrew Morton <akpm@linux-foundation.org> [220427 13:20]:
> > On Wed, 27 Apr 2022 06:15:20 -0700 syzbot <syzbot+7728e4ab5371cebc9c00@=
syzkaller.appspotmail.com> wrote:
> >=20
> > > syzbot has found a reproducer for the following issue on:
> >=20
> > Thanks.
> >=20
> > userfaultfd_release() appears to have offended vma_merge().
>=20
> Potentially apply_mlockall_flags() and not userfaultfd_release(). There
> is a potential that the vma iterator is stale if a split/merge succeeds,
> although KASAN should pick this up and KASAN is active according to the
> config below. I've sent a patch for the mlockall issue after Qian Cai's
> reported it to linux-mm.
>=20
> >=20
> > I'm not seeing any changes in that area from Peter, but Liam's
> > mapletree work changed things around a bit.  Gents, could you please
> > take a look?
> >=20
> >=20
> > > HEAD commit:    f02ac5c95dfd Add linux-next specific files for 202204=
27
> > > git tree:       linux-next
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=3D105a33a2f=
00000
> > > kernel config:  https://syzkaller.appspot.com/x/.config?x=3De9256c70f=
586da8a
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=3D7728e4ab537=
1cebc9c00
> > > compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Bi=
nutils for Debian) 2.35.2
> > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=3D15f76f8=
2f00000
> > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=3D12b42c3cf=
00000
> > >=20
> > > IMPORTANT: if you fix the issue, please add the following tag to the =
commit:
> > > Reported-by: syzbot+7728e4ab5371cebc9c00@syzkaller.appspotmail.com
> > >=20

...

>=20
> I cannot get this issue to trigger with the given tree and git repo with
> my config.  I will try again with the kernel config above.


I was able to reproduce the issue using the config from syzkaller in my
VM and can confirm it was the apply_mlockall_flags() bug also reported
by Qian Cai [1].  The patch I sent earlier [2] fixes this issue as well.


1. https://lore.kernel.org/linux-mm/20220427161033.GA1935@qian/
2. https://lore.kernel.org/linux-mm/20220427165139.5s3qcj2u5vqrvwlc@revolve=
r/

Thanks,
Liam=