Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
Date:   Mon, 6 Jun 2022 08:26:10 -0400
From:   Qian Cai <quic_qiancai@quicinc.com>
To:     Liam Howlett <liam.howlett@oracle.com>
CC:     "maple-tree@lists.infradead.org" <maple-tree@lists.infradead.org>,
        "linux-mm@kvack.org" <linux-mm@kvack.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Andrew Morton <akpm@linux-foundation.org>
Subject: Re: [PATCH v9 08/69] mm: start tracking VMAs with maple tree
Message-ID: <Yp3yYmNJ5dd8g8Ur@qian>
References: <20220504010716.661115-1-Liam.Howlett@oracle.com>
 <20220504010716.661115-10-Liam.Howlett@oracle.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20220504010716.661115-10-Liam.Howlett@oracle.com>
Precedence: bulk

On Wed, May 04, 2022 at 01:07:52AM +0000, Liam Howlett wrote:
> From: "Liam R. Howlett" <Liam.Howlett@Oracle.com>
> 
> Start tracking the VMAs with the new maple tree structure in parallel with
> the rb_tree.  Add debug and trace events for maple tree operations and
> duplicate the rb_tree that is created on forks into the maple tree.
> 
> The maple tree is added to the mm_struct including the mm_init struct,
> added support in required mm/mmap functions, added tracking in kernel/fork
> for process forking, and used to find the unmapped_area and checked
> against what the rbtree finds.
> 
> This also moves the mmap_lock() in exit_mmap() since the oom reaper call
> does walk the VMAs.  Otherwise lockdep will be unhappy if oom happens.
> 
> Signed-off-by: Liam R. Howlett <Liam.Howlett@Oracle.com>
> Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
...
> @@ -842,6 +969,12 @@ int __vma_adjust(struct vm_area_struct *vma, unsigned long start,
>  again:
>  	vma_adjust_trans_huge(orig_vma, start, end, adjust_next);
>  
> +	if (mas_preallocate(&mas, vma, GFP_KERNEL)) {
> +		if (exporter && exporter->anon_vma)
> +			unlink_anon_vmas(importer);
> +		return -ENOMEM;
> +	}
> +
>  	if (file) {
>  		mapping = file->f_mapping;
>  		root = &mapping->i_mmap;

Running a syscall fuzzer for a while could still trigger some memory leak reports.

unreferenced object 0xffff4021439c6100 (size 256):
  comm "trinity-c32", pid 1329067, jiffies 4301918356 (age 231692.944s)
  hex dump (first 32 bytes):
    00 61 9c 43 21 40 ff ff 1c b1 65 1d 02 40 ff ff  .a.C!@....e..@..
    ff 2f 42 97 ff ff 00 00 ff 2f 43 97 ff ff 00 00  ./B....../C.....
  backtrace:
    [<ffffd4be60434e28>] slab_post_alloc_hook+0x98/0xf0
    [<ffffd4be6043a2e0>] kmem_cache_alloc_bulk+0x26c/0x4ac
    [<ffffd4be60d549c8>] mas_alloc_nodes+0x1e8/0x500
    [<ffffd4be60d7cc68>] mas_preallocate+0xc8/0x210
    [<ffffd4be603607a0>] __vma_adjust+0x27c/0x1290
    __vma_adjust at mm/mmap.c:762
    [<ffffd4be60361b0c>] vma_merge+0x358/0x650
    [<ffffd4be60370e20>] mprotect_fixup+0x160/0x530
    [<ffffd4be60371544>] do_mprotect_pkey.constprop.0+0x354/0x710
    [<ffffd4be60371978>] __arm64_sys_mprotect+0x78/0x130
    [<ffffd4be5fc43a24>] invoke_syscall+0x74/0x260
    [<ffffd4be5fc43db8>] el0_svc_common.constprop.0+0x1a8/0x260
    [<ffffd4be5fc43f1c>] do_el0_svc+0xac/0xe0
    [<ffffd4be62d68144>] el0_svc+0x84/0x1c0
    [<ffffd4be62d687dc>] el0t_64_sync_handler+0xbc/0x140
    [<ffffd4be5fc12548>] el0t_64_sync+0x18c/0x190