Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Liam Howlett <liam.howlett@oracle.com>
To:     Andrew Morton <akpm@linux-foundation.org>
CC:     syzbot <syzbot+a7b60a176ec13cafb793@syzkaller.appspotmail.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-mm@kvack.org" <linux-mm@kvack.org>,
        "syzkaller-bugs@googlegroups.com" <syzkaller-bugs@googlegroups.com>,
        Ondrej Mosnacek <omosnace@redhat.com>,
        Minchan Kim <minchan@kernel.org>,
        "Christian Brauner (Microsoft)" <brauner@kernel.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Hridya Valsaraju <hridya@google.com>,
        Joel Fernandes <joel@joelfernandes.org>,
        Martijn Coenen <maco@android.com>,
        Suren Baghdasaryan <surenb@google.com>,
        Todd Kjos <tkjos@android.com>,
        "Matthew Wilcox (Oracle)" <willy@infradead.org>,
        =?iso-8859-1?Q?Arve_Hj=F8nnev=E5g?= <arve@android.com>,
        Carlos Llamas <cmllamas@google.com>
Subject: Re: [syzbot] WARNING in find_vma
Thread-Topic: [syzbot] WARNING in find_vma
Thread-Index: AQHYqvlZndy4dcl9OUWMjKq+hi9Ih62lZXyAgAAyHoCAASkXgA==
Date:   Tue, 9 Aug 2022 16:16:10 +0000
Message-ID: <20220809161603.65enspb45xcmblc2@revolver>
References: <00000000000085cb1705e5b5d9f6@google.com>
 <0000000000007cda2705e5bfe389@google.com>
 <20220808153243.6a80c73ce4f14c50efef086f@linux-foundation.org>
In-Reply-To: <20220808153243.6a80c73ce4f14c50efef086f@linux-foundation.org>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?jksAgKdjNGh9/Ib+ubu2gxa79NaJ3jbk9wQA7Sbxs6EKmKjWugZYSvI3Hd?=
 =?iso-8859-1?Q?1uV3wQslDeIq50/CnFneqdXD8pXwYnsIdJWudtZoraKXBkTvgpfiRDowBn?=
 =?iso-8859-1?Q?HTf2J2JYQ3EqZ+XAdcjBeKiDqlIRbYFPls1NXcbCVITRkU0UekgGAp/5+u?=
 =?iso-8859-1?Q?IVv7ETuri6/n+W2awhBCGNTOG7rDYmj0Swxt9SC9aUmEO/LOMJqnclbMuJ?=
 =?iso-8859-1?Q?W8krkg0d9iwIe1XK6drrZoAhZAu3XYF8xLqjmhieShDkXAkHCkPDUxuO8M?=
 =?iso-8859-1?Q?DGXcupt3nf+8sFCq5b848r+LYbekcZcJsaAjgAObfrwNvq24HNsO9fAc2S?=
 =?iso-8859-1?Q?ZpIuWM0Oq4H6dtDoh/8xs4CAzkp1m0ME2f7cSrwrwYGj0fPSPLt5WsvV6C?=
 =?iso-8859-1?Q?CC7EYNQXBr5L/5j6nb/iZVDigoi4lTXNsnIam+r28FbWe2bniYHYICHIWM?=
 =?iso-8859-1?Q?031S/7SBWvQMjjYzVLjPlMOJiWtr7AVj9e7/LeIiuj2aAR4SuyAEEi4Mnb?=
 =?iso-8859-1?Q?AAqAnZLTPcpXFEO7so3Cho1hDZf2jtSzrsH6YneM+0zxQkOnlpiUC676Gg?=
 =?iso-8859-1?Q?fZj6NAJUoRYM4yFC+sQW+DQWmlRDOwMd36y6A6zKWoguQs+uCOYUKwsgL4?=
 =?iso-8859-1?Q?KHcpjizHViyAsDZbXdyf/vzFQjbyVqPuXdMtbtfVlnt1ftAyMj2v9chtRb?=
 =?iso-8859-1?Q?DegvjvLlllvQlRFG1XDG1HCq8z/tfd+zCrzuymG12sxIzUK9hQPS7Gu0lD?=
 =?iso-8859-1?Q?ZmP2y53yTCiaAJMYRzCdA5df7DwVFbw0PXHzIUohtiIYceH9W1lp5G/ZVU?=
 =?iso-8859-1?Q?i2mqev6I8bUQUIImP14JmzjqaXotXZB+r64U10KHv2N7MxuA1IPmd2Ruyt?=
 =?iso-8859-1?Q?UrKgt6XhkAiXWz/6USJl5Y3fyCuHRf2plEMoYhiCc0YzS4blyzLlyHaWH4?=
 =?iso-8859-1?Q?wZuGWpdlQr+T8LX4upsktskI0lMjPnjuyDMQ8Sla/PeI2n/YnEcjWTur1K?=
 =?iso-8859-1?Q?kygliD5SHqxC9EfPq60q6Q8zJMMh4tVrT7g4boVdBgtGpn2hu1N330bI/Y?=
 =?iso-8859-1?Q?+euWBvs6rWDjXQFJ4ojd2tm3JMlQPWfHKfrKnbX1vYKyhERX1MGQshFTWD?=
 =?iso-8859-1?Q?f4KOwQnhVFAWsVVzlZatcfYolSALmBQF86XHkGdmld9lXWIKoLMUxAZ6GA?=
 =?iso-8859-1?Q?ex6jc6h5uvHI4XB+Ua+Db/ogV46oEgpXlJ70bJ4aJ9vVWLMWdpeoRgSUHa?=
 =?iso-8859-1?Q?cv/pD0gz1gGxQEET510aA+86ESVSzrlQHUeDgAjcNgfkrdBKM7DW3AnLsC?=
 =?iso-8859-1?Q?5Q4zIYxVGLrx8NmYE9KWVj0i/wuvX5sjtNMFqtXgEfWjmumPXt4b+Bz32+?=
 =?iso-8859-1?Q?sGRR3jks5FCwOc8g94VxThx0HIKHBRVQXcc64OmKiEe0I9sAHmpAN3zUfK?=
 =?iso-8859-1?Q?3hzqwY2WKncIdu1uvkiytrPxuvU7aQ/kTMCEUn/F+RNRI1nXB4W7m7iJRo?=
 =?iso-8859-1?Q?5j6MTfIt9NQMBKGtfq7msqo6/uCKUrGanEUKNM2lNNHR2zMwOqGqVrWkVf?=
 =?iso-8859-1?Q?cW4/yHCXsB27Kiqdc3c17Yf9xqcOHeMedWX8ABWX3eUuCyPhkPXtjzRL+Q?=
 =?iso-8859-1?Q?p8779eWs+NNHUBA+J2ki6k+hUHr3Guc42xKVnjPg5Tce9aVXktGGrgMA?=
 =?iso-8859-1?Q?=3D=3D?=
Content-Type: text/plain; charset="iso-8859-1"
Content-ID: <1C8A9B4A0CC92E43A0C1ECB4E2A1276F@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c65b0964-2f0f-4f61-475b-08da7a2278eb
X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Aug 2022 16:16:10.1883
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: Gz+UYPpuKYW7ePrvS886+HtVdnflZF+Nfc9iSWCfTpeSz/ZhQUtxK7In5/cSIqIckeO53NQDzmejX5Ij1wSNrQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR1001MB2175
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.883,Hydra:6.0.517,FMLib:17.11.122.1
 definitions=2022-08-09_05,2022-08-09_02,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 bulkscore=0 mlxlogscore=999
 spamscore=0 suspectscore=0 adultscore=0 phishscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2206140000
 definitions=main-2208090067
X-Proofpoint-ORIG-GUID: CiMie8l2fz3yVFBTrlh0J2u1hsesESxv
X-Proofpoint-GUID: CiMie8l2fz3yVFBTrlh0J2u1hsesESxv
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

* Andrew Morton <akpm@linux-foundation.org> [220808 18:32]:
> (cc people from the thread "Binder regression caused by commit a43cfc87ca=
af")
>=20
> On Mon, 08 Aug 2022 12:33:21 -0700 syzbot <syzbot+a7b60a176ec13cafb793@sy=
zkaller.appspotmail.com> wrote:
>=20
> > syzbot has found a reproducer for the following issue on:
> >=20
> > HEAD commit:    ca688bff68bc Add linux-next specific files for 20220808
> > git tree:       linux-next
> > console output: https://syzkaller.appspot.com/x/log.txt?x=3D14807dfa080=
000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=3D4c20e006003=
cdecb
> > dashboard link: https://syzkaller.appspot.com/bug?extid=3Da7b60a176ec13=
cafb793
> > compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binu=
tils for Debian) 2.35.2
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=3D129992320=
80000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=3D15452c12080=
000
> >=20
> > IMPORTANT: if you fix the issue, please add the following tag to the co=
mmit:
> > Reported-by: syzbot+a7b60a176ec13cafb793@syzkaller.appspotmail.com
> >=20
> > binder: 7796:7797 ioctl c0306201 20001480 returned -14
> > ------------[ cut here ]------------
> > WARNING: CPU: 1 PID: 7797 at include/linux/mmap_lock.h:155 mmap_assert_=
locked include/linux/mmap_lock.h:155 [inline]
> > WARNING: CPU: 1 PID: 7797 at include/linux/mmap_lock.h:155 find_vma+0xf=
8/0x270 mm/mmap.c:2255
> > Modules linked in:
> > CPU: 1 PID: 7797 Comm: syz-executor269 Not tainted 5.19.0-next-20220808=
-syzkaller #0
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS=
 Google 07/22/2022
> > RIP: 0010:mmap_assert_locked include/linux/mmap_lock.h:155 [inline]
> > RIP: 0010:find_vma+0xf8/0x270 mm/mmap.c:2255
> > Code: 49 8d bc 24 28 01 00 00 be ff ff ff ff e8 40 2e c8 07 31 ff 89 c3=
 89 c6 e8 85 e2 c4 ff 85 db 0f 85 61 ff ff ff e8 b8 e5 c4 ff <0f> 0b e9 55 =
ff ff ff e8 ac e5 c4 ff 4c 89 e7 e8 54 38 fb ff 0f 0b
> > RSP: 0018:ffffc9000cee7530 EFLAGS: 00010293
> > RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> > RDX: ffff88807c278000 RSI: ffffffff81b72058 RDI: 0000000000000005
> > RBP: 0000000020ffc000 R08: 0000000000000005 R09: 0000000000000000
> > R10: 0000000000000000 R11: 0000000000000000 R12: ffff88807dda3100
> > R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
> > FS:  00007f5fdf1fb700(0000) GS:ffff8880b9a00000(0000) knlGS:00000000000=
00000
> > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 0000000000000000 CR3: 000000007d391000 CR4: 00000000003506f0
> > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > Call Trace:
> >  <TASK>
> >  vma_lookup include/linux/mm.h:2743 [inline]
> >  binder_alloc_get_vma drivers/android/binder_alloc.c:340 [inline]
> >  binder_alloc_new_buf_locked drivers/android/binder_alloc.c:405 [inline=
]
> >  binder_alloc_new_buf+0xd6/0x18b0 drivers/android/binder_alloc.c:590
> >  binder_transaction+0x242e/0x9a80 drivers/android/binder.c:3187
> >  binder_thread_write+0x8a9/0x3220 drivers/android/binder.c:3963
> >  binder_ioctl_write_read drivers/android/binder.c:5024 [inline]
> >  binder_ioctl+0x3470/0x6d00 drivers/android/binder.c:5311
> >  vfs_ioctl fs/ioctl.c:51 [inline]
> >  __do_sys_ioctl fs/ioctl.c:870 [inline]
> >  __se_sys_ioctl fs/ioctl.c:856 [inline]
> >  __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856
> >  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> >  do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> >  entry_SYSCALL_64_after_hwframe+0x63/0xcd
...

There are actually two call paths that will cause this BUG_ON to
trigger.  The patch I've sent fixes both [1].  Besides the above
binder_alloc_new_buf_locked() call path, there is one that would be
triggered when reading the debugfs binder files.  I'm guessing there
aren't test that cover the debugfs files.

[1] https://lore.kernel.org/linux-mm/20220809160618.1052539-1-Liam.Howlett@=
oracle.com/

Thanks,
Liam