Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <2076817.1675434996@warthog.procyon.org.uk>
References: <2076817.1675434996@warthog.procyon.org.uk> <72029a93-1150-1994-916f-b15ef0befd49@nvidia.com> <e8065d6a-d2f9-60aa-8541-8dfc8e9b608f@redhat.com> <000000000000b0b3c005f3a09383@google.com> <822863.1675327935@warthog.procyon.org.uk> <1265629.1675350909@warthog.procyon.org.uk>
To:     John Hubbard <jhubbard@nvidia.com>
Cc:     dhowells@redhat.com, David Hildenbrand <david@redhat.com>,
        syzbot <syzbot+a440341a59e3b7142895@syzkaller.appspotmail.com>,
        hch@lst.de, linux-kernel@vger.kernel.org,
        syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] general protection fault in skb_dequeue (3)
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2112098.1675441439.1@warthog.procyon.org.uk>
Date:   Fri, 03 Feb 2023 16:23:59 +0000
Message-ID: <2112099.1675441439@warthog.procyon.org.uk>
Precedence: bulk

David Howells <dhowells@redhat.com> wrote:

> I think I have managed to isolate the bug to the read side of sendfile() or
> the pipe in the middle by the following:

I did something similar in iov_iter_extract_pipe_pages(), allocating a
permanent page there:

+	mutex_lock(&extract_tmp_lock);
+	if (!extract_tmp) {
+		pr_notice("alloc extract_tmp\n");
+		extract_tmp = alloc_page(GFP_USER);
+		if (extract_tmp) {
+			SetPageDebugMark(extract_tmp);
+			page_ref_add(extract_tmp, 200);
+		}
+	}
+	mutex_unlock(&extract_tmp_lock);
+	if (!extract_tmp)
+		return -ENOMEM;

and then subbing that for the returned page:

 		chunk = min_t(size_t, left, PAGE_SIZE - offset);
 		left -= chunk;
-		*p++ = page;
+		//*p++ = page;
+		*p++ = extract_tmp;

That makes the oopses stop happening.  Pages are still being added to the pipe
at one end and being removed at the other.

So I'm guessing a DMA happens to the destination buffer for the DIO read after
it has been released.

David