Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 27 Jul 2023 12:47:57 -0400
From:   "Liam R. Howlett" <Liam.Howlett@Oracle.com>
To:     Suren Baghdasaryan <surenb@google.com>
Cc:     akpm@linux-foundation.org, linux-kernel@vger.kernel.org,
        linux-mm@kvack.org, syzkaller-bugs@googlegroups.com,
        willy@infradead.org,
        syzbot <syzbot+8645fe63c4d22c8d27b8@syzkaller.appspotmail.com>
Subject: Re: [syzbot] [mm?] WARNING: suspicious RCU usage in mas_walk (2)
Message-ID: <20230727164757.e2di75xjybxncohn@revolver>
Mail-Followup-To: "Liam R. Howlett" <Liam.Howlett@Oracle.com>,
        Suren Baghdasaryan <surenb@google.com>, akpm@linux-foundation.org,
        linux-kernel@vger.kernel.org, linux-mm@kvack.org,
        syzkaller-bugs@googlegroups.com, willy@infradead.org,
        syzbot <syzbot+8645fe63c4d22c8d27b8@syzkaller.appspotmail.com>
References: <000000000000607ff905ffc8e477@google.com>
 <0000000000000aeb7f06015e5cbd@google.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <0000000000000aeb7f06015e5cbd@google.com>
User-Agent: NeoMutt/20220429
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?cREp2gLTC4fYo70I3Zy4rcg6Qo+e28K/3qPJtoy+d4ocnMwioARcFT3IbBKj?=
 =?us-ascii?Q?oOPoWyHiOyXxKvhfUd2FTupqd7vwVGpO7rixTN/1pXOx7WzL+96hMZ8QLVSF?=
 =?us-ascii?Q?5623xWX0iHyS7+4UC8Md/eBK+hQnRBvC0EXDtMUaz3V2sb0Tq6CAgTmECc4/?=
 =?us-ascii?Q?zs6+d2PNg0jj0wPgQY4z/646wu+3gGAnpIKWSBn+y24vFCCLOYR5kONXa8V2?=
 =?us-ascii?Q?4XvawpkHpB9yZYKfWviM9SBOuS+3cYYZnjodzw12ZBcwfNzRp56wz4Xk0leF?=
 =?us-ascii?Q?+XwuVSJ6En+uwg7FfJTIHysO7vJWVc9cIekdCWlYi8U4Zp9ngh6YoeC8vm67?=
 =?us-ascii?Q?vvrBgizSrE63A3WXn+ou9KBJ9slxAddiPftzP3o+4ylfq2NVXr8xWxCqx2or?=
 =?us-ascii?Q?6ydv5oMyNaUwAteUBmpNXCx8S9VXTKGNb5z3jSMzqUjNpMjc8O87zNynFPlC?=
 =?us-ascii?Q?b9ca+DFRVcUdwEpIKhupRP146AFaIOvnPpqM3bxuN1MG/5rdtv1LLU6Svvyv?=
 =?us-ascii?Q?zYGMYvX05XRXwwz9OlrXNbXrIJXrEVYP9nmUaAOTMrQZVNY2iH/RKzjYhW57?=
 =?us-ascii?Q?GPG1Lxlplht4+8iXBZE+k9anYHvhHb1UNdQ5VIOH1v29ezTfxw5yMQWN8jnN?=
 =?us-ascii?Q?zW5R0vL8IrEu/1039I0GluuTJxf5eQwzaXzHVP/qJydgvtDawcNrQZfxaM6w?=
 =?us-ascii?Q?yiloPcv5/Pg0GkoK9TP5PXVrNcFQvcariMOjXcczJm+bjBZzGcAWrMorvdOx?=
 =?us-ascii?Q?U5lzlApQPcty/2eiKSxpCuxsPEfn+6mmWOr+o+aoWWUFoR8qk1KOXkA04mly?=
 =?us-ascii?Q?/4tGFKgnAj86Bsv6Ujdemm2DIvpSsLNr0BFJO8Wp4IeuebzusH8dGQFtpBqF?=
 =?us-ascii?Q?Ruyr81Liwk4F1KCJHwktvUSed6KBh4BOC+6mml3xQDfRQCKiszIUsuyrymQT?=
 =?us-ascii?Q?HP0olUJxIv7hRqpo7JASEFP7R5851yBBTBI+6nsVC15uA8hDlMG8GF6YV+6S?=
 =?us-ascii?Q?VYyvsV10BrFoTv15jRADFNqpHCegS7aMaKVIT5xhF9xc4K5YN6w082rsnK1a?=
 =?us-ascii?Q?uXF6DzgsXxstLS4kk2iBZEr2kou/iu559Ow8MQGFCSBWtqmrYImm2wb6CcAt?=
 =?us-ascii?Q?OrGLc0U8aX98SQXMM73E1Er4zx5wVY6unrOvhhgsXaAM26Uh31OUaS9gchld?=
 =?us-ascii?Q?Zop1fkIrcKKzpkl+D4E+nFL5gYwoUUho4J/lGnW98nPKJQ3ZYIrBXqC/+Fbc?=
 =?us-ascii?Q?mr0Xz8D2p0S8bHEIeMWm2Hj7KJNSwNAFM/Puvjc3zUJwgeohg3QNQmdEbmwY?=
 =?us-ascii?Q?qh/MKbI79WqyA9fB0lDG3+IAOERorgOlBxt6NKJx8BC/thytwYPCftEmch1d?=
 =?us-ascii?Q?O0WqEaoBKzvhXfsSQ+qPc9lwcrWwQ/STEPcDvihFQbdMHjtMd0wMyqz7q6JY?=
 =?us-ascii?Q?5jOQTwugE7KjUCm1VLKx2QEkWNLYFOjG/n3/Qcr9/tDFBPY/UnC3aHztuXVt?=
 =?us-ascii?Q?x9XDYxKeAjXJXC8O3syLEo/iehQIgP7tJcNxDczXnUHPWbNmmKYRgEzGFbQh?=
 =?us-ascii?Q?/0LTv5PsTMd33hA6Psj8a8Bo5vHs1fOFm43UxgWEiC8l1vhDcTWqMr4VOwWr?=
 =?us-ascii?Q?Ew=3D=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?3KUw6WGY5oqtnjq3pVVENn5Ct4B5PQguaiDYgYbwqvyxpteLf8Z0uPk/A6O+?=
 =?us-ascii?Q?R+BiEstuggG2iaRTLLHegigflOx6EBGM6vij5G2xZyYDYtn6bc/5EzxZYmwn?=
 =?us-ascii?Q?el5tPaD9RDtsbMMkftJ8uh0dsuMl4ihR9aePfNzG8fbCpY/wDgPTdWSdmYp1?=
 =?us-ascii?Q?75LDxfifV0FEjBnnhW7gfjQ6I3nSCsHSRe0Lz1SsNx50/lP+36QAvDf68tzr?=
 =?us-ascii?Q?VzFkaUZfQyYW/Y6ZSaNXsHa91bQ6hRPNw3QEnxMGx8WDfEzH61OLWGwFgX7M?=
 =?us-ascii?Q?rQff6t3vd2XbEUFURoObscZEbIErr+OQcISRVROeizshsswDsdh0I/pt2wtk?=
 =?us-ascii?Q?Qwo3MWEQ74YgMiLdt+9WHlBgZXkgVLjY1zk4TKkDnAz1GCSiCtdKfgRj2ZsU?=
 =?us-ascii?Q?Qji/cjL/KyPuOoI4js/UzCV7xZ8Ct2qI23MZLWoj6Gelo12E76v7R23ZIkPp?=
 =?us-ascii?Q?lloMG0fUkM5RUUzUlTFERAK4ZJJ+oCHud3ImheDjDYw4oA368s0X4JnglX6o?=
 =?us-ascii?Q?MmQ3cQvJXnIXvahlJ0pB1rVdnvuKI1zetfayPTIF/KV4a7ja2bLaDTn5Y3xA?=
 =?us-ascii?Q?ckUuue+MFFiHt5xiN3YCyJkiFZyruRKFgp3WzXeF/XvFk7HfTfxJh2erYWKY?=
 =?us-ascii?Q?JKrCSuUgrUKGst76M/PRya/YRR9mjFYNhvPuaRu5Uu8PvllGMRaE25pcDHCw?=
 =?us-ascii?Q?n5PzQkAqzTtSsESPzf39hCUSI6AKfla7l5ss9TVxcg3hQBEXU47bv5xlNzps?=
 =?us-ascii?Q?SXat7ziarAb5ZXMoSmqV/BuRBo+PVuFOArpYIpJTg28SUzsDUnnlFhbdTRs2?=
 =?us-ascii?Q?hrTHAw6EEXwZVv0YiXixemY5yOSoRSbUw0OoXTZw+zGj7yKRFlqBxdrJq0l7?=
 =?us-ascii?Q?f1KPu/HSonEgdH49PVmsd+a2DV9CKsqY+zj8eNQl1HSn5A3N5/fGT1Y3m8ye?=
 =?us-ascii?Q?kkwu5xwsYT1NG+6kVhldEq3YGeELXx/EMX0GiZ8ZKodCPBScsYXSNnDxtP4i?=
 =?us-ascii?Q?zFRnarXij4wyuY18ICKCexkUyg=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: fa4ec2f6-e191-497c-4e92-08db8ec13c7a
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jul 2023 16:47:59.9530
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: j+KzemCR5oB9WLB/3bNpn4zBAvH635KcxATrHkvYkaEZLlEgxsOBqZKyI7lRV836JkfQd9LIUU+TDGA8OvZDzQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB4954
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.957,Hydra:6.0.591,FMLib:17.11.176.26
 definitions=2023-07-27_07,2023-07-26_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 mlxlogscore=654
 adultscore=0 mlxscore=0 phishscore=0 suspectscore=0 bulkscore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2306200000 definitions=main-2307270152
X-Proofpoint-GUID: ESVPmMGIlFjmSHOS3i592f_C1IH1-T4R
X-Proofpoint-ORIG-GUID: ESVPmMGIlFjmSHOS3i592f_C1IH1-T4R
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

* syzbot <syzbot+8645fe63c4d22c8d27b8@syzkaller.appspotmail.com> [230726 02:57]:
> syzbot has bisected this issue to:
> 
> commit a52f58b34afe095ebc5823684eb264404dad6f7b
> Author: Matthew Wilcox (Oracle) <willy@infradead.org>
> Date:   Mon Jul 24 18:54:10 2023 +0000
> 
>     mm: handle faults that merely update the accessed bit under the VMA lock
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1783585ea80000
> start commit:   [unknown] 
> git tree:       linux-next
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=1443585ea80000
> console output: https://syzkaller.appspot.com/x/log.txt?x=1043585ea80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=f481ab36ce878b84
> dashboard link: https://syzkaller.appspot.com/bug?extid=8645fe63c4d22c8d27b8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1697cec9a80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1566986ea80000
> 
> Reported-by: syzbot+8645fe63c4d22c8d27b8@syzkaller.appspotmail.com
> Fixes: a52f58b34afe ("mm: handle faults that merely update the accessed bit under the VMA lock")
> 
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection

This is caused by walking the maple tree without holding the mmap or rcu
read lock when per-vma locking is used for the page fault.

We could wrap the find_mergeable_anon_vma() walk with an rcu read lock,
but I am unsure if that's the correct way to handle this as the anon_vma
lock is taken later in __anon_vma_prepare().  Note that the anon_vma
lock is per-anon_vma, so we cannot just relocate that lock.

I'm wondering if we need find_mergeable_anon_vma() to take a read lock
on the VMA which contains the anon_vma to ensure it doesn't go away?
Maybe a find_and_lock_mergeable_anon_vma() and return a locked anon_vma?
Basically lock_vma_under_rcu(), anon_vma_lock_write(), vma_end_read().

Thoughts?

Thanks,
Liam