Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 27 Jul 2023 21:08:47 +0100
From:   Matthew Wilcox <willy@infradead.org>
To:     Jann Horn <jannh@google.com>
Cc:     Suren Baghdasaryan <surenb@google.com>,
        "Liam R. Howlett" <Liam.Howlett@oracle.com>,
        akpm@linux-foundation.org, linux-kernel@vger.kernel.org,
        linux-mm@kvack.org, syzkaller-bugs@googlegroups.com,
        syzbot <syzbot+8645fe63c4d22c8d27b8@syzkaller.appspotmail.com>
Subject: Re: [syzbot] [mm?] WARNING: suspicious RCU usage in mas_walk (2)
Message-ID: <ZMLOz7rkW6hY5aW/@casper.infradead.org>
References: <000000000000607ff905ffc8e477@google.com>
 <0000000000000aeb7f06015e5cbd@google.com>
 <20230727164757.e2di75xjybxncohn@revolver>
 <CAJuCfpEyE18kbH84FfmfzUnar2dxgzpi=FOYPbU8MOpz-SbVjg@mail.gmail.com>
 <CAG48ez1yg7m=aNsjNiGt_s0_tEBEmEXXx0-vijuN9MBmoxL7PQ@mail.gmail.com>
 <ZMK0ony0LG2SL2Ha@casper.infradead.org>
 <CAG48ez0Qgtamxj7BieL5U+pWyQ3S+s3hVJfdJEevqk-hPAN3sA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAG48ez0Qgtamxj7BieL5U+pWyQ3S+s3hVJfdJEevqk-hPAN3sA@mail.gmail.com>
Precedence: bulk

On Thu, Jul 27, 2023 at 09:20:33PM +0200, Jann Horn wrote:
> One kinda straightforward option would be to pass the vmf (or NULL if
> it's not in fault context) to anon_vma_prepare(), teach it to bail if
> it runs under the mm lock, and propagate a VM_FAULT_RETRY all the way
> up? It can already fail due to OOM, so the bailout paths exist, though
> you'd have to work a bit to plumb the right error code up.
> 
> And if you're feeling adventurous, you could try to build a way to
> opportunistically upgrade from vma lock to mmap lock, to avoid having
> to bail out all the way back up and then dive back in when that
> happens. Something that does mmap_read_trylock(); on failure, bail out
> with VM_FAULT_RETRY; on success, drop the VMA lock and change
> vmf->flags to note the changed locking context.

I think that's all a little more adventurous than I'd be comfortable
with right now ;-)  I just sent the fix patch that syzbot tested to
Andrew for integration.