Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.35 as permitted sender) client-ip=23.128.96.35;
Date:   Tue, 24 Oct 2023 11:18:27 -0400
From:   "Liam R. Howlett" <Liam.Howlett@Oracle.com>
To:     Hugh Dickins <hughd@google.com>
Cc:     Andrew Morton <akpm@linux-foundation.org>,
        Andi Kleen <ak@linux.intel.com>,
        Christoph Lameter <cl@linux.com>,
        Matthew Wilcox <willy@infradead.org>,
        Mike Kravetz <mike.kravetz@oracle.com>,
        David Hildenbrand <david@redhat.com>,
        Suren Baghdasaryan <surenb@google.com>,
        Yang Shi <shy828301@gmail.com>,
        Sidhartha Kumar <sidhartha.kumar@oracle.com>,
        Vishal Moola <vishal.moola@gmail.com>,
        Kefeng Wang <wangkefeng.wang@huawei.com>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Tejun Heo <tj@kernel.org>,
        Mel Gorman <mgorman@techsingularity.net>,
        Michal Hocko <mhocko@suse.com>,
        "Huang, Ying" <ying.huang@intel.com>, linux-kernel@vger.kernel.org,
        linux-mm@kvack.org
Subject: Re: [PATCH] mempolicy: migration attempt to match interleave nodes:
 fix
Message-ID: <20231024151827.i7e2f6cheet4k5h5@revolver>
Mail-Followup-To: "Liam R. Howlett" <Liam.Howlett@Oracle.com>,
        Hugh Dickins <hughd@google.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        Andi Kleen <ak@linux.intel.com>, Christoph Lameter <cl@linux.com>,
        Matthew Wilcox <willy@infradead.org>,
        Mike Kravetz <mike.kravetz@oracle.com>,
        David Hildenbrand <david@redhat.com>,
        Suren Baghdasaryan <surenb@google.com>,
        Yang Shi <shy828301@gmail.com>,
        Sidhartha Kumar <sidhartha.kumar@oracle.com>,
        Vishal Moola <vishal.moola@gmail.com>,
        Kefeng Wang <wangkefeng.wang@huawei.com>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Tejun Heo <tj@kernel.org>, Mel Gorman <mgorman@techsingularity.net>,
        Michal Hocko <mhocko@suse.com>,
        "Huang, Ying" <ying.huang@intel.com>, linux-kernel@vger.kernel.org,
        linux-mm@kvack.org
References: <ebc0987e-beff-8bfb-9283-234c2cbd17c5@google.com>
 <77954a5-9c9b-1c11-7d5c-3262c01b895f@google.com>
 <3311d544-fb05-a7f1-1b74-16aa0f6cd4fe@google.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <3311d544-fb05-a7f1-1b74-16aa0f6cd4fe@google.com>
User-Agent: NeoMutt/20220429
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?GA5yJquQN223G2Ioj7LvYe//RbJmiq5DmH3Z3xe05nGhfst2HF9j+Yl7U3LJ?=
 =?us-ascii?Q?I7i//i2uZH676ELgBGWtIykd3zQk3eljhfmjRxHUWpMZcv3eLzDcbC7Vyi50?=
 =?us-ascii?Q?d1QMLu40cVK9VFPhaL8mF9FCmKfzfMGDaGb047Zf+6Z2FWGHjUmjR94jcFSi?=
 =?us-ascii?Q?AyEdo99AdAPsIEcsVj/AnGpuZn27k5pqufu1r+u+8Nn9QfRvQT1Sh9H9icrr?=
 =?us-ascii?Q?D9iev3QKqZ2sLwucmsMN8UfCy8eDB8dXXdTO8PUneyNWnmj21Ub/Zh8Cwd7D?=
 =?us-ascii?Q?oEOPci+DmVSY4PSQUsa6M6Tbbld/iOiA2UKd2ZEErPVOJCxgoEPjWwetauvU?=
 =?us-ascii?Q?Au8VBiObFK1Vlq0ZZik5eyqjw3t0pkvKidEuKSgfzt3ARRm8Ly1VddpTMhcu?=
 =?us-ascii?Q?s5glFDvtEsF55iKfrUn/Vv7hOrTRoItG/Sur2FolBTCz1K2a6zhFD858zZmK?=
 =?us-ascii?Q?HvfFBIjMx7JDaQiouDZ8aQ2QEbNyHBFDja8W6UPuxFwq7P4onnspjOoHa2bl?=
 =?us-ascii?Q?jZvOsYogXf6o4gvoMfCsTzioZ1pZ1Z53+R8jOUVNc2S/I+7bLnLaE6FnFmUU?=
 =?us-ascii?Q?cWC2dTJ5aShV8VnCoVgv/3/2DYXgrBHw3/M+Xx2moJGCuRsyddQZWVRIALqv?=
 =?us-ascii?Q?Gdu0p/NUoWF8rVroiDycQrkK5okM/FFvmVKjA7MV8M5akYvmHjquxLnE7MQq?=
 =?us-ascii?Q?r/oRoLHikKLqDmqXXhrNFcG6nWFdK/CSI5PO4VHFXDVY+b/gLAB/wNKVMTHP?=
 =?us-ascii?Q?33ECY2Jd3ko8PsINqiXwpTBbIuas4J7vv8gAljeczKdyplXpmYLq5a5BfcSe?=
 =?us-ascii?Q?XgBUIW93emNYeeJlkHtjtvFrTMQOLKokwf83jsK7JlxI5aWSLiFG/JczJesC?=
 =?us-ascii?Q?ENn3WCIbEJCkAp0b/t1ww7MR1oGC5HXEnJp8dCHztIIP3rchhQjgCL0aANwI?=
 =?us-ascii?Q?AV2PzIrUvHh/LirKDi/c6rJ87vX2WIbc7N//Lg+H23KdrnmDRuX2D2yQkGZy?=
 =?us-ascii?Q?M/pi8Nbk3ljdIbovSyUJ4356EvXFZfLgXZ4QfA9fye679Pjme8EBIpS/av0D?=
 =?us-ascii?Q?/gnxUpQtOJv+0pYzFAZ16mLqiW7Iu/bZGWhjp34kTSZQvMPsNf8EzDh/k76+?=
 =?us-ascii?Q?Zf853ad+meZlujTS92l8CAlh2C/F9B9GaMhx1H5S50E2UyNP5xqeqarAc6j9?=
 =?us-ascii?Q?HERr8tFZaesdf/gWG7OJ7CepjWZzTmI8e5GV/DH4y632Jul90rUPV8YOgiBm?=
 =?us-ascii?Q?gfp+ZgfY/9CX/ZAYiIFXIAgkN5MEcRLzgUSH0RSskoKgJqFUnNoNbYxZ+5fp?=
 =?us-ascii?Q?RS9qenAXp9IeTOtwkzKgjLjY4QBlE8Pkh0vkmpGf1/lkkvy4T6rg6WS8eyu6?=
 =?us-ascii?Q?BYMD6bOleTZuUfS9Y+9cAJimhqjOvI2JoLuwgviXgkVKytJUo9DV/Yq8hOEw?=
 =?us-ascii?Q?svOQSa4/81+oL5vxUjghKIrqfB3cypFeZnpqhAGWPdWNq77P5+hxkHHv4lPZ?=
 =?us-ascii?Q?Plu7koYTOzNIPyWF0fW5IyccQOPxF9JDnxtxYU4KNmCXGITaNguGi72iVwle?=
 =?us-ascii?Q?2QmV7UtHgZjtgMcHWIklXPJQ5M1d2+BMg+udg6ii?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?+YMUNyXS0bEWg7NJoeVPHi2n3ayccCnv12OeBzFbKCTQrBZRUkWOvNjA0+/+?=
 =?us-ascii?Q?mn/y2K07fIvIqH8V+zBQcUtN35snKqR7tdbHis9NtdEqJD+wz6pyRAj1+FvV?=
 =?us-ascii?Q?WhfWoPux37vSZlXPd+OO0vI6e3HuBLlfg4THL/VtMkVAUCcIg/Tha4CST80X?=
 =?us-ascii?Q?SX3tc6OWcLtUaVOKevS1uPvc5gLUZE7avdqVmnjzlMcYd15XZWEPcUUzwxQ7?=
 =?us-ascii?Q?3H2yoezoAkc4TA3qdV9soV/jvhPc5bqG3MHM8j2sSlhri3emaHJHMdJZoJDe?=
 =?us-ascii?Q?TPOnN1+oy3WLlZ9IZaut80gAXT8ebqdjI5tPZVmCA8Gv2sX+rotJ2uRY15wK?=
 =?us-ascii?Q?/XH7fjbbsiQSO+lesFABsQV+EC+1LopnVFqZODgN1li5V5LB4SurLQuIcD/J?=
 =?us-ascii?Q?VBReWUgNGEXGSxiotTpezuscishwsK8uta4PWsr6LUtlA4dYCgTNjvYUqsvH?=
 =?us-ascii?Q?OVxfskJ92f7zxSm9MD3gADmXUs9PbTEOOQ/vdIhNxpv65GSg6GtpFmdjTfBU?=
 =?us-ascii?Q?3dzG6Q19lydfqt1+7u6TK4T4noKe+vDQjgE7VjtMbD2kt8TCHb4PLNeiz9X/?=
 =?us-ascii?Q?UOzL9KvmZrFK2m1lHledPC7Yn+7rpkH2/1U5AjBtYvgty7Pl5QvojEwyAKpr?=
 =?us-ascii?Q?J+BYoVDzTkhfA8PLBj9HKz/FG6uwqDtaY/kfxLfLRA5bBAMimCkkicsS/p+j?=
 =?us-ascii?Q?HmEKTtwLkY32ct6zKbKPfPlmTvpsllmhyAfbXIB0oB+30Tkl8aYDjYWqQDwu?=
 =?us-ascii?Q?jCzmfYfhzdfLeFUIybFF7bv2KmuZ+YnVLPvcw066cJEwe1qkse0TknsYbyI+?=
 =?us-ascii?Q?HDHn5YaYyWML+rYHCWUR2XWbz+cXKBPlBfuIWOnZU13X/4WXhkFWeC3i3MzM?=
 =?us-ascii?Q?GBCiJrhNCUbQjuZ8gajNoFhwmUlckITnNOwAmDk996nqOSy4a1iSo/0kruzm?=
 =?us-ascii?Q?fk3iJ5SpGnrci4nJAWJ25jQqLDL0sChQZ8sKdxT2CcFFN5ULT87Y06iIrv2t?=
 =?us-ascii?Q?PJEV+1Bd2Zmw+PP+774TTsDePpDWySoKIzJm8ld4KrssWy+7LC83kycZ9A2O?=
 =?us-ascii?Q?zTC4XRmft9p2z4NF4mOBvr3MWV3ckIjmco3lT+SAMgvklj1mXaXSUpPi3uq0?=
 =?us-ascii?Q?apSjlHy0PQSuJsbs1bHWT2OPHuXJOfrhdp2e72I+Lusw4OlF3lavpelNVr5Q?=
 =?us-ascii?Q?r7eCEqjWZ9o8bF8Sd0g/lLj74zpPPTExEferjsABFFVLZSLyGhSgpoEeIYyL?=
 =?us-ascii?Q?EPHh7+BcKbek4+pdpLiy?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: cc442e51-7b7c-40ac-0dc3-08dbd4a47b41
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Oct 2023 15:18:31.2235
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: tLDEdGw7aK6lCjGJM2AHB9MzJ9MGW5CRlIdkyscwZnr5q4NEJ99DB8lOE0SZqpGf9V3LIGpvQzLjbFbgB+iWJg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA2PR10MB4780
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.980,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2023-10-24_15,2023-10-24_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 mlxlogscore=797
 adultscore=0 bulkscore=0 suspectscore=0 mlxscore=0 phishscore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2310170001 definitions=main-2310240131
X-Proofpoint-ORIG-GUID: wBEOtOnm0RJe2YQz8VMF34e-dWIxiNWy
X-Proofpoint-GUID: wBEOtOnm0RJe2YQz8VMF34e-dWIxiNWy
X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no
	version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on groat.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (groat.vger.email [0.0.0.0]); Tue, 24 Oct 2023 08:23:28 -0700 (PDT)

* Hugh Dickins <hughd@google.com> [231024 02:50]:
> mm-unstable commit edd33b8807a1 ("mempolicy: migration attempt to match
> interleave nodes") added a second vma_iter search to do_mbind(), to
> determine the interleave index to be used in the MPOL_INTERLEAVE case.
> 
> But sadly it added it just after the mmap_write_unlock(), leaving this
> new VMA search unprotected: and so syzbot reports suspicious RCU usage
> from lib/maple_tree.c:856.
> 
> This could be fixed with an rcu_read_lock/unlock() pair (per Liam);
> but since we have been relying on the mmap_lock up to this point, it's
> slightly better to extend it over the new search too, for a well-defined
> result consistent with the policy this mbind() is establishing (rather
> than whatever might follow once the mmap_lock is dropped).

Would downgrading the lock work?  It would avoid the potential writing
issue and should still satisfy lockdep.

> 
> Reported-by: syzbot+79fcba037b6df73756d3@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/linux-mm/000000000000c05f1b0608657fde@google.com/
> Fixes: edd33b8807a1 ("mempolicy: migration attempt to match interleave nodes")
> Signed-off-by: Hugh Dickins <hughd@google.com>
> ---
>  mm/mempolicy.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> index 989293180eb6..5e472e6e0507 100644
> --- a/mm/mempolicy.c
> +++ b/mm/mempolicy.c
> @@ -1291,8 +1291,6 @@ static long do_mbind(unsigned long start, unsigned long len,
>  		}
>  	}
>  
> -	mmap_write_unlock(mm);
> -
>  	if (!err && !list_empty(&pagelist)) {
>  		/* Convert MPOL_DEFAULT's NULL to task or default policy */
>  		if (!new) {
> @@ -1334,7 +1332,11 @@ static long do_mbind(unsigned long start, unsigned long len,
>  				mmpol.ilx -= page->index >> order;
>  			}
>  		}
> +	}
>  
> +	mmap_write_unlock(mm);
> +
> +	if (!err && !list_empty(&pagelist)) {
>  		nr_failed |= migrate_pages(&pagelist,
>  				alloc_migration_target_by_mpol, NULL,
>  				(unsigned long)&mmpol, MIGRATE_SYNC,
> -- 
> 2.35.3
>