Received-SPF: pass (google.com: domain of linux-kernel+bounces-37697-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Message-ID: <e8583a3ab0522b4e75ba0ada47b6f093b186fa81.camel@xry111.site>
Subject: Re: Strange EFAULT on mips64el returned by syscall when another
 thread is forking
From: Xi Ruoyao <xry111@xry111.site>
To: Andreas Schwab <schwab@suse.de>, Ben Hutchings <ben@decadent.org.uk>
Cc: linux-mips@vger.kernel.org, linux-kernel@vger.kernel.org, Jiaxun Yang
 <jiaxun.yang@flygoat.com>, Thomas Bogendoerfer <tsbogend@alpha.franken.de>,
  libc-alpha@sourceware.org, Linus Torvalds <torvalds@linux-foundation.org>
Date: Thu, 25 Jan 2024 05:32:59 +0800
In-Reply-To: <0be1203c9df55432548c92281c8392dfa2f7d6bf.camel@xry111.site>
References: <75e9fd7b08562ad9b456a5bdaacb7cc220311cc9.camel@xry111.site>
	 <mvmplxraqmd.fsf@suse.de>
	 <9481b6d9d015aea25d8f2563bf7bd6f6462f758f.camel@xry111.site>
	 <0be1203c9df55432548c92281c8392dfa2f7d6bf.camel@xry111.site>
Autocrypt: addr=xry111@xry111.site; prefer-encrypt=mutual;
 keydata=mDMEYnkdPhYJKwYBBAHaRw8BAQdAsY+HvJs3EVKpwIu2gN89cQT/pnrbQtlvd6Yfq7egugi0HlhpIFJ1b3lhbyA8eHJ5MTExQHhyeTExMS5zaXRlPoiTBBMWCgA7FiEEkdD1djAfkk197dzorKrSDhnnEOMFAmJ5HT4CGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQrKrSDhnnEOPHFgD8D9vUToTd1MF5bng9uPJq5y3DfpcxDp+LD3joA3U2TmwA/jZtN9xLH7CGDHeClKZK/ZYELotWfJsqRcthOIGjsdAPuDgEYnkdPhIKKwYBBAGXVQEFAQEHQG+HnNiPZseiBkzYBHwq/nN638o0NPwgYwH70wlKMZhRAwEIB4h4BBgWCgAgFiEEkdD1djAfkk197dzorKrSDhnnEOMFAmJ5HT4CGwwACgkQrKrSDhnnEOPjXgD/euD64cxwqDIqckUaisT3VCst11RcnO5iRHm6meNIwj0BALLmWplyi7beKrOlqKfuZtCLbiAPywGfCNg8LOTt4iMD
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.50.3 
Precedence: bulk
MIME-Version: 1.0

On Thu, 2024-01-25 at 00:13 +0800, Xi Ruoyao wrote:
> On Wed, 2024-01-24 at 20:49 +0800, Xi Ruoyao wrote:
> > On Wed, 2024-01-24 at 12:59 +0100, Andreas Schwab wrote:
> > > On Jan 24 2024, Xi Ruoyao wrote:
> > >=20
> > > > Now I'm suspecting this might be a kernel bug.=C2=A0 Any pointer to=
 further
> > > > triage?
> > >=20
> > > Is this a regression?
> >=20
> > Initially I guessed it was perhaps a Glibc regression related to the
> > newly introduced clone3 usage on MIPS, but it fails with Glibc-2.35 too=
.
> >=20
> > Not sure if this is a kernel regression, I'll try different kernels in
> > several hours (once I can physically access the system).
>=20
> Not happening with kernel 5.18.1.=C2=A0 I can do a bisection but it will =
take
> several days, I guess.

Hmm, not so time-consuming as I expected.

4bce37a68ff884e821a02a731897a8119e0c37b7 is the first bad commit
commit 4bce37a68ff884e821a02a731897a8119e0c37b7
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Thu Jun 22 18:47:40 2023 +0200

    mips/mm: Convert to using lock_mm_and_find_vma()

Re-posting the broken test case for Ben (I also added a waitpid call to
prevent PID exhaustion):

#include <stdlib.h>
#include <errno.h>
#include <pthread.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/wait.h>

void *
test_thread (void *)
{
  char buf[16] =3D {};
  int fd =3D open("/dev/zero", O_RDONLY);
  while (1)
    {
      ssize_t ret =3D read (fd, buf, 7);
      if (ret =3D=3D -1 && errno =3D=3D EFAULT)
        abort ();
    }
}

void *
fork_thread (void *)
{
  while (1)
    {
      pid_t p =3D fork ();
      if (!p)
        _exit (0);
      waitpid (p, NULL, 0);
    }
}

int
main (void)
{
  pthread_t test_th;
  pthread_t fork_th;

  pthread_create (&test_th, NULL, test_thread, NULL);
  pthread_create (&fork_th, NULL, fork_thread, NULL);
  pthread_join (test_th, NULL);
  pthread_join (fork_th, NULL);
}

and the context where this issue was detected:

https://sourceware.org/glibc/wiki/Testing/Tests/stdlib/tst-arc4random-threa=
d

and the "interesting" aspects:

1. If I change the third parameter of "read" to any value >=3D 8, it no
longer fails.  But it fails with any integer in [1, 8).
2. It fails no matter if I initialize buf.
3. It does not fail on arm64 (the only other port using
lock_mm_and_find_vma I have access to).

--=20
Xi Ruoyao <xry111@xry111.site>
School of Aerospace Science and Technology, Xidian University