Received-SPF: pass (google.com: domain of linux-kernel+bounces-92404-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Precedence: bulk
MIME-Version: 1.0
References: <202403051032.e2f865a-lkp@intel.com> <ZeblmHyVlxl_6HGC@localhost.localdomain>
In-Reply-To: <ZeblmHyVlxl_6HGC@localhost.localdomain>
From: Marco Elver <elver@google.com>
Date: Tue, 5 Mar 2024 14:02:35 +0100
Message-ID: <CANpmjNMOazCrzJr+Ckx0vM73P86dPM_0qbcv=Nu44jUtPERD+A@mail.gmail.com>
Subject: Re: [linux-next:master] [mm,page_owner] 4bedfb314b: BUG:KASAN:null-ptr-deref_in_init_page_owner
To: Oscar Salvador <osalvador@suse.de>
Cc: kernel test robot <oliver.sang@intel.com>, oe-lkp@lists.linux.dev, lkp@intel.com, 
	Linux Memory Management List <linux-mm@kvack.org>, Andrew Morton <akpm@linux-foundation.org>, 
	Vlastimil Babka <vbabka@suse.cz>, Andrey Konovalov <andreyknvl@gmail.com>, 
	Alexander Potapenko <glider@google.com>, Michal Hocko <mhocko@suse.com>, linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"

On Tue, 5 Mar 2024 at 10:26, Oscar Salvador <osalvador@suse.de> wrote:
>
> On Tue, Mar 05, 2024 at 02:08:23PM +0800, kernel test robot wrote:
> >
> > [    6.582562][    T0] Node 0, zone    DMA32: page owner found early allocated 0 pages
> > [    6.612136][    T0] Node 0, zone   Normal: page owner found early allocated 73871 pages
> > [    6.612762][    T0] ==================================================================
> > [ 6.613351][ T0] BUG: KASAN: null-ptr-deref in init_page_owner (arch/x86/include/asm/atomic.h:28)
> > [    6.613893][    T0] Write of size 4 at addr 000000000000001c by task swapper/0
> > [    6.614434][    T0]
> > [    6.614600][    T0] CPU: 0 PID: 0 Comm: swapper Tainted: G                T  6.8.0-rc5-00256-g4bedfb314bdd #1 29e70169ace75ef72d53825e983f3dcb1d5756d9
> > [    6.615605][    T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
> > [    6.616367][    T0] Call Trace:
> > [    6.616604][    T0]  <TASK>
> > [ 6.616816][ T0] ? dump_stack_lvl (lib/dump_stack.c:?)
> > [ 6.617161][ T0] ? print_report (mm/kasan/report.c:?)
> > [ 6.617499][ T0] ? init_page_owner (arch/x86/include/asm/atomic.h:28)
>
> So, we are crashing here:
>
>         /* Initialize dummy and failure stacks and link them to stack_list */
>         dummy_stack.stack_record = __stack_depot_get_stack_record(dummy_handle);
>         failure_stack.stack_record = __stack_depot_get_stack_record(failure_handle);
>         refcount_set(&dummy_stack.stack_record->count, 1);
>         refcount_set(&failure_stack.stack_record->count, 1);
>
> when trying to set the refcount. Allegedly, because dummy_handle is 0.
> I thought we fixed that with
>
> commit 3ee34eabac2abb6b1b6fcdebffe18870719ad000
> Author: Oscar Salvador <osalvador@suse.de>
> Date:   Thu Feb 15 22:59:01 2024 +0100
>
>     lib/stackdepot: fix first entry having a 0-handle
>
>
> But I guess this is different.
> The obvious way out is to only set the refcount and link the stacks
> if their handles are not 0.
>
> Marco, could it be that stackdepot was too overloaded, that by the time
> page_owner gets initialized, there are no more space for its stacks, and
> hence return 0-handles?.

That's possible. But it's unclear to me what exactly happens. Are you
able to reproduce the issue? (I haven't been able to because the
config enables CFI which seems to cause other issues for me,
presumably toolchain related. :-/ )