Received-SPF: pass (google.com: domain of linux-kernel+bounces-153879-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Date: Mon, 22 Apr 2024 14:53:17 -0400
From: "Liam R. Howlett" <Liam.Howlett@oracle.com>
To: Marius Fleischer <fleischermarius@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>, maple-tree@lists.infradead.org,
        linux-kernel@vger.kernel.org, syzkaller@googlegroups.com,
        harrisonmichaelgreen@gmail.com
Subject: Re: general protection fault in mas_empty_area_rev
Message-ID: <4vyuejd7gikyjlbmcpmdcemplminhy27ltbodmq7nkjsozzod7@ttzgzxrjp63y>
References: <CAJg=8jyuSxDL6XvqEXY_66M20psRK2J53oBTP+fjV5xpW2-R6w@mail.gmail.com>
 <uekqafv4wx5axijnnfybnxixui3ruzy3mkxirflv7tb3ovrtbk@ounqurycykuv>
 <CAJg=8jzRT=oA9g6AGd1KmAY3GBkKkczj1rCqQ+pik5LmUQYd_A@mail.gmail.com>
 <7jhx44ynje54wfcq3bkaui5w6oox7ypd7cgg4u5zhue6rf5tok@nj6jaxppzq2b>
 <usubtr2bibcnwca3rk3ytbd2jbpvshgu44faujrrrcnidnrr25@ttdhvhrz34vs>
 <CAJg=8jyaV20PannVxVQrqasmo3RCTAjOWfmkdm3ehviMoc=V-w@mail.gmail.com>
Content-Type: multipart/mixed; boundary="xkl2ju77harx26p7"
Content-Disposition: inline
In-Reply-To: <CAJg=8jyaV20PannVxVQrqasmo3RCTAjOWfmkdm3ehviMoc=V-w@mail.gmail.com>
User-Agent: NeoMutt/20231103
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?us-ascii?Q?V8XFZH7SeAAJW45vy62xUNV/Vr8nW1rKlM+ijdb56SJy8heZ7wmAomcGEKMP?=
 =?us-ascii?Q?BqsH8z6wDDOKA5WKyjZrqQ6+ueCjlsA8vc53tD7MAMtGZ5cn1eZgU5zOqSZT?=
 =?us-ascii?Q?Wf06n9GkcHsKN2LVWCVS1ML+UdHTozQNtpR5iTQcYidqYMsSugpxnWz+zQsZ?=
 =?us-ascii?Q?/4tnJhenqiO50Au1zF8xgmIeVoTGSOj7s9FZjsgsTkojcf5MtH7sOLuLBd5a?=
 =?us-ascii?Q?KsR76YLamXYvw5dIYAcMHC8NV/agFAoA1TpFkTsIyXxDc/quQhwe3RG2G5zT?=
 =?us-ascii?Q?sh+OP8dg4vojWgy956xbRYf/383Owa4nf9NimE9JqHASh53Uvob74Uay5+5N?=
 =?us-ascii?Q?9U2gBiTI9UtMkcDNLKx8aRO2L8Qz/Tbbsrhp0bwEWk6XhDFdjK/ArfZCLNL/?=
 =?us-ascii?Q?p6IPgcA+yVggm+4zV6MIVlTW2Si2yjwfCbYSRMGciBE2xwEJHtMGUMeLOpTs?=
 =?us-ascii?Q?uluZSukThvuvpyjNy9RjocatNJ9xWaoZAOQ13u7jPapPOwkrVtyn5PBPTVRs?=
 =?us-ascii?Q?rUlZp/IhZDadKBAs6YuUoff7lvjDoDAwYhGXIWceO5dkO15/zdV44I72xDIk?=
 =?us-ascii?Q?6keeO4/OK0K5UObuzxc1FrYQthA3tBaI8vazXpCal/i4n42Q3FJyGAtss33L?=
 =?us-ascii?Q?VEtBTE51FI9/egULSB2uh1eD50WGRIU/0PCv4418n7z8C2tzkYlmljd/DEe1?=
 =?us-ascii?Q?sa/Zzp8A7Wo5heeAhmiwRZ6vTxhl6gfFoDTvdaBsYcLzOG5k06UL8W5Y0NTS?=
 =?us-ascii?Q?lFaCxdAE8mumzvexVnCl2oafzO+XGO9vKZOvpYQJHEyd2nlXmN14TsDZz0Y9?=
 =?us-ascii?Q?2EVHFsxtzdRKmev35cWKzl7VhrgMpDLWG8V1RlzzkGj5VYIg08mcRcCWpf9W?=
 =?us-ascii?Q?QLJkEj8cHYnAe59KDJdbU4MJr9gW7Cm/yCegEUJMqrPQr48Fe6EcIMwFXArV?=
 =?us-ascii?Q?JN1+74w9kp4/5t1WenOH4Hgv/Rn5IjUhKII8C24+Bh8lV0aweT6hQyPDz+4m?=
 =?us-ascii?Q?ypjoIFuhqOXBPNnv2hFmpcySG3t89ejTNeuur/jdX3k7f0hrMkHvmgAAKTfG?=
 =?us-ascii?Q?RCkUSHOZkFTOkpninz2mBAoVilVA6268vZ6E/1zcc3RsOnlVxN/XcO2yuMEm?=
 =?us-ascii?Q?l1VP0Fg9fMAkOydsrKhUESEj7/hejptgfZeV4bjjXLK+GEyqcCnLJCynIn4s?=
 =?us-ascii?Q?gw0ssw+QHAofCvwDKYVeS62ggfygdxfUE2RCoLsoH2NSUU/ahWA9HcFEAiJ5?=
 =?us-ascii?Q?AwlGBOmc1AOV9BoFhpmqOGP4jRFvjYJoeS3qSp3w3n6rtTmuWLnyzzrrVsQV?=
 =?us-ascii?Q?63S+H1UK0coO3Vhvl+N8mha5SrBpb4TYA+cBF77z5vRycqLz2F6V/u+f42Q+?=
 =?us-ascii?Q?lGnaIyUJ44jOnM0wJYkERomUTZbVoLpRNgYW97BPLEllx7d2xwDURwCjYV4Z?=
 =?us-ascii?Q?87mhmOg01gar7Uh8vXTElYxf7q5gzxEM7rh8entKj0SWEd6LtpQU0VVShifN?=
 =?us-ascii?Q?vnX3XRvoF/Zmi2TLTok7tiPRSSUJuDg4UPR9D9XHwFYg2EA6xHFKwsu8An+G?=
 =?us-ascii?Q?rtwf2vy51mx3CCAZqn2pP3OGKgTAxj0GiNLkie1J?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	cpVJjglqLtEqDSweKba11Yz8hU7AEQZMRn7XfHKsoIDSDuZOmm8tnvazDb8GA3AsKv9i/C9ay3vSXPGEnVBXDeQEe1o7+wmWrVWlMaMnKkV+etkRrcP8d+7o74vMgjVyDGUKuIXL4qgYWto0fW6S/qP3NQegTIjz4LFMDKUx+Rkcq3yls69v2EZuJ3itiqbONgvXv13V4ctJRKaoVbtpocQjw+s027G/nIAS+BFivTdJ2cB5uKI4jkH3Ue3mOxyQUnOv0lC4+r8ffVxfyjmlbT5wenc9W6oT+eJBOBaoyxRyAPbnH6BEp+ecYQ+qld9fskgcpBzJeJSqD0ZjNlrdjcdMcWr7Hx8HDIBjNuLtD0YxbX6wgJ9GDyLfxlscW9IQdiO2NROI4gGIcdWlD6joPT1WIB7dEQx4M82odLjy12Q3zeejw5daNSKGpVgDyOGzS0K+QvsDIgO3vI5Rj3c5BPZ6Q66bFASSj8YeV/mz6WvIxXYyltQDGYwYawUHGv5nHHCjbsWttE/lHBBOHNlTuEPgcb6nZ5RvpcyXQxRY5Rw5IWMAQyiQT1om1ajJPLjppI/E2NqwubBTj9eIZPJxTslkkub6u1pjfSHTC/W3A60=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 90f62db6-3a04-448a-ee5a-08dc62fd7996
X-MS-Exchange-CrossTenant-AuthSource: DS0PR10MB7933.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Apr 2024 18:53:18.7235
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: r5atAn0qnBV0QIbPsGI74AnwJ16aofwk16CVby+vvYnRYhNNtZFawIZMp/aEIarbskcXBvF3n2bmKXa7dNmaUg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB4568
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2024-04-22_13,2024-04-22_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxlogscore=999
 mlxscore=0 phishscore=0 spamscore=0 malwarescore=0 adultscore=0
 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2404010000 definitions=main-2404220080
X-Proofpoint-GUID: oeb_AJfPfT3LzLP1jIgd83B56leK_wAp
X-Proofpoint-ORIG-GUID: oeb_AJfPfT3LzLP1jIgd83B56leK_wAp

--xkl2ju77harx26p7
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

* Marius Fleischer <fleischermarius@gmail.com> [240422 14:07]:
> Hi Liam,
> 
> On Mon, 22 Apr 2024 at 10:05, Liam R. Howlett <Liam.Howlett@oracle.com> wrote:
> > * Liam R. Howlett <Liam.Howlett@oracle.com> [240422 11:25]:
> > > * Marius Fleischer <fleischermarius@gmail.com> [240422 11:11]:
> > > > Hi Liam,
> > > >
> > > > Thank you so much for the response!
> > > >
> > > > > >
> > > > > > Crash log:
> > > > > >
> > > > > > general protection fault, probably for non-canonical address
> > > > > > 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI
> > > > > >
> > > > > > KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
> > > > > >
> > > > > > CPU: 0 PID: 79545 Comm: syz-executor.0 Not tainted 6.9.0-rc4-dirty #3
> > > > >
> > > > > This indicates that you built with your own patches.  Could you test an
> > > > > unmodified 6.9.0-rc4 with your setup?
> > > > >
> > > >
> > > > I'm very sorry for this oversight. I had applied the patches for another bug
> > > > from this conversation
> > > > (https://lore.kernel.org/all/20240404070702.2744-3-osalvador@suse.de/T/#m480f21ab850996395082d0faab7f624f45b83781)
> > > > I will test the reproducer without these patches and get back to you!
> > >
> > > After testing with your config, I can see that those fixes are needed to
> > > boot.
> > >
> > > I am going to try 6.9-rc5 with your configuration and see if I can
> > > trigger the issue there.
> > >
> >
> > The reproducer does not trigger for me with your configuration and
> > reproducer.
> >
> > Does it still happen for you in 6.9-rc5?
> >
> You are right, indeed, I was not able to boot v6.9-rc4 without the fixes.
> 
> I tested the reproducer on 6.9-rc5 (ed30a4a51bb196781c8058073ea720133a65596f)
> and it still triggers the crash in my setup. How can I help you
> further troubleshoot
> this issue?

Can you try the attached patch and see if that stops the crash?

Thanks,
Liam

--xkl2ju77harx26p7
Content-Type: text/x-diff; charset=us-ascii
Content-Disposition: attachment; filename="fix_20240422.patch"

diff --git a/lib/maple_tree.c b/lib/maple_tree.c
index 55e1b35bf877..db91918d4d20 100644
--- a/lib/maple_tree.c
+++ b/lib/maple_tree.c
@@ -5109,18 +5109,18 @@ int mas_empty_area_rev(struct ma_state *mas, unsigned long min,
 	if (size == 0 || max - min < size - 1)
 		return -EINVAL;
 
-	if (mas_is_start(mas)) {
+	if (mas_is_start(mas))
 		mas_start(mas);
-		mas->offset = mas_data_end(mas);
-	} else if (mas->offset >= 2) {
-		mas->offset -= 2;
-	} else if (!mas_rewind_node(mas)) {
+	else if ((mas->offset < 2) && (!mas_rewind_node(mas))) 
 		return -EBUSY;
-	}
 
-	/* Empty set. */
-	if (mas_is_none(mas) || mas_is_ptr(mas))
+	if (unlikely(mas_is_none(mas) || mas_is_ptr(mas)))
 		return mas_sparse_area(mas, min, max, size, false);
+	else if (mas->offset >= 2)
+		mas->offset -= 2;
+	else
+		mas->offset = mas_data_end(mas);
+
 
 	/* The start of the window can only be within these values. */
 	mas->index = min;

--xkl2ju77harx26p7--