Received-SPF: pass (google.com: domain of linux-kernel+bounces-183672-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Subject: Re: [syzbot] [bpf?] possible deadlock in get_page_from_freelist
To: Pengfei Xu <pengfei.xu@intel.com>,
 syzbot <syzbot+a7f061d2d16154538c58@syzkaller.appspotmail.com>,
 ytcoode@gmail.com
Cc: andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org,
 daniel@iogearbox.net, eddyz87@gmail.com, haoluo@google.com,
 john.fastabend@gmail.com, jolsa@kernel.org, kpsingh@kernel.org,
 linux-kernel@vger.kernel.org, martin.lau@linux.dev, sdf@google.com,
 song@kernel.org, syzkaller-bugs@googlegroups.com, yonghong.song@linux.dev,
 akpm@linux-foundation.org
References: <000000000000c051d80616195f15@google.com>
 <ZkcD9H0P8O7Me5Do@xpf.sh.intel.com>
From: Hou Tao <houtao@huaweicloud.com>
Message-ID: <554af7a5-4309-cfec-8182-93e61aadc918@huaweicloud.com>
Date: Mon, 20 May 2024 19:44:31 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.6.0
Precedence: bulk
MIME-Version: 1.0
In-Reply-To: <ZkcD9H0P8O7Me5Do@xpf.sh.intel.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Content-Language: en-US

Hi

On 5/17/2024 3:15 PM, Pengfei Xu wrote:
> Hi Yuntao,
>
> Greeting!
>
> On 2024-04-14 at 19:28:16 -0700, syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit:    7efd0a74039f Merge tag 'ata-6.9-rc4' of git://git.kernel.o..
>> git tree:       upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=1358aeed180000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=285be8dd6baeb438
>> dashboard link: https://syzkaller.appspot.com/bug?extid=a7f061d2d16154538c58
>> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
>>
>> Unfortunately, I don't have any reproducer for this issue yet.
>>
> I used syzkaller and could reproduce the similar issue "WARNING in
> get_page_from_freelist" in v6.9 mainline kernel.

The warning report is different with the dead-lock syzbot report. The
warning is "WARN_ON_ONCE((gfp_flags & __GFP_NOFAIL) && (order > 1))" in
rmqueue() and it is caused by "kzalloc(sizeof(struct xfs_mount),
GFP_KERNEL | __GFP_NOFAIL)" in xfs_init_fs_context().
>
> Bisected and found first bad commit:
> "
> 816d334afa85 kexec: modify the meaning of the end parameter in kimage_is_destination_range()
> "
> Revert above commit on top of v6.9 kernel this issue was gone.
>
> All detailed info: https://github.com/xupengfe/syzkaller_logs/tree/main/240517_085953_get_page_from_freelist
> mount_*.gz are in above link.
> Syzkaller reproduced code: https://github.com/xupengfe/syzkaller_logs/blob/main/240517_085953_get_page_from_freelist/rep.c
> Syzkaller syscall repro steps: https://github.com/xupengfe/syzkaller_logs/blob/main/240517_085953_get_page_from_freelist/repro.prog
> Syzkaller report: https://github.com/xupengfe/syzkaller_logs/blob/main/240517_085953_get_page_from_freelist/repro.report

I think it is a false positive, because without KASAN enabled, the size
of xfs_mount is about 2496 bytes and it is impossible to trigger the
WARN_ON_ONCE(). However with KASAN enabled, the size of xfs_mount will
be greater than 4096, so the warning will be triggered accordingly when
the 8KB-slab needs to refill its slabs.