On Sat, Nov 30, 2019 at 09:48:34PM +0900, Tetsuo Handa wrote: > On 2019/11/30 16:57, Dmitry Vyukov wrote: > > On Sat, Nov 30, 2019 at 8:35 AM syzbot > > <syzbot+4925d60532bf4c399608@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote: > >> > >> Hello, > >> > >> syzbot found the following crash on: > >> > >> HEAD commit: 419593da Add linux-next specific files for 20191129 > >> git tree: linux-next > >> console output: https://syzkaller.appspot.com/x/log.txt?x=12cc369ce00000 > >> kernel config: https://syzkaller.appspot.com/x/.config?x=7c04b0959e75c206 > >> dashboard link: https://syzkaller.appspot.com/bug?extid=4925d60532bf4c399608 > >> compiler: gcc (GCC) 9.0.0 20181231 (experimental) > >> > >> Unfortunately, I don't have any reproducer for this crash yet. > >> > >> IMPORTANT: if you fix the bug, please add the following tag to the commit: > >> Reported-by: syzbot+4925d60532bf4c399608@xxxxxxxxxxxxxxxxxxxxxxxxx > > > > +Daniel, kasan-dev > > This is presumably from the new CONFIG_KASAN_VMALLOC > > Well, this is because > > commit d005e4cdb2307f63b5ce5cb359964c5a72d95790 > Author: Uladzislau Rezki (Sony) <urezki@xxxxxxxxx> > Date: Tue Nov 19 11:45:23 2019 +1100 > > mm/vmalloc: rework vmap_area_lock > > @@ -3363,29 +3369,38 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets, > va = vas[area]; > va->va_start = start; > va->va_end = start + size; > - > - insert_vmap_area(va, &vmap_area_root, &vmap_area_list); > } > > - spin_unlock(&vmap_area_lock); > + spin_unlock(&free_vmap_area_lock); > > /* insert all vm's */ > - for (area = 0; area < nr_vms; area++) > - setup_vmalloc_vm(vms[area], vas[area], VM_ALLOC, > + spin_lock(&vmap_area_lock); > + for (area = 0; area < nr_vms; area++) { > + insert_vmap_area(vas[area], &vmap_area_root, &vmap_area_list); > + > + setup_vmalloc_vm_locked(vms[area], vas[area], VM_ALLOC, > pcpu_get_vm_areas); > + } > + spin_unlock(&vmap_area_lock); > > kfree(vas); > return vms; > > made the iteration atomic context while > > commit 1800fa0a084c60a600be0cc43fc657ba5609fdda > Author: Daniel Axtens <dja@xxxxxxxxxx> > Date: Tue Nov 19 11:45:23 2019 +1100 > > kasan: support backing vmalloc space with real shadow memory > > @@ -3380,6 +3414,9 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets, > > setup_vmalloc_vm_locked(vms[area], vas[area], VM_ALLOC, > pcpu_get_vm_areas); > + > + /* assume success here */ > + kasan_populate_vmalloc(sizes[area], vms[area]); > } > spin_unlock(&vmap_area_lock); > > tried to do sleeping allocation inside the iteration. There was a patch that fixes an attempt of "sleeping allocation" under the spinlock from Daniel: https://lkml.org/lkml/2019/11/20/22 -- Vlad Rezki
