On Wed, May 04, 2022 at 01:07:52AM +0000, Liam Howlett wrote:
> From: "Liam R. Howlett" <Liam.Howlett@xxxxxxxxxx>
>
> Start tracking the VMAs with the new maple tree structure in parallel with
> the rb_tree. Add debug and trace events for maple tree operations and
> duplicate the rb_tree that is created on forks into the maple tree.
>
> The maple tree is added to the mm_struct including the mm_init struct,
> added support in required mm/mmap functions, added tracking in kernel/fork
> for process forking, and used to find the unmapped_area and checked
> against what the rbtree finds.
>
> This also moves the mmap_lock() in exit_mmap() since the oom reaper call
> does walk the VMAs. Otherwise lockdep will be unhappy if oom happens.
>
> Signed-off-by: Liam R. Howlett <Liam.Howlett@xxxxxxxxxx>
> Signed-off-by: Matthew Wilcox (Oracle) <willy@xxxxxxxxxxxxx>
...
> @@ -842,6 +969,12 @@ int __vma_adjust(struct vm_area_struct *vma, unsigned long start,
> again:
> vma_adjust_trans_huge(orig_vma, start, end, adjust_next);
>
> + if (mas_preallocate(&mas, vma, GFP_KERNEL)) {
> + if (exporter && exporter->anon_vma)
> + unlink_anon_vmas(importer);
> + return -ENOMEM;
> + }
> +
> if (file) {
> mapping = file->f_mapping;
> root = &mapping->i_mmap;
Running a syscall fuzzer for a while could still trigger some memory leak reports.
unreferenced object 0xffff4021439c6100 (size 256):
comm "trinity-c32", pid 1329067, jiffies 4301918356 (age 231692.944s)
hex dump (first 32 bytes):
00 61 9c 43 21 40 ff ff 1c b1 65 1d 02 40 ff ff .a.C!@....e..@..
ff 2f 42 97 ff ff 00 00 ff 2f 43 97 ff ff 00 00 ./B....../C.....
backtrace:
[<ffffd4be60434e28>] slab_post_alloc_hook+0x98/0xf0
[<ffffd4be6043a2e0>] kmem_cache_alloc_bulk+0x26c/0x4ac
[<ffffd4be60d549c8>] mas_alloc_nodes+0x1e8/0x500
[<ffffd4be60d7cc68>] mas_preallocate+0xc8/0x210
[<ffffd4be603607a0>] __vma_adjust+0x27c/0x1290
__vma_adjust at mm/mmap.c:762
[<ffffd4be60361b0c>] vma_merge+0x358/0x650
[<ffffd4be60370e20>] mprotect_fixup+0x160/0x530
[<ffffd4be60371544>] do_mprotect_pkey.constprop.0+0x354/0x710
[<ffffd4be60371978>] __arm64_sys_mprotect+0x78/0x130
[<ffffd4be5fc43a24>] invoke_syscall+0x74/0x260
[<ffffd4be5fc43db8>] el0_svc_common.constprop.0+0x1a8/0x260
[<ffffd4be5fc43f1c>] do_el0_svc+0xac/0xe0
[<ffffd4be62d68144>] el0_svc+0x84/0x1c0
[<ffffd4be62d687dc>] el0t_64_sync_handler+0xbc/0x140
[<ffffd4be5fc12548>] el0t_64_sync+0x18c/0x190
