* Qian Cai <quic_qiancai@xxxxxxxxxxx> [220606 08:26]:
> On Wed, May 04, 2022 at 01:07:52AM +0000, Liam Howlett wrote:
> > From: "Liam R. Howlett" <Liam.Howlett@xxxxxxxxxx>
> >
> > Start tracking the VMAs with the new maple tree structure in parallel with
> > the rb_tree. Add debug and trace events for maple tree operations and
> > duplicate the rb_tree that is created on forks into the maple tree.
> >
> > The maple tree is added to the mm_struct including the mm_init struct,
> > added support in required mm/mmap functions, added tracking in kernel/fork
> > for process forking, and used to find the unmapped_area and checked
> > against what the rbtree finds.
> >
> > This also moves the mmap_lock() in exit_mmap() since the oom reaper call
> > does walk the VMAs. Otherwise lockdep will be unhappy if oom happens.
> >
> > Signed-off-by: Liam R. Howlett <Liam.Howlett@xxxxxxxxxx>
> > Signed-off-by: Matthew Wilcox (Oracle) <willy@xxxxxxxxxxxxx>
> ...
> > @@ -842,6 +969,12 @@ int __vma_adjust(struct vm_area_struct *vma, unsigned long start,
> > again:
> > vma_adjust_trans_huge(orig_vma, start, end, adjust_next);
> >
> > + if (mas_preallocate(&mas, vma, GFP_KERNEL)) {
> > + if (exporter && exporter->anon_vma)
> > + unlink_anon_vmas(importer);
> > + return -ENOMEM;
> > + }
> > +
> > if (file) {
> > mapping = file->f_mapping;
> > root = &mapping->i_mmap;
>
> Running a syscall fuzzer for a while could still trigger some memory leak reports.
>
> unreferenced object 0xffff4021439c6100 (size 256):
> comm "trinity-c32", pid 1329067, jiffies 4301918356 (age 231692.944s)
> hex dump (first 32 bytes):
> 00 61 9c 43 21 40 ff ff 1c b1 65 1d 02 40 ff ff .a.C!@....e..@..
> ff 2f 42 97 ff ff 00 00 ff 2f 43 97 ff ff 00 00 ./B....../C.....
> backtrace:
> [<ffffd4be60434e28>] slab_post_alloc_hook+0x98/0xf0
> [<ffffd4be6043a2e0>] kmem_cache_alloc_bulk+0x26c/0x4ac
> [<ffffd4be60d549c8>] mas_alloc_nodes+0x1e8/0x500
> [<ffffd4be60d7cc68>] mas_preallocate+0xc8/0x210
> [<ffffd4be603607a0>] __vma_adjust+0x27c/0x1290
> __vma_adjust at mm/mmap.c:762
I assume this is 5.18.0-next-20220603? The line number seems to be
correct.
> [<ffffd4be60361b0c>] vma_merge+0x358/0x650
> [<ffffd4be60370e20>] mprotect_fixup+0x160/0x530
> [<ffffd4be60371544>] do_mprotect_pkey.constprop.0+0x354/0x710
> [<ffffd4be60371978>] __arm64_sys_mprotect+0x78/0x130
This must be on arm64 then.
> [<ffffd4be5fc43a24>] invoke_syscall+0x74/0x260
> [<ffffd4be5fc43db8>] el0_svc_common.constprop.0+0x1a8/0x260
> [<ffffd4be5fc43f1c>] do_el0_svc+0xac/0xe0
> [<ffffd4be62d68144>] el0_svc+0x84/0x1c0
> [<ffffd4be62d687dc>] el0t_64_sync_handler+0xbc/0x140
> [<ffffd4be5fc12548>] el0t_64_sync+0x18c/0x190
Does your fuzzer create a reproducer at all? It would be helpful a lot
since I cannot see my bug right now.
Thanks,
Liam
