On Mon, 2024-09-23 at 11:43 -0700, Eduard Zingerman wrote:
> On Mon, 2024-09-23 at 11:34 -0700, Manu Bretelle wrote:
>
> [...]
>
> > The qemu command invoked by vmtest is:
> >
> > qemu-system-x86_64 "-nodefaults" "-display" "none" "-serial" "mon:stdio" \
> > "-enable-kvm" "-cpu" "host" "-qmp" "unix:/tmp/qmp-971717.sock,server=on,wait=off" \
> > "-chardev" "socket,path=/tmp/qga-888301.sock,server=on,wait=off,id=qga0" \
> > "-device" "virtio-serial" \
> > "-device" "virtserialport,chardev=qga0,name=org.qemu.guest_agent.0" \
> > "--device" "virtio-serial" \
> > "-chardev" "socket,path=/tmp/cmdout-508724.sock,server=on,wait=off,id=cmdout" \
> > "--device" "virtserialport,chardev=cmdout,name=org.qemu.virtio_serial.0" \
> > "-virtfs" "local,id=root,path=/,mount_tag=/dev/root,security_model=none,multidevs=remap" \
> > "-kernel" "/data/users/chantra/linux/arch/x86/boot/bzImage" \
> > "-no-reboot" "-append" "rootfstype=9p rootflags=trans=virtio,cache=mmap,msize=1048576 rw earlyprintk=serial,0,115200 printk.devkmsg=on console=0,115200 loglevel=7 raid=noautodetect init=/tmp/vmtest-init4PdCA.sh panic=-1" \
> > "-virtfs" "local,id=shared,path=/data/users/chantra/linux,mount_tag=vmtest-shared,security_model=none,multidevs=remap" \
> > "-smp" "2" "-m" "4G"
>
> fwiw: removing "cache=mmap" from "rootflags" allows VM to boot and run tests.
>
A few more details:
- error could be reproduced with KASAN enabled, log after
scripts/decode_stacktrace.sh post-processing is in [1];
(KASAN reports use-after-free followed by null-ptr-deref);
- null-ptr-deref is triggered by access to page->pcp_list.next
when list_del() is called from page_alloc.c:__rmqueue_pcplist(),
e.g. the following warning is triggered if added:
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2990,6 +2990,7 @@ struct page *__rmqueue_pcplist(struct zone *zone, unsigned int order,
}
page = list_first_entry(list, struct page, pcp_list);
+ WARN_ONCE(!page->pcp_list.next, "!!!!! page->pcp_list.next is NULL\n");
list_del(&page->pcp_list);
pcp->count -= 1 << order;
} while (check_new_pages(page, order));
- config used for testing is [2];
- kernel used for testing is [3];
[1] https://gist.github.com/eddyz87/e638d67454558508451331754f946f41
[2] https://gist.github.com/eddyz87/f2c9c267db20ee53a6eb350aba0d2182
[3] de5cb0dcb74c ("Merge branch 'address-masking'")
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
