linux-kernel - Re: BUG: sleeping function called from invalid context in __alloc_pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20191130134455.GA27399@pc636>
Date:   Sat, 30 Nov 2019 14:44:55 +0100
From:   Uladzislau Rezki <urezki@...il.com>
To:     Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
Cc:     Dmitry Vyukov <dvyukov@...gle.com>,
        syzbot <syzbot+4925d60532bf4c399608@...kaller.appspotmail.com>,
        Daniel Axtens <dja@...ens.net>,
        kasan-dev <kasan-dev@...glegroups.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Linux-MM <linux-mm@...ck.org>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: Re: BUG: sleeping function called from invalid context in
 __alloc_pages_nodemask

On Sat, Nov 30, 2019 at 09:48:34PM +0900, Tetsuo Handa wrote:
> On 2019/11/30 16:57, Dmitry Vyukov wrote:
> > On Sat, Nov 30, 2019 at 8:35 AM syzbot
> > <syzbot+4925d60532bf4c399608@...kaller.appspotmail.com> wrote:
> >>
> >> Hello,
> >>
> >> syzbot found the following crash on:
> >>
> >> HEAD commit:    419593da Add linux-next specific files for 20191129
> >> git tree:       linux-next
> >> console output: https://syzkaller.appspot.com/x/log.txt?x=12cc369ce00000
> >> kernel config:  https://syzkaller.appspot.com/x/.config?x=7c04b0959e75c206
> >> dashboard link: https://syzkaller.appspot.com/bug?extid=4925d60532bf4c399608
> >> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> >>
> >> Unfortunately, I don't have any reproducer for this crash yet.
> >>
> >> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> >> Reported-by: syzbot+4925d60532bf4c399608@...kaller.appspotmail.com
> > 
> > +Daniel, kasan-dev
> > This is presumably from the new CONFIG_KASAN_VMALLOC
> 
> Well, this is because
> 
> commit d005e4cdb2307f63b5ce5cb359964c5a72d95790
> Author: Uladzislau Rezki (Sony) <urezki@...il.com>
> Date:   Tue Nov 19 11:45:23 2019 +1100
> 
>     mm/vmalloc: rework vmap_area_lock
> 
> @@ -3363,29 +3369,38 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
>                 va = vas[area];
>                 va->va_start = start;
>                 va->va_end = start + size;
> -
> -               insert_vmap_area(va, &vmap_area_root, &vmap_area_list);
>         }
> 
> -       spin_unlock(&vmap_area_lock);
> +       spin_unlock(&free_vmap_area_lock);
> 
>         /* insert all vm's */
> -       for (area = 0; area < nr_vms; area++)
> -               setup_vmalloc_vm(vms[area], vas[area], VM_ALLOC,
> +       spin_lock(&vmap_area_lock);
> +       for (area = 0; area < nr_vms; area++) {
> +               insert_vmap_area(vas[area], &vmap_area_root, &vmap_area_list);
> +
> +               setup_vmalloc_vm_locked(vms[area], vas[area], VM_ALLOC,
>                                  pcpu_get_vm_areas);
> +       }
> +       spin_unlock(&vmap_area_lock);
> 
>         kfree(vas);
>         return vms;
> 
> made the iteration atomic context while
> 
> commit 1800fa0a084c60a600be0cc43fc657ba5609fdda
> Author: Daniel Axtens <dja@...ens.net>
> Date:   Tue Nov 19 11:45:23 2019 +1100
> 
>     kasan: support backing vmalloc space with real shadow memory
> 
> @@ -3380,6 +3414,9 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
> 
>                 setup_vmalloc_vm_locked(vms[area], vas[area], VM_ALLOC,
>                                  pcpu_get_vm_areas);
> +
> +               /* assume success here */
> +               kasan_populate_vmalloc(sizes[area], vms[area]);
>         }
>         spin_unlock(&vmap_area_lock);
> 
> tried to do sleeping allocation inside the iteration.
There was a patch that fixes an attempt of "sleeping allocation" under
the spinlock from Daniel:

https://lkml.org/lkml/2019/11/20/22

--
Vlad Rezki