linux-kernel - Re: [syzbot] [mm?] WARNING in page_add_anon

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1fe06726-85bf-7231-f33d-d73e8cfbaa4f@redhat.com>
Date:   Mon, 18 Sep 2023 14:53:22 +0200
From:   David Hildenbrand <david@...hat.com>
To:     Matthew Wilcox <willy@...radead.org>
Cc:     syzbot <syzbot+6e4f59235036c3c2e296@...kaller.appspotmail.com>,
        akpm@...ux-foundation.org, linux-kernel@...r.kernel.org,
        linux-mm@...ck.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [mm?] WARNING in page_add_anon_rmap

On 18.09.23 14:32, Matthew Wilcox wrote:
> On Mon, Sep 18, 2023 at 12:00:24PM +0200, David Hildenbrand wrote:
>>> If you want syzbot to run the reproducer, reply with:
>>> #syz test: git://repo/address.git branch-or-commit-hash
>>> If you attach or paste a git patch, syzbot will apply it before testing.
> 
> If I understand correctly, you have to do it like this:
> 
> #syz test
> 
> diff --git a/mm/rmap.c b/mm/rmap.c
> index 789a2beb8b3a..f13a2927163d 100644
> --- a/mm/rmap.c
> +++ b/mm/rmap.c
> @@ -1249,8 +1249,10 @@ void page_add_anon_rmap(struct page *page, struct vm_area_struct *vma,
>   	}
>   	if (flags & RMAP_EXCLUSIVE)
>   		SetPageAnonExclusive(page);
> -	VM_WARN_ON_FOLIO(page_mapcount(page) > 1 && PageAnonExclusive(page),
> -			 folio);
> +	/* While PTE-mapping a THP we have a PMD and a PTE mapping. */
> +	VM_WARN_ON_FOLIO((atomic_read(&page->_mapcount) > 0 ||
> +			  (folio_test_large(folio) && folio_entire_mapcount(folio) > 1)) &&
> +			 PageAnonExclusive(page), folio);
>   	mlock_vma_folio(folio, vma, compound);
>   }

Looks like an empty line went missing in your attempt.

Let's try again for fun (I reproduced and tested myself already ;) ).


#syz test

diff --git a/mm/rmap.c b/mm/rmap.c
index 789a2beb8b3a..f13a2927163d 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1249,8 +1249,10 @@ void page_add_anon_rmap(struct page *page, struct vm_area_struct *vma,
  	}
  	if (flags & RMAP_EXCLUSIVE)
  		SetPageAnonExclusive(page);
-	VM_WARN_ON_FOLIO(page_mapcount(page) > 1 && PageAnonExclusive(page),
-			 folio);
+	/* While PTE-mapping a THP we have a PMD and a PTE mapping. */
+	VM_WARN_ON_FOLIO((atomic_read(&page->_mapcount) > 0 ||
+			  (folio_test_large(folio) && folio_entire_mapcount(folio) > 1)) &&
+			 PageAnonExclusive(page), folio);
  
  	mlock_vma_folio(folio, vma, compound);
  }
-- 
2.41.0

-- 
Cheers,

David / dhildenb