linux-kernel - Re: [syzbot] [mm?] WARNING in xfs_init_fs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1921ec99-7abb-42f1-a56b-d1f0f5bc1377@I-love.SAKURA.ne.jp>
Date: Wed, 2 Jul 2025 10:41:07 +0900
From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To: Zi Yan <ziy@...dia.com>, Vlastimil Babka <vbabka@...e.cz>,
        Barry Song <baohua@...nel.org>
Cc: syzbot <syzbot+359a67b608de1ef72f65@...kaller.appspotmail.com>,
        akpm@...ux-foundation.org, apopple@...dia.com, byungchul@...com,
        david@...hat.com, gourry@...rry.net, joshua.hahnjy@...il.com,
        linux-kernel@...r.kernel.org, linux-mm@...ck.org,
        matthew.brost@...el.com, rakie.kim@...com,
        syzkaller-bugs@...glegroups.com, ying.huang@...ux.alibaba.com
Subject: Re: [syzbot] [mm?] WARNING in xfs_init_fs_context

On 2025/07/02 0:01, Zi Yan wrote:
>>  __alloc_frozen_pages_noprof+0x319/0x370 mm/page_alloc.c:4972
>>  alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2419
>>  alloc_slab_page mm/slub.c:2451 [inline]
>>  allocate_slab+0xe2/0x3b0 mm/slub.c:2627
>>  new_slab mm/slub.c:2673 [inline]
> 
> new_slab() allows __GFP_NOFAIL, since GFP_RECLAIM_MASK has it.
> In allocate_slab(), the first allocation without __GFP_NOFAIL
> failed, the retry used __GFP_NOFAIL but kmem_cache order
> was greater than 1, which led to the warning above.
> 
> Maybe allocate_slab() should just fail when kmem_cache
> order is too big and first trial fails? I am no expert,
> so add Vlastimil for help. Barry, who added the nofail
> warning is cc’d.

Indeed. In allocate_slab(struct kmem_cache *s, gfp_t flags, int node),

	/*
	 * Let the initial higher-order allocation fail under memory pressure
	 * so we fall-back to the minimum order allocation.
	 */
	alloc_gfp = (flags | __GFP_NOWARN | __GFP_NORETRY) & ~__GFP_NOFAIL;
	if ((alloc_gfp & __GFP_DIRECT_RECLAIM) && oo_order(oo) > oo_order(s->min))
		alloc_gfp = (alloc_gfp | __GFP_NOMEMALLOC) & ~__GFP_RECLAIM;

	slab = alloc_slab_page(alloc_gfp, node, oo);
	if (unlikely(!slab)) {
		oo = s->min;
		alloc_gfp = flags;
		/*
		 * Allocation may have failed due to fragmentation.
		 * Try a lower order alloc if possible
		 */
		slab = alloc_slab_page(alloc_gfp, node, oo);

__GFP_NOFAIL needs to be dropped unless s->min is either 0 or 1.

		if (unlikely(!slab))
			return NULL;
		stat(s, ORDER_FALLBACK);
	}



By the way, why is xfs_init_fs_context() using __GFP_NOFAIL ?

	mp = kzalloc(sizeof(struct xfs_mount), GFP_KERNEL | __GFP_NOFAIL);
	if (!mp)
		return -ENOMEM;

This looks an allocation attempt which can fail safely.