Re: BUG: sleeping function called from invalid context in __alloc_pages_nodemask

From: Tetsuo Handa
Date: Sat Nov 30 2019 - 07:48:46 EST


On 2019/11/30 16:57, Dmitry Vyukov wrote:
> On Sat, Nov 30, 2019 at 8:35 AM syzbot
> <syzbot+4925d60532bf4c399608@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>>
>> Hello,
>>
>> syzbot found the following crash on:
>>
>> HEAD commit: 419593da Add linux-next specific files for 20191129
>> git tree: linux-next
>> console output: https://syzkaller.appspot.com/x/log.txt?x=12cc369ce00000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=7c04b0959e75c206
>> dashboard link: https://syzkaller.appspot.com/bug?extid=4925d60532bf4c399608
>> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
>>
>> Unfortunately, I don't have any reproducer for this crash yet.
>>
>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>> Reported-by: syzbot+4925d60532bf4c399608@xxxxxxxxxxxxxxxxxxxxxxxxx
>
> +Daniel, kasan-dev
> This is presumably from the new CONFIG_KASAN_VMALLOC

Well, this is because

commit d005e4cdb2307f63b5ce5cb359964c5a72d95790
Author: Uladzislau Rezki (Sony) <urezki@xxxxxxxxx>
Date: Tue Nov 19 11:45:23 2019 +1100

mm/vmalloc: rework vmap_area_lock

@@ -3363,29 +3369,38 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
va = vas[area];
va->va_start = start;
va->va_end = start + size;
-
- insert_vmap_area(va, &vmap_area_root, &vmap_area_list);
}

- spin_unlock(&vmap_area_lock);
+ spin_unlock(&free_vmap_area_lock);

/* insert all vm's */
- for (area = 0; area < nr_vms; area++)
- setup_vmalloc_vm(vms[area], vas[area], VM_ALLOC,
+ spin_lock(&vmap_area_lock);
+ for (area = 0; area < nr_vms; area++) {
+ insert_vmap_area(vas[area], &vmap_area_root, &vmap_area_list);
+
+ setup_vmalloc_vm_locked(vms[area], vas[area], VM_ALLOC,
pcpu_get_vm_areas);
+ }
+ spin_unlock(&vmap_area_lock);

kfree(vas);
return vms;

made the iteration atomic context while

commit 1800fa0a084c60a600be0cc43fc657ba5609fdda
Author: Daniel Axtens <dja@xxxxxxxxxx>
Date: Tue Nov 19 11:45:23 2019 +1100

kasan: support backing vmalloc space with real shadow memory

@@ -3380,6 +3414,9 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,

setup_vmalloc_vm_locked(vms[area], vas[area], VM_ALLOC,
pcpu_get_vm_areas);
+
+ /* assume success here */
+ kasan_populate_vmalloc(sizes[area], vms[area]);
}
spin_unlock(&vmap_area_lock);

tried to do sleeping allocation inside the iteration.