Re: BUG: sleeping function called from invalid context in __alloc_pages_nodemask

[Tetsuo Handa]

On 2019/11/30 16:57, Dmitry Vyukov wrote:
> On Sat, Nov 30, 2019 at 8:35 AM syzbot
> <syzbot+4925d60532bf4c399608@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>>
>> Hello,
>>
>> syzbot found the following crash on:
>>
>> HEAD commit:    419593da Add linux-next specific files for 20191129
>> git tree:       linux-next
>> console output: https://syzkaller.appspot.com/x/log.txt?x=12cc369ce00000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=7c04b0959e75c206
>> dashboard link: https://syzkaller.appspot.com/bug?extid=4925d60532bf4c399608
>> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
>>
>> Unfortunately, I don't have any reproducer for this crash yet.
>>
>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>> Reported-by: syzbot+4925d60532bf4c399608@xxxxxxxxxxxxxxxxxxxxxxxxx
> 
> +Daniel, kasan-dev
> This is presumably from the new CONFIG_KASAN_VMALLOC

Well, this is because

commit d005e4cdb2307f63b5ce5cb359964c5a72d95790
Author: Uladzislau Rezki (Sony) <urezki@xxxxxxxxx>
Date:   Tue Nov 19 11:45:23 2019 +1100

    mm/vmalloc: rework vmap_area_lock

@@ -3363,29 +3369,38 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
                va = vas[area];
                va->va_start = start;
                va->va_end = start + size;
-
-               insert_vmap_area(va, &vmap_area_root, &vmap_area_list);
        }

-       spin_unlock(&vmap_area_lock);
+       spin_unlock(&free_vmap_area_lock);

        /* insert all vm's */
-       for (area = 0; area < nr_vms; area++)
-               setup_vmalloc_vm(vms[area], vas[area], VM_ALLOC,
+       spin_lock(&vmap_area_lock);
+       for (area = 0; area < nr_vms; area++) {
+               insert_vmap_area(vas[area], &vmap_area_root, &vmap_area_list);
+
+               setup_vmalloc_vm_locked(vms[area], vas[area], VM_ALLOC,
                                 pcpu_get_vm_areas);
+       }
+       spin_unlock(&vmap_area_lock);

        kfree(vas);
        return vms;

made the iteration atomic context while

commit 1800fa0a084c60a600be0cc43fc657ba5609fdda
Author: Daniel Axtens <dja@xxxxxxxxxx>
Date:   Tue Nov 19 11:45:23 2019 +1100

    kasan: support backing vmalloc space with real shadow memory

@@ -3380,6 +3414,9 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,

                setup_vmalloc_vm_locked(vms[area], vas[area], VM_ALLOC,
                                 pcpu_get_vm_areas);
+
+               /* assume success here */
+               kasan_populate_vmalloc(sizes[area], vms[area]);
        }
        spin_unlock(&vmap_area_lock);

tried to do sleeping allocation inside the iteration.