Re: BUG: sleeping function called from invalid context in __alloc_pages_nodemask

[Uladzislau Rezki]

On Sat, Nov 30, 2019 at 09:48:34PM +0900, Tetsuo Handa wrote:
> On 2019/11/30 16:57, Dmitry Vyukov wrote:
> > On Sat, Nov 30, 2019 at 8:35 AM syzbot
> > <syzbot+4925d60532bf4c399608@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> >>
> >> Hello,
> >>
> >> syzbot found the following crash on:
> >>
> >> HEAD commit:    419593da Add linux-next specific files for 20191129
> >> git tree:       linux-next
> >> console output: https://syzkaller.appspot.com/x/log.txt?x=12cc369ce00000
> >> kernel config:  https://syzkaller.appspot.com/x/.config?x=7c04b0959e75c206
> >> dashboard link: https://syzkaller.appspot.com/bug?extid=4925d60532bf4c399608
> >> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> >>
> >> Unfortunately, I don't have any reproducer for this crash yet.
> >>
> >> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> >> Reported-by: syzbot+4925d60532bf4c399608@xxxxxxxxxxxxxxxxxxxxxxxxx
> > 
> > +Daniel, kasan-dev
> > This is presumably from the new CONFIG_KASAN_VMALLOC
> 
> Well, this is because
> 
> commit d005e4cdb2307f63b5ce5cb359964c5a72d95790
> Author: Uladzislau Rezki (Sony) <urezki@xxxxxxxxx>
> Date:   Tue Nov 19 11:45:23 2019 +1100
> 
>     mm/vmalloc: rework vmap_area_lock
> 
> @@ -3363,29 +3369,38 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
>                 va = vas[area];
>                 va->va_start = start;
>                 va->va_end = start + size;
> -
> -               insert_vmap_area(va, &vmap_area_root, &vmap_area_list);
>         }
> 
> -       spin_unlock(&vmap_area_lock);
> +       spin_unlock(&free_vmap_area_lock);
> 
>         /* insert all vm's */
> -       for (area = 0; area < nr_vms; area++)
> -               setup_vmalloc_vm(vms[area], vas[area], VM_ALLOC,
> +       spin_lock(&vmap_area_lock);
> +       for (area = 0; area < nr_vms; area++) {
> +               insert_vmap_area(vas[area], &vmap_area_root, &vmap_area_list);
> +
> +               setup_vmalloc_vm_locked(vms[area], vas[area], VM_ALLOC,
>                                  pcpu_get_vm_areas);
> +       }
> +       spin_unlock(&vmap_area_lock);
> 
>         kfree(vas);
>         return vms;
> 
> made the iteration atomic context while
> 
> commit 1800fa0a084c60a600be0cc43fc657ba5609fdda
> Author: Daniel Axtens <dja@xxxxxxxxxx>
> Date:   Tue Nov 19 11:45:23 2019 +1100
> 
>     kasan: support backing vmalloc space with real shadow memory
> 
> @@ -3380,6 +3414,9 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
> 
>                 setup_vmalloc_vm_locked(vms[area], vas[area], VM_ALLOC,
>                                  pcpu_get_vm_areas);
> +
> +               /* assume success here */
> +               kasan_populate_vmalloc(sizes[area], vms[area]);
>         }
>         spin_unlock(&vmap_area_lock);
> 
> tried to do sleeping allocation inside the iteration.
There was a patch that fixes an attempt of "sleeping allocation" under
the spinlock from Daniel:

https://lkml.org/lkml/2019/11/20/22

--
Vlad Rezki