Re: general protection fault in mas_empty_area_rev

[Liam R. Howlett]

* Marius Fleischer <fleischermarius@xxxxxxxxx> [240422 14:07]:
> Hi Liam,
> 
> On Mon, 22 Apr 2024 at 10:05, Liam R. Howlett <Liam.Howlett@xxxxxxxxxx> wrote:
> > * Liam R. Howlett <Liam.Howlett@xxxxxxxxxx> [240422 11:25]:
> > > * Marius Fleischer <fleischermarius@xxxxxxxxx> [240422 11:11]:
> > > > Hi Liam,
> > > >
> > > > Thank you so much for the response!
> > > >
> > > > > >
> > > > > > Crash log:
> > > > > >
> > > > > > general protection fault, probably for non-canonical address
> > > > > > 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI
> > > > > >
> > > > > > KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
> > > > > >
> > > > > > CPU: 0 PID: 79545 Comm: syz-executor.0 Not tainted 6.9.0-rc4-dirty #3
> > > > >
> > > > > This indicates that you built with your own patches.  Could you test an
> > > > > unmodified 6.9.0-rc4 with your setup?
> > > > >
> > > >
> > > > I'm very sorry for this oversight. I had applied the patches for another bug
> > > > from this conversation
> > > > (https://lore.kernel.org/all/20240404070702.2744-3-osalvador@xxxxxxx/T/#m480f21ab850996395082d0faab7f624f45b83781)
> > > > I will test the reproducer without these patches and get back to you!
> > >
> > > After testing with your config, I can see that those fixes are needed to
> > > boot.
> > >
> > > I am going to try 6.9-rc5 with your configuration and see if I can
> > > trigger the issue there.
> > >
> >
> > The reproducer does not trigger for me with your configuration and
> > reproducer.
> >
> > Does it still happen for you in 6.9-rc5?
> >
> You are right, indeed, I was not able to boot v6.9-rc4 without the fixes.
> 
> I tested the reproducer on 6.9-rc5 (ed30a4a51bb196781c8058073ea720133a65596f)
> and it still triggers the crash in my setup. How can I help you
> further troubleshoot
> this issue?

Can you try the attached patch and see if that stops the crash?

Thanks,
Liam
diff --git a/lib/maple_tree.c b/lib/maple_tree.c
index 55e1b35bf877..db91918d4d20 100644
--- a/lib/maple_tree.c
+++ b/lib/maple_tree.c
@@ -5109,18 +5109,18 @@ int mas_empty_area_rev(struct ma_state *mas, unsigned long min,
 	if (size == 0 || max - min < size - 1)
 		return -EINVAL;
 
-	if (mas_is_start(mas)) {
+	if (mas_is_start(mas))
 		mas_start(mas);
-		mas->offset = mas_data_end(mas);
-	} else if (mas->offset >= 2) {
-		mas->offset -= 2;
-	} else if (!mas_rewind_node(mas)) {
+	else if ((mas->offset < 2) && (!mas_rewind_node(mas))) 
 		return -EBUSY;
-	}
 
-	/* Empty set. */
-	if (mas_is_none(mas) || mas_is_ptr(mas))
+	if (unlikely(mas_is_none(mas) || mas_is_ptr(mas)))
 		return mas_sparse_area(mas, min, max, size, false);
+	else if (mas->offset >= 2)
+		mas->offset -= 2;
+	else
+		mas->offset = mas_data_end(mas);
+
 
 	/* The start of the window can only be within these values. */
 	mas->index = min;