From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1754443AbdCWSDO (ORCPT <rfc822;w@1wt.eu>);
        Thu, 23 Mar 2017 14:03:14 -0400
Received: from userp1040.oracle.com ([156.151.31.81]:41945 "EHLO
        userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1753764AbdCWSDJ (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Thu, 23 Mar 2017 14:03:09 -0400
Subject: Re: mm: BUG in resv_map_release
To: Dmitry Vyukov <dvyukov@google.com>, nyc@holomorphy.com,
        Andrew Morton <akpm@linux-foundation.org>,
        Michal Hocko <mhocko@suse.com>,
        "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
        Andrea Arcangeli <aarcange@redhat.com>,
        "linux-mm@kvack.org" <linux-mm@kvack.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Andrey Ryabinin <aryabinin@virtuozzo.com>
References: <CACT4Y+Z-trVe0Oqzs8c+mTG6_iL7hPBBFgOm0p0iQsCz9Q2qiw@mail.gmail.com>
 <a10eb28c-305d-3547-8df1-7a2216473e09@oracle.com>
From: Mike Kravetz <mike.kravetz@oracle.com>
Message-ID: <888af92c-1d20-d9f4-a425-c720d1179756@oracle.com>
Date: Thu, 23 Mar 2017 11:02:22 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
 Thunderbird/45.8.0
MIME-Version: 1.0
In-Reply-To: <a10eb28c-305d-3547-8df1-7a2216473e09@oracle.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-Source-IP: userv0022.oracle.com [156.151.31.74]
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 03/23/2017 10:25 AM, Mike Kravetz wrote:
> On 03/23/2017 03:19 AM, Dmitry Vyukov wrote:
>> Hello,
>>
>> I've got the following BUG while running syzkaller fuzzer.
>> Note the injected kmalloc failure, most likely it's the root cause.
> 
> Thanks  Dmitry,
> 
> The BUG indicates someone called region_chg() in the process of adding
> a hugetlbfs page reservation, but did not complete this 'two step'
> process with a call to region_add() or region_abort().  Most likely a
> missed call in an error path somewhere.  :(
> 
> I'll try to track this down.  The hint of 'injected kmalloc failure'
> should help.

Actually, in this case I believe the bug is in hugetlb_reserve_pages.
It calls region_chg(), but gets an error due to the injected kmalloc
failure.  At this point, the resv_map->adds_in_progress is 0 as it
should be.  However, the error path for hugetlb_reserve_pages calls
region_abort() which will unconditionally decrement adds_in_progress.
So, adds_in_progress goes negative and we eventually BUG.  :(

I'll look for other misuses of region_chg()/region_add()/region_abort()
and put together a patch.

Dmitry, is there some way to run the fuzzer with kmalloc failure injection
and target the hugetlbfs code?  I'm suspect we could flush out other bugs.
I noticed one other you discovered, and will look at that next.

-- 
Mike Kravetz