From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 78121EB64DD for ; Sat, 29 Jul 2023 00:52:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236086AbjG2AwQ (ORCPT ); Fri, 28 Jul 2023 20:52:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41252 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235564AbjG2AwG (ORCPT ); Fri, 28 Jul 2023 20:52:06 -0400 Received: from casper.infradead.org (casper.infradead.org [IPv6:2001:8b0:10b:1236::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E744D4ED2 for ; Fri, 28 Jul 2023 17:51:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Transfer-Encoding: Content-Type:MIME-Version:References:Message-ID:Subject:Cc:To:From:Date: Sender:Reply-To:Content-ID:Content-Description; bh=0wWBrgJmDz8vNioLPvZ7zs17z+DjGgVgGJutHe403bI=; b=DAgMrl3JkbZs+KCaWX1+F2NZ1z PcxOVZsyjLzc1qYhqPCk9PzcK4gtont3vucKMrOtH6RT0JMSqmsqnC5529uXsEY5j73s/bGiWhk7l 4JOmVvGAw3EgpMVqhe/NhKCiz8Hophzn5kyDHC/nDMBcYknk8BLZJ7o0fU5IKz0OEfyz4ADgab7m3 KllwofHsQeeLcsuqZGs0COx+s5k5hCOg7mFaNHKJRkqSwRqzaApo07D3R1inMiOhgOXW+RirAYJQO 2wAMw8DR4ZkLPjTyx6z0V+TBUZiCcqQTR/r0HJ1OQqm0ANIFiLdiVfmR5QlTM1zZTIy6jATwaVP3w 8wD3hJeg==; Received: from willy by casper.infradead.org with local (Exim 4.94.2 #2 (Red Hat Linux)) id 1qPYA7-009CJy-4G; Sat, 29 Jul 2023 00:50:27 +0000 Date: Sat, 29 Jul 2023 01:50:27 +0100 From: Matthew Wilcox To: Joan Bruguera =?iso-8859-1?Q?Mic=F3?= Cc: Steven Price , zhengqi.arch@bytedance.com, Roman Gushchin , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrew Morton Subject: Re: [PATCH] mm: shrinkers: fix race condition on debugfs cleanup Message-ID: References: <20230726000827.724389-1-joanbrugueram@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20230726000827.724389-1-joanbrugueram@gmail.com> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Jul 26, 2023 at 12:08:26AM +0000, Joan Bruguera Micó wrote: > Hmmm, indeed linux-next crashes with a null pointer dereference when > calling `ida_free(..., -1)`. > > It appears to me that 69cb69ea5542 ("ida: Remove assertions that an ID was > allocated") didn't intend to make `ida_free(..., -1)` invalid; after all, > it was authored & introduced immediately after fc82bbf4dede ("ida: don't > use BUG_ON() for debugging") whose commit message calls for making it > legal, with Matthew's support. > And the referenced Bluetooth HCI code that also calls `ida_free(..., -1)` > is still there, as far as I can tell ([1]). > > Rather, probably the `((int)id < 0)` was accidentally dropped, or the idea > was that it would be handled by the `not_found:` label in `ida_free`, but > for that to work you'd need to change the `!test_bit(bit, bitmap->bitmap)` > condition to `!bitmap || !test_bit(bit, bitmap->bitmap)` since otherwise > `bitmap->bitmap` is a null pointer dereference. I've been in two minds about that patch ever since I wrote it. I've dropped it from my tree for now. But, er, you have pointed out a bug which is that we don't handle !bitmap properly. That should be fixed.