[syzbot] [mm?] BUG: sleeping function called from invalid context in vma_alloc_folio_noprof

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 3fe121b62282 Add linux-next specific files for 20240712
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=12ba9149980000
kernel config: https://syzkaller.appspot.com/x/.config?x=98dd8c4bab5cdce
dashboard link: https://syzkaller.appspot.com/bug?extid=a3e82ae343b26b4d2335
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=144c4b66980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=163c28f6980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8c6fbf69718d/disk-3fe121b6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/39fc7e43dfc1/vmlinux-3fe121b6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0a78e70e4b4e/bzImage-3fe121b6.xz

The issue was bisected to:

commit ca567df74a28a9fb368c6b2d93e864113f73f5c2
Author: Christian Brauner <bra...@kernel.org>
Date: Sun Jun 7 20:47:08 2020 +0000

nsfs: add pid translation ioctls

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1073805e980000
final oops: https://syzkaller.appspot.com/x/report.txt?x=1273805e980000
console output: https://syzkaller.appspot.com/x/log.txt?x=1473805e980000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a3e82a...@syzkaller.appspotmail.com
Fixes: ca567df74a28 ("nsfs: add pid translation ioctls")

BUG: sleeping function called from invalid context at include/linux/sched/mm.h:337
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5092, name: syz-executor156
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
INFO: lockdep is turned off.
CPU: 1 UID: 0 PID: 5092 Comm: syz-executor156 Not tainted 6.10.0-rc7-next-20240712-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
__might_resched+0x5d4/0x780 kernel/sched/core.c:8526
might_alloc include/linux/sched/mm.h:337 [inline]
prepare_alloc_pages+0x1c9/0x5d0 mm/page_alloc.c:4503
__alloc_pages_noprof+0x166/0x6c0 mm/page_alloc.c:4721
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2263
folio_alloc_mpol_noprof mm/mempolicy.c:2281 [inline]
vma_alloc_folio_noprof+0x12e/0x230 mm/mempolicy.c:2312
folio_prealloc+0x31/0x170
wp_page_copy mm/memory.c:3342 [inline]
do_wp_page+0x11cc/0x52f0 mm/memory.c:3734
handle_pte_fault+0x1138/0x6eb0 mm/memory.c:5545
__handle_mm_fault mm/memory.c:5672 [inline]
handle_mm_fault+0xff1/0x19a0 mm/memory.c:5837
do_user_addr_fault arch/x86/mm/fault.c:1338 [inline]
handle_page_fault arch/x86/mm/fault.c:1481 [inline]
exc_page_fault+0x459/0x8c0 arch/x86/mm/fault.c:1539
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f3a8171eb80
Code: 84 dd fe ff ff 4c 89 e7 e8 ed 90 00 00 e9 d0 fe ff ff 0f 1f 84 00 00 00 00 00 49 8b 06 48 89 45 00 48 85 c0 0f 85 85 00 00 00 <c6> 05 49 25 0a 00 01 31 c0 87 05 19 21 0a 00 83 f8 01 0f 8f 84 00
RSP: 002b:00007ffc347a4150 EFLAGS: 00010246


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Andrew Morton]

On Mon, 15 Jul 2024 18:24:19 -0700 syzbot <syzbot+a3e82a...@syzkaller.appspotmail.com> wrote:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 3fe121b62282 Add linux-next specific files for 20240712
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=12ba9149980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=98dd8c4bab5cdce
> dashboard link: https://syzkaller.appspot.com/bug?extid=a3e82ae343b26b4d2335
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=144c4b66980000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=163c28f6980000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/8c6fbf69718d/disk-3fe121b6.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/39fc7e43dfc1/vmlinux-3fe121b6.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/0a78e70e4b4e/bzImage-3fe121b6.xz
>
> The issue was bisected to:
>
> commit ca567df74a28a9fb368c6b2d93e864113f73f5c2
> Author: Christian Brauner <bra...@kernel.org>
> Date: Sun Jun 7 20:47:08 2020 +0000
>
> nsfs: add pid translation ioctls
>

yup, thanks. Breaking out of the switch statement while holding
rcu_read_lock().

[Christian Brauner]

Ensure that rcu read lock is given up before returning.

Reported-by: syzbot+a3e82a...@syzkaller.appspotmail.com
Fixes: ca567df74a28 ("nsfs: add pid translation ioctls")
Signed-off-by: Christian Brauner <bra...@kernel.org>
---
I have a few fixes pending I plan to send out asap.
---
fs/nsfs.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/nsfs.c b/fs/nsfs.c
index a4a925dce331..97c37a9631e5 100644
--- a/fs/nsfs.c
+++ b/fs/nsfs.c
@@ -174,14 +174,14 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl,
fallthrough;
case NS_GET_PID_IN_PIDNS:
fallthrough;
- case NS_GET_TGID_IN_PIDNS:
+ case NS_GET_TGID_IN_PIDNS: {
if (ns->ops->type != CLONE_NEWPID)
return -EINVAL;

ret = -ESRCH;
pid_ns = container_of(ns, struct pid_namespace, ns);

- rcu_read_lock();
+ guard(rcu)();

if (ioctl == NS_GET_PID_IN_PIDNS ||
ioctl == NS_GET_TGID_IN_PIDNS)
@@ -208,11 +208,11 @@ static long ns_ioctl(struct file *filp, unsigned int ioctl,
ret = 0;
break;
}
- rcu_read_unlock();

if (!ret)
ret = -ESRCH;
break;
+ }
default:
ret = -ENOTTY;
}
--
2.43.0

[Christian Brauner]

On Tue, 16 Jul 2024 09:19:11 +0200, Christian Brauner wrote:
> Ensure that rcu read lock is given up before returning.
>
>

Applied to the vfs.fixes branch of the vfs/vfs.git tree.
Patches in the vfs.fixes branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree: https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.fixes

[1/1] nsfs: use cleanup guard
https://git.kernel.org/vfs/vfs/c/0052b241e3e5