Messages in this thread Patch in this message | | | Date | Mon, 22 Apr 2024 14:53:17 -0400 | From | "Liam R. Howlett" <> | Subject | Re: general protection fault in mas_empty_area_rev |
| |
* Marius Fleischer <fleischermarius@gmail.com> [240422 14:07]: > Hi Liam, > > On Mon, 22 Apr 2024 at 10:05, Liam R. Howlett <Liam.Howlett@oracle.com> wrote: > > * Liam R. Howlett <Liam.Howlett@oracle.com> [240422 11:25]: > > > * Marius Fleischer <fleischermarius@gmail.com> [240422 11:11]: > > > > Hi Liam, > > > > > > > > Thank you so much for the response! > > > > > > > > > > > > > > > > Crash log: > > > > > > > > > > > > general protection fault, probably for non-canonical address > > > > > > 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI > > > > > > > > > > > > KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] > > > > > > > > > > > > CPU: 0 PID: 79545 Comm: syz-executor.0 Not tainted 6.9.0-rc4-dirty #3 > > > > > > > > > > This indicates that you built with your own patches. Could you test an > > > > > unmodified 6.9.0-rc4 with your setup? > > > > > > > > > > > > > I'm very sorry for this oversight. I had applied the patches for another bug > > > > from this conversation > > > > (https://lore.kernel.org/all/20240404070702.2744-3-osalvador@suse.de/T/#m480f21ab850996395082d0faab7f624f45b83781) > > > > I will test the reproducer without these patches and get back to you! > > > > > > After testing with your config, I can see that those fixes are needed to > > > boot. > > > > > > I am going to try 6.9-rc5 with your configuration and see if I can > > > trigger the issue there. > > > > > > > The reproducer does not trigger for me with your configuration and > > reproducer. > > > > Does it still happen for you in 6.9-rc5? > > > You are right, indeed, I was not able to boot v6.9-rc4 without the fixes. > > I tested the reproducer on 6.9-rc5 (ed30a4a51bb196781c8058073ea720133a65596f) > and it still triggers the crash in my setup. How can I help you > further troubleshoot > this issue?
Can you try the attached patch and see if that stops the crash?
Thanks, Liam diff --git a/lib/maple_tree.c b/lib/maple_tree.c index 55e1b35bf877..db91918d4d20 100644 --- a/lib/maple_tree.c +++ b/lib/maple_tree.c @@ -5109,18 +5109,18 @@ int mas_empty_area_rev(struct ma_state *mas, unsigned long min, if (size == 0 || max - min < size - 1) return -EINVAL; - if (mas_is_start(mas)) { + if (mas_is_start(mas)) mas_start(mas); - mas->offset = mas_data_end(mas); - } else if (mas->offset >= 2) { - mas->offset -= 2; - } else if (!mas_rewind_node(mas)) { + else if ((mas->offset < 2) && (!mas_rewind_node(mas))) return -EBUSY; - } - /* Empty set. */ - if (mas_is_none(mas) || mas_is_ptr(mas)) + if (unlikely(mas_is_none(mas) || mas_is_ptr(mas))) return mas_sparse_area(mas, min, max, size, false); + else if (mas->offset >= 2) + mas->offset -= 2; + else + mas->offset = mas_data_end(mas); + /* The start of the window can only be within these values. */ mas->index = min; | |