[PATCH v9 08/69] mm: start tracking VMAs with maple tree

[Liam Howlett]

* Qian Cai <quic_qiancai at quicinc.com> [220606 08:26]:
> On Wed, May 04, 2022 at 01:07:52AM +0000, Liam Howlett wrote:
> > From: "Liam R. Howlett" <Liam.Howlett at Oracle.com>
> > 
> > Start tracking the VMAs with the new maple tree structure in parallel with
> > the rb_tree.  Add debug and trace events for maple tree operations and
> > duplicate the rb_tree that is created on forks into the maple tree.
> > 
> > The maple tree is added to the mm_struct including the mm_init struct,
> > added support in required mm/mmap functions, added tracking in kernel/fork
> > for process forking, and used to find the unmapped_area and checked
> > against what the rbtree finds.
> > 
> > This also moves the mmap_lock() in exit_mmap() since the oom reaper call
> > does walk the VMAs.  Otherwise lockdep will be unhappy if oom happens.
> > 
> > Signed-off-by: Liam R. Howlett <Liam.Howlett at Oracle.com>
> > Signed-off-by: Matthew Wilcox (Oracle) <willy at infradead.org>
> ...
> > @@ -842,6 +969,12 @@ int __vma_adjust(struct vm_area_struct *vma, unsigned long start,
> >  again:
> >  	vma_adjust_trans_huge(orig_vma, start, end, adjust_next);
> >  
> > +	if (mas_preallocate(&mas, vma, GFP_KERNEL)) {
> > +		if (exporter && exporter->anon_vma)
> > +			unlink_anon_vmas(importer);
> > +		return -ENOMEM;
> > +	}
> > +
> >  	if (file) {
> >  		mapping = file->f_mapping;
> >  		root = &mapping->i_mmap;
> 
> Running a syscall fuzzer for a while could still trigger some memory leak reports.
> 
> unreferenced object 0xffff4021439c6100 (size 256):
>   comm "trinity-c32", pid 1329067, jiffies 4301918356 (age 231692.944s)
>   hex dump (first 32 bytes):
>     00 61 9c 43 21 40 ff ff 1c b1 65 1d 02 40 ff ff  .a.C!@....e.. at ..
>     ff 2f 42 97 ff ff 00 00 ff 2f 43 97 ff ff 00 00  ./B....../C.....
>   backtrace:
>     [<ffffd4be60434e28>] slab_post_alloc_hook+0x98/0xf0
>     [<ffffd4be6043a2e0>] kmem_cache_alloc_bulk+0x26c/0x4ac
>     [<ffffd4be60d549c8>] mas_alloc_nodes+0x1e8/0x500
>     [<ffffd4be60d7cc68>] mas_preallocate+0xc8/0x210
>     [<ffffd4be603607a0>] __vma_adjust+0x27c/0x1290
>     __vma_adjust at mm/mmap.c:762

I assume this is 5.18.0-next-20220603?  The line number seems to be
correct.

>     [<ffffd4be60361b0c>] vma_merge+0x358/0x650
>     [<ffffd4be60370e20>] mprotect_fixup+0x160/0x530
>     [<ffffd4be60371544>] do_mprotect_pkey.constprop.0+0x354/0x710
>     [<ffffd4be60371978>] __arm64_sys_mprotect+0x78/0x130

This must be on arm64 then.

>     [<ffffd4be5fc43a24>] invoke_syscall+0x74/0x260
>     [<ffffd4be5fc43db8>] el0_svc_common.constprop.0+0x1a8/0x260
>     [<ffffd4be5fc43f1c>] do_el0_svc+0xac/0xe0
>     [<ffffd4be62d68144>] el0_svc+0x84/0x1c0
>     [<ffffd4be62d687dc>] el0t_64_sync_handler+0xbc/0x140
>     [<ffffd4be5fc12548>] el0t_64_sync+0x18c/0x190

Does your fuzzer create a reproducer at all?  It would be helpful a lot
since I cannot see my bug right now.

Thanks,
Liam