Buildresult: linus/TCM-BF518_defconfig/bfin built on Jan 8 2017, 14:37

kisskb

Revisions | Branches | Compilers | Configs | Build Results | Build Failures |

Status:	Failed
Date/Time:	Jan 8 2017, 14:37
Duration:	0:00:03.390641
Builder:	ka1
Revision:	mm: workingset: fix use-after-free in shadow node shrinker (`ea07b862ac8ef9b8c8358517d2e39f847dda6659)`
Target:	linus/TCM-BF518_defconfig/bfin
Branch:	linus
Compiler:	bfin (bfin-uclinux-gcc (GCC) 4.6.3)
Config:	TCM-BF518_defconfig (download)
Log:	Download original Possible errors cc1: error: -mcpu=bf518-0.1 has invalid silicon revision cc1: error: unrecognized command line option '-mcpu=bf518-0.1' make[3]: * [scripts/mod/empty.o] Error 1 cc1: error: -mcpu=bf518-0.1 has invalid silicon revision cc1: error: unrecognized command line option '-mcpu=bf518-0.1' make[3]: * [scripts/mod/devicetable-offsets.s] Error 1 cc1: error: -mcpu=bf518-0.1 has invalid silicon revision cc1: error: unrecognized command line option '-mcpu=bf518-0.1' make[2]: * [kernel/bounds.s] Error 1 make[1]: * [prepare0] Error 2 make[2]: * [scripts/mod] Error 2 make[1]: * [scripts] Error 2 make: * [sub-make] Error 2 Possible warnings (1) WARNING: CPU: 2 PID: 53 at lib/radix-tree.c:643 delete_node+0x1e4/0x200 Full Log # git rev-parse -q --verify ea07b862ac8ef9b8c8358517d2e39f847dda6659^{commit} ea07b862ac8ef9b8c8358517d2e39f847dda6659 already have revision, skipping fetch # git checkout -q -f -B kisskb ea07b862ac8ef9b8c8358517d2e39f847dda6659 # git clean -qxdf # git log -1 commit ea07b862ac8ef9b8c8358517d2e39f847dda6659 Author: Johannes Weiner <hannes@cmpxchg.org> Date: Fri Jan 6 19:21:43 2017 -0500 mm: workingset: fix use-after-free in shadow node shrinker Several people report seeing warnings about inconsistent radix tree nodes followed by crashes in the workingset code, which all looked like use-after-free access from the shadow node shrinker. Dave Jones managed to reproduce the issue with a debug patch applied, which confirmed that the radix tree shrinking indeed frees shadow nodes while they are still linked to the shadow LRU: WARNING: CPU: 2 PID: 53 at lib/radix-tree.c:643 delete_node+0x1e4/0x200 CPU: 2 PID: 53 Comm: kswapd0 Not tainted 4.10.0-rc2-think+ #3 Call Trace: delete_node+0x1e4/0x200 __radix_tree_delete_node+0xd/0x10 shadow_lru_isolate+0xe6/0x220 __list_lru_walk_one.isra.4+0x9b/0x190 list_lru_walk_one+0x23/0x30 scan_shadow_nodes+0x2e/0x40 shrink_slab.part.44+0x23d/0x5d0 shrink_node+0x22c/0x330 kswapd+0x392/0x8f0 This is the WARN_ON_ONCE(!list_empty(&node->private_list)) placed in the inlined radix_tree_shrink(). The problem is with 14b468791fa9 ("mm: workingset: move shadow entry tracking to radix tree exceptional tracking"), which passes an update callback into the radix tree to link and unlink shadow leaf nodes when tree entries change, but forgot to pass the callback when reclaiming a shadow node. While the reclaimed shadow node itself is unlinked by the shrinker, its deletion from the tree can cause the left-most leaf node in the tree to be shrunk. If that happens to be a shadow node as well, we don't unlink it from the LRU as we should. Consider this tree, where the s are shadow entries: root->rnode \| [0 n] \| \| [s ] [sssss] Now the shadow node shrinker reclaims the rightmost leaf node through the shadow node LRU: root->rnode \| [0 ] \| [s ] Because the parent of the deleted node is the first level below the root and has only one child in the left-most slot, the intermediate level is shrunk and the node containing the single shadow is put in its place: root->rnode \| [s ] The shrinker again sees a single left-most slot in a first level node and thus decides to store the shadow in root->rnode directly and free the node - which is a leaf node on the shadow node LRU. root->rnode \| s Without the update callback, the freed node remains on the shadow LRU, where it causes later shrinker runs to crash. Pass the node updater callback into __radix_tree_delete_node() in case the deletion causes the left-most branch in the tree to collapse too. Also add warnings when linked nodes are freed right away, rather than wait for the use-after-free when the list is scanned much later. Fixes: 14b468791fa9 ("mm: workingset: move shadow entry tracking to radix tree exceptional tracking") Reported-by: Dave Chinner <david@fromorbit.com> Reported-by: Hugh Dickins <hughd@google.com> Reported-by: Andrea Arcangeli <aarcange@redhat.com> Reported-and-tested-by: Dave Jones <davej@codemonkey.org.uk> Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Cc: Christoph Hellwig <hch@lst.de> Cc: Chris Leech <cleech@redhat.com> Cc: Lee Duncan <lduncan@suse.com> Cc: Jan Kara <jack@suse.cz> Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Cc: Matthew Wilcox <mawilcox@linuxonhyperv.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> # < /opt/cross/kisskb/gcc-4.6.3-nolibc/bfin-uclinux/bin/bfin-uclinux-gcc --version # < git log --format=%s --max-count=1 ea07b862ac8ef9b8c8358517d2e39f847dda6659 # < make -j 48 ARCH=blackfin O=/home/kisskb/slave/build/linus_TCM-BF518_defconfig_bfin CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/bfin-uclinux/bin/bfin-uclinux- TCM-BF518_defconfig # make -j 48 ARCH=blackfin O=/home/kisskb/slave/build/linus_TCM-BF518_defconfig_bfin CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/bfin-uclinux/bin/bfin-uclinux- make[1]: Entering directory '/home/kisskb/slave/build/linus_TCM-BF518_defconfig_bfin' GEN ./Makefile scripts/kconfig/conf --silentoldconfig Kconfig CHK include/config/kernel.release GEN ./Makefile WRAP arch/blackfin/include/generated/asm/auxvec.h WRAP arch/blackfin/include/generated/asm/bitsperlong.h WRAP arch/blackfin/include/generated/asm/bugs.h WRAP arch/blackfin/include/generated/asm/cputime.h WRAP arch/blackfin/include/generated/asm/current.h WRAP arch/blackfin/include/generated/asm/device.h WRAP arch/blackfin/include/generated/asm/div64.h WRAP arch/blackfin/include/generated/asm/emergency-restart.h WRAP arch/blackfin/include/generated/asm/errno.h WRAP arch/blackfin/include/generated/asm/fb.h WRAP arch/blackfin/include/generated/asm/futex.h WRAP arch/blackfin/include/generated/asm/hw_irq.h CHK include/generated/uapi/linux/version.h WRAP arch/blackfin/include/generated/asm/ioctl.h WRAP arch/blackfin/include/generated/asm/ipcbuf.h WRAP arch/blackfin/include/generated/asm/irq_regs.h WRAP arch/blackfin/include/generated/asm/irq_work.h UPD include/generated/uapi/linux/version.h WRAP arch/blackfin/include/generated/asm/kdebug.h WRAP arch/blackfin/include/generated/asm/kmap_types.h WRAP arch/blackfin/include/generated/asm/kvm_para.h WRAP arch/blackfin/include/generated/asm/local.h WRAP arch/blackfin/include/generated/asm/local64.h WRAP arch/blackfin/include/generated/asm/mcs_spinlock.h WRAP arch/blackfin/include/generated/asm/mm-arch-hooks.h WRAP arch/blackfin/include/generated/asm/mman.h WRAP arch/blackfin/include/generated/asm/msgbuf.h WRAP arch/blackfin/include/generated/asm/percpu.h WRAP arch/blackfin/include/generated/asm/param.h WRAP arch/blackfin/include/generated/asm/pgalloc.h WRAP arch/blackfin/include/generated/asm/preempt.h WRAP arch/blackfin/include/generated/asm/resource.h WRAP arch/blackfin/include/generated/asm/sembuf.h WRAP arch/blackfin/include/generated/asm/serial.h WRAP arch/blackfin/include/generated/asm/setup.h WRAP arch/blackfin/include/generated/asm/shmbuf.h WRAP arch/blackfin/include/generated/asm/shmparam.h WRAP arch/blackfin/include/generated/asm/socket.h WRAP arch/blackfin/include/generated/asm/sockios.h WRAP arch/blackfin/include/generated/asm/statfs.h WRAP arch/blackfin/include/generated/asm/termbits.h WRAP arch/blackfin/include/generated/asm/termios.h WRAP arch/blackfin/include/generated/asm/topology.h WRAP arch/blackfin/include/generated/asm/trace_clock.h WRAP arch/blackfin/include/generated/asm/types.h HOSTCC scripts/basic/bin2c WRAP arch/blackfin/include/generated/asm/ucontext.h WRAP arch/blackfin/include/generated/asm/unaligned.h WRAP arch/blackfin/include/generated/asm/user.h WRAP arch/blackfin/include/generated/asm/word-at-a-time.h WRAP arch/blackfin/include/generated/asm/xor.h UPD include/config/kernel.release Using /home/kisskb/slave/src as source for kernel CHK include/generated/utsrelease.h UPD include/generated/utsrelease.h HOSTCC scripts/kallsyms HOSTCC scripts/conmakehash CC scripts/mod/empty.o HOSTCC scripts/mod/mk_elfconfig CC scripts/mod/devicetable-offsets.s cc1: error: -mcpu=bf518-0.1 has invalid silicon revision cc1: error: unrecognized command line option '-mcpu=bf518-0.1' /home/kisskb/slave/src/scripts/Makefile.build:293: recipe for target 'scripts/mod/empty.o' failed make[3]: * [scripts/mod/empty.o] Error 1 make[3]: * Waiting for unfinished jobs.... cc1: error: -mcpu=bf518-0.1 has invalid silicon revision cc1: error: unrecognized command line option '-mcpu=bf518-0.1' /home/kisskb/slave/src/scripts/Makefile.build:154: recipe for target 'scripts/mod/devicetable-offsets.s' failed make[3]: * [scripts/mod/devicetable-offsets.s] Error 1 CHK include/generated/timeconst.h CC kernel/bounds.s cc1: error: -mcpu=bf518-0.1 has invalid silicon revision cc1: error: unrecognized command line option '-mcpu=bf518-0.1' UPD include/generated/timeconst.h /home/kisskb/slave/src/./Kbuild:45: recipe for target 'kernel/bounds.s' failed make[2]: * [kernel/bounds.s] Error 1 make[2]: * Waiting for unfinished jobs.... /home/kisskb/slave/src/Makefile:1033: recipe for target 'prepare0' failed make[1]: * [prepare0] Error 2 make[1]: * Waiting for unfinished jobs.... /home/kisskb/slave/src/scripts/Makefile.build:551: recipe for target 'scripts/mod' failed make[2]: * [scripts/mod] Error 2 make[2]: * Waiting for unfinished jobs.... /home/kisskb/slave/src/Makefile:560: recipe for target 'scripts' failed make[1]: * [scripts] Error 2 make[1]: Leaving directory '/home/kisskb/slave/build/linus_TCM-BF518_defconfig_bfin' Makefile:150: recipe for target 'sub-make' failed make: * [sub-make] Error 2 Command 'make -j 48 ARCH=blackfin O=/home/kisskb/slave/build/linus_TCM-BF518_defconfig_bfin CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/bfin-uclinux/bin/bfin-uclinux- ' returned non-zero exit status 2 # rm -rf /home/kisskb/slave/build/linus_TCM-BF518_defconfig_bfin # Build took: 0:00:03.390641

© Michael Ellerman 2006-2018.