From: Robin Murphy <robin.murphy@arm.com>
To: linux-mm@kvack.org
Cc: mhocko@suse.com, akpm@linux-foundation.org, linux-kernel@vger.kernel.org
Subject: [PATCH v2] mm: Fix __dump_page() for poisoned pages
Date: Wed, 13 Feb 2019 15:41:04 +0000 [thread overview]
Message-ID: <03b53ee9d7e76cda4b9b5e1e31eea080db033396.1550071778.git.robin.murphy@arm.com> (raw)
Evaluating page_mapping() on a poisoned page ends up dereferencing junk
and making PF_POISONED_CHECK() considerably crashier than intended:
[ 107.147056] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000006
[ 107.155774] Mem abort info:
[ 107.158546] ESR = 0x96000005
[ 107.161572] Exception class = DABT (current EL), IL = 32 bits
[ 107.167437] SET = 0, FnV = 0
[ 107.170460] EA = 0, S1PTW = 0
[ 107.173568] Data abort info:
[ 107.176419] ISV = 0, ISS = 0x00000005
[ 107.180218] CM = 0, WnR = 0
[ 107.183151] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c2f6ac38
[ 107.189702] [0000000000000006] pgd=0000000000000000, pud=0000000000000000
[ 107.196430] Internal error: Oops: 96000005 [#1] PREEMPT SMP
[ 107.201942] Modules linked in:
[ 107.204962] CPU: 2 PID: 491 Comm: bash Not tainted 5.0.0-rc1+ #1
[ 107.210903] Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Dec 17 2018
[ 107.221576] pstate: 00000005 (nzcv daif -PAN -UAO)
[ 107.226321] pc : page_mapping+0x18/0x118
[ 107.230200] lr : __dump_page+0x1c/0x398
[ 107.233990] sp : ffffff8011a53c30
[ 107.237265] x29: ffffff8011a53c30 x28: ffffffc039b6ec00
[ 107.242520] x27: 0000000000000000 x26: 0000000000000000
[ 107.247775] x25: 0000000056000000 x24: 0000000000000015
[ 107.253029] x23: ffffff80114d8b18 x22: 0000000000000022
[ 107.258283] x21: ffffffc03538ec38 x20: ffffff8011082e78
[ 107.263537] x19: ffffffbf20000000 x18: 0000000000000000
[ 107.268790] x17: 0000000000000000 x16: 0000000000000000
[ 107.274044] x15: 0000000000000000 x14: 0000000000000000
[ 107.279297] x13: 0000000000000000 x12: 0000000000000030
[ 107.284550] x11: 0000000000000030 x10: 0101010101010101
[ 107.289804] x9 : ff7274615e68726c x8 : 7f7f7f7f7f7f7f7f
[ 107.295057] x7 : feff64756e6c6471 x6 : 0000000000008080
[ 107.300310] x5 : 0000000000000000 x4 : 0000000000000000
[ 107.305564] x3 : ffffffc039b6ec00 x2 : fffffffffffffffe
[ 107.310817] x1 : ffffffffffffffff x0 : fffffffffffffffe
[ 107.316072] Process bash (pid: 491, stack limit = 0x000000004ebd4ecd)
[ 107.322442] Call trace:
[ 107.324858] page_mapping+0x18/0x118
[ 107.328392] __dump_page+0x1c/0x398
[ 107.331840] dump_page+0xc/0x18
[ 107.334945] remove_store+0xbc/0x120
[ 107.338479] dev_attr_store+0x18/0x28
[ 107.342103] sysfs_kf_write+0x40/0x50
[ 107.345722] kernfs_fop_write+0x130/0x1d8
[ 107.349687] __vfs_write+0x30/0x180
[ 107.353134] vfs_write+0xb4/0x1a0
[ 107.356410] ksys_write+0x60/0xd0
[ 107.359686] __arm64_sys_write+0x18/0x20
[ 107.363565] el0_svc_common+0x94/0xf8
[ 107.367184] el0_svc_handler+0x68/0x70
[ 107.370890] el0_svc+0x8/0xc
[ 107.373737] Code: f9400401 d1000422 f240003f 9a801040 (f9400402)
[ 107.379766] ---[ end trace cdb5eb5bf435cecb ]---
Fix that by not inspecting the mapping until we've determined that it's
likely to be valid. Now the above condition still ends up stopping the
kernel, but in the correct manner:
[ 46.835963] page:ffffffbf20000000 is uninitialized and poisoned
[ 46.835970] raw: ffffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffff
[ 46.849520] raw: ffffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffff
[ 46.857194] page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p))
[ 46.863170] ------------[ cut here ]------------
[ 46.867736] kernel BUG at ./include/linux/mm.h:1006!
[ 46.872646] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
[ 46.878071] Modules linked in:
[ 46.881092] CPU: 1 PID: 483 Comm: bash Not tainted 5.0.0-rc1+ #3
[ 46.887032] Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Dec 17 2018
[ 46.897704] pstate: 40000005 (nZcv daif -PAN -UAO)
[ 46.902449] pc : remove_store+0xbc/0x120
[ 46.906327] lr : remove_store+0xbc/0x120
...
Fixes: 1c6fb1d89e73 ("mm: print more information about mapping in __dump_page")
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
---
v2: Expand commit message with logs, add Michal's ack
mm/debug.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/mm/debug.c b/mm/debug.c
index 0abb987dad9b..1611cf00a137 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -44,7 +44,7 @@ const struct trace_print_flags vmaflag_names[] = {
void __dump_page(struct page *page, const char *reason)
{
- struct address_space *mapping = page_mapping(page);
+ struct address_space *mapping;
bool page_poisoned = PagePoisoned(page);
int mapcount;
@@ -58,6 +58,8 @@ void __dump_page(struct page *page, const char *reason)
goto hex_only;
}
+ mapping = page_mapping(page);
+
/*
* Avoid VM_BUG_ON() in page_mapcount().
* page->_mapcount space in struct page is used by sl[aou]b pages to
--
2.20.1.dirty
reply other threads:[~2019-02-13 15:41 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=03b53ee9d7e76cda4b9b5e1e31eea080db033396.1550071778.git.robin.murphy@arm.com \
--to=robin.murphy@arm.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®