From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756696AbdKGJk0 (ORCPT ); Tue, 7 Nov 2017 04:40:26 -0500 Received: from mailout4.samsung.com ([203.254.224.34]:11050 "EHLO mailout4.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755877AbdKGJjy (ORCPT ); Tue, 7 Nov 2017 04:39:54 -0500 DKIM-Filter: OpenDKIM Filter v2.11.0 mailout4.samsung.com 20171107093948epoutp041cfe196153d752ccb16705b8654b06be~0xEf5jXds0049900499epoutp04v X-AuditID: b6c32a48-905ff7000000103e-c8-5a017f640612 From: Jaewon Kim To: akpm@linux-foundation.org Cc: mhocko@suse.com, vbabka@suse.cz, minchan@kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, jaewon31.kim@gmail.com, Jaewon Kim Subject: [PATCH] mm: page_ext: check if page_ext is not prepared Date: Tue, 07 Nov 2017 18:41:31 +0900 Message-id: <20171107094131.14621-1-jaewon31.kim@samsung.com> X-Mailer: git-send-email 2.13.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrAKsWRmVeSWpSXmKPExsWy7bCmuW5KPWOUwYSHrBZz1q9hs+jePJPR ovf9KyaLy7vmsFncW/Of1eJ+n4PFsq/v2S1mN/YxOnB47Jx1l91j06pONo9Nnyaxe5yY8ZvF o2/LKkaP9VuusnicWXCE3ePzJrkAjqhUm4zUxJTUIoXUvOT8lMy8dFsl7+B453hTMwNDXUNL C3MlhbzE3FRbJRefAF23zBygy5QUyhJzSoFCAYnFxUr6djZF+aUlqQoZ+cUltkrRhoZGeoYG 5npGRkZ6JuaxVkamQCUJqRnv+96wFXyXqmjbOYe9gfGYWBcjB4eEgInE3EbpLkYuDiGBHYwS 1+afZIJwvjNK3Hx5hrmLkROsqPHqNxaIxAZGiZ8T57JCOP8ZJd59+skCUsUmoC3xfsEkVhBb REBWYurf82AdzAJrGCWe7H4ElhAWcJBYu3kXWAOLgKrEpqcvwFbwCthKPH2+mwVinbzElV/9 YM0SAhPYJDY/6WaDSLhI3Lm3hwnCFpZ4dXwLO4QtLfFs1UZGiIZuRomejeuhijqAnAeZELax xKfPnxlBbGYBPomOw3/ZISHAK9HRJgRR4iGxfHsL1M+OEvN2LwYbIyQQK/FkfhfzBEbJBYwM qxjFUguKc9NTi40KTPSKE3OLS/PS9ZLzczcxglOLlscOxgPnfA4xCnAwKvHwzjjIECXEmlhW XJl7iFGCg1lJhHe7OlCINyWxsiq1KD++qDQntfgQoykwPCYyS4km5wPTXl5JvKGJpYGJmZmh uZGpgbmSOG/dtmsRQgLpiSWp2ampBalFMH1MHJxSDYy9TmUzuB8YzTxQcNc0ca7N+7utdSd2 3FOdJuEXoVec7btT7/VN7d7bik2fnbg7D/heOzDN7/TSf8qsPu/mc/FZRutz9Zv932d0/frb Vx/NEo6ekbt55/Cd9pbipquTf0e4uQjKz9FPYP7QdfTDrxvXHe4F6XQs7lr9QKfidUGS/vpj 4jefMIoosRRnJBpqMRcVJwIAKevEtkMDAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupgluLIzCtJLcpLzFFi42I5/e+xoG5yPWOUwZw5ehZz1q9hs+jePJPR ovf9KyaLy7vmsFncW/Of1eJ+n4PFsq/v2S1mN/YxOnB47Jx1l91j06pONo9Nnyaxe5yY8ZvF o2/LKkaP9VuusnicWXCE3ePzJrkAjigum5TUnMyy1CJ9uwSujPd9b9gKvktVtO2cw97AeEys i5GTQ0LARKLx6jeWLkYuDiGBdYwSh3peM0I4jUwSJ3/dZwWpYhPQlni/YBKYLSIgKzH173mw DmaBNYwS8xvuMoEkhAUcJNZu3sUCYrMIqEpsevqCGcTmFbCVePp8NwvEOnmJK7/6WSYwci1g ZFjFKJlaUJybnltsVGCUl1quV5yYW1yal66XnJ+7iREYPtsOa/XvYHy8JP4QowAHoxIP74yD DFFCrIllxZW5hxglOJiVRHi3qwOFeFMSK6tSi/Lji0pzUosPMUpzsCiJ8/LnH4sUEkhPLEnN Tk0tSC2CyTJxcEo1MG5/q7pIxf7UfIN9lxc7ZZaJL77sGNnwYHXyWal5DMYnJ9Q1/ZzxtUH7 l4bCdebcP6obr1/MilU/H/Gn+17ojtR2rZcbOqWmWVx6x7dG6U1AefcpjTkveiLXK4pWTYuc aHz5p4NJhlTiojsdLx5/167/fqnye+g/S5OndWuS2mcWdr23sck46KjEUpyRaKjFXFScCACG VDaMGwIAAA== X-CMS-MailID: 20171107093947epcas2p3d449dd14d11907cd29df7be7984d90f0 X-Msg-Generator: CA CMS-TYPE: 102P DLP-Filter: Pass X-CFilter-Loop: Reflected X-CMS-RootMailID: 20171107093947epcas2p3d449dd14d11907cd29df7be7984d90f0 X-RootMTR: 20171107093947epcas2p3d449dd14d11907cd29df7be7984d90f0 References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org online_page_ext and page_ext_init allocate page_ext for each section, but they do not allocate if the first PFN is !pfn_present(pfn) or !pfn_valid(pfn). Then section->page_ext remains as NULL. lookup_page_ext checks NULL only if CONFIG_DEBUG_VM is enabled. For a valid PFN, __set_page_owner will try to get page_ext through lookup_page_ext. Without CONFIG_DEBUG_VM lookup_page_ext will misuse NULL pointer as value 0. This incurrs invalid address access. This is the panic example when PFN 0x100000 is not valid but PFN 0x13FC00 is being used for page_ext. section->page_ext is NULL, get_entry returned invalid page_ext address as 0x1DFA000 for a PFN 0x13FC00. To avoid this panic, CONFIG_DEBUG_VM should be removed so that page_ext will be checked at all times. <1>[ 11.618085] Unable to handle kernel paging request at virtual address 01dfa014 <1>[ 11.618140] pgd = ffffffc0c6dc9000 <1>[ 11.618174] [01dfa014] *pgd=0000000000000000, *pud=0000000000000000 <4>[ 11.618240] ------------[ cut here ]------------ <2>[ 11.618278] Kernel BUG at ffffff80082371e0 [verbose debug info unavailable] <0>[ 11.618338] Internal error: Oops: 96000045 [#1] PREEMPT SMP <4>[ 11.618381] Modules linked in: <4>[ 11.618524] task: ffffffc0c6ec9180 task.stack: ffffffc0c6f40000 <4>[ 11.618569] PC is at __set_page_owner+0x48/0x78 <4>[ 11.618607] LR is at __set_page_owner+0x44/0x78 <4>[ 11.626025] [] __set_page_owner+0x48/0x78 <4>[ 11.626071] [] get_page_from_freelist+0x880/0x8e8 <4>[ 11.626118] [] __alloc_pages_nodemask+0x14c/0xc48 <4>[ 11.626165] [] __do_page_cache_readahead+0xdc/0x264 <4>[ 11.626214] [] filemap_fault+0x2ac/0x550 <4>[ 11.626259] [] ext4_filemap_fault+0x3c/0x58 <4>[ 11.626305] [] __do_fault+0x80/0x120 <4>[ 11.626347] [] handle_mm_fault+0x704/0xbb0 <4>[ 11.626393] [] do_page_fault+0x2e8/0x394 <4>[ 11.626437] [] do_mem_abort+0x88/0x124 Signed-off-by: Jaewon Kim --- mm/page_ext.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/mm/page_ext.c b/mm/page_ext.c index 32f18911deda..114a4d3dcc3c 100644 --- a/mm/page_ext.c +++ b/mm/page_ext.c @@ -124,7 +124,6 @@ struct page_ext *lookup_page_ext(struct page *page) struct page_ext *base; base = NODE_DATA(page_to_nid(page))->node_page_ext; -#if defined(CONFIG_DEBUG_VM) /* * The sanity checks the page allocator does upon freeing a * page can reach here before the page_ext arrays are @@ -133,7 +132,6 @@ struct page_ext *lookup_page_ext(struct page *page) */ if (unlikely(!base)) return NULL; -#endif index = pfn - round_down(node_start_pfn(page_to_nid(page)), MAX_ORDER_NR_PAGES); return get_entry(base, index); @@ -198,7 +196,6 @@ struct page_ext *lookup_page_ext(struct page *page) { unsigned long pfn = page_to_pfn(page); struct mem_section *section = __pfn_to_section(pfn); -#if defined(CONFIG_DEBUG_VM) /* * The sanity checks the page allocator does upon freeing a * page can reach here before the page_ext arrays are @@ -207,7 +204,6 @@ struct page_ext *lookup_page_ext(struct page *page) */ if (!section->page_ext) return NULL; -#endif return get_entry(section->page_ext, pfn); } -- 2.13.0