[PATCH RFC 0/4] crash_dump: recover from machine checks in copy_oldmem_page()

[PATCH RFC 0/4] crash_dump: recover from machine checks in copy_oldmem_page()

[Christian Brauner]

A capture kernel reads the memory of the crashed kernel. That memory
may have uncorrectable errors in it. Which is likely also what murdered
the first kernel.

On x86 a machine check in the copy that /proc/vmcore does out of an old
page panics the capture kernel. On book3s64 the read() comes up short
and splice() panics. Breno has observed that on a fleet iiuc. The first
kernel dies of a machine check and then there's no vmcore either.

I had the powerpc half of this as a fix in part 1 of the procfs series
because Chris ran into it there. Breno pointed out that x86 has the same
hole.

I think that likely makes this a kdump problem and not a procfs problem.
So I moved this out together with the ioremap_cache() fix.

The first two patches make powerpc's and sh's copy_oldmem_page() check
whether mapping the old page worked.

Every architecture that maps a page of the old kernel copies it out with
copy_to_iter(). The third patch puts that copy into a new
copy_oldmem_to_iter() helper. It's just copy_to_iter() with
_copy_mc_to_iter() underneath.

On x86_64 (and book3s64 - whatever that is) that's the machine check
safe copy and the machine check turns into a short read and -EFAULT.
Everywhere else it's copy_to_iter() under another name.

I then convert the remaining architectures so the copy lives in one
place and any new architecture with ARCH_HAS_COPY_MC later gets this for
free.

I reproduced the x86 panic in a kdump VM by injecting a machine check
into the copy. Without it the capture kernel is gone, with it the read()
fails with EFAULT and the kernel logs the event and keeps going.

The helper is a static inline in crash_dump.h and that pulls uio.h into
it. If people would rather have it out of line it can go into
kernel/crash_core.c, which builds for CRASH_DUMP just like the arch
crash_dump.c files do.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
Christian Brauner (4):
      powerpc/crash_dump: check ioremap_cache() in copy_oldmem_page()
      sh/crash_dump: check ioremap() in copy_oldmem_page()
      crash_dump: recover from a machine check in copy_oldmem_page()
      crash_dump: use copy_oldmem_to_iter() everywhere

 arch/arm/kernel/crash_dump.c       |  2 +-
 arch/arm64/kernel/crash_dump.c     |  2 +-
 arch/loongarch/kernel/crash_dump.c |  2 +-
 arch/mips/kernel/crash_dump.c      |  2 +-
 arch/powerpc/kernel/crash_dump.c   |  6 ++++--
 arch/riscv/kernel/crash_dump.c     |  2 +-
 arch/sh/kernel/crash_dump.c        |  5 ++++-
 arch/x86/kernel/crash_dump_32.c    |  2 +-
 arch/x86/kernel/crash_dump_64.c    |  2 +-
 include/linux/crash_dump.h         | 22 ++++++++++++++++++++++
 10 files changed, 37 insertions(+), 10 deletions(-)
---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261112-work-procfs-oldmem-9e80c2ebab7b

[PATCH RFC 1/4] powerpc/crash_dump: check ioremap_cache() in copy_oldmem_page()

[Christian Brauner]

copy_oldmem_page() maps a page of the old kernel that isn't in the
linear mapping with ioremap_cache() and copies from it without checking
whether the mapping worked. If it didn't, the copy reads from an offset
into the NULL page. That oopses unless the copy happens to be a user
copy, whose exception table entries turn the fault into a short copy.

Return -ENOMEM like the other architectures do. read_from_oldmem()
turns that into -EFAULT like any other short copy.

Reported-by: Chris Mason <mason@kernel.org>
Fixes: 54c32021eb6f ("[PATCH] powerpc: Add arch-dependent copy_oldmem_page")
Cc: stable@vger.kernel.org
Reviewed-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
 arch/powerpc/kernel/crash_dump.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/powerpc/kernel/crash_dump.c b/arch/powerpc/kernel/crash_dump.c
index 103b6605dd68f..1543917bd3e1d 100644
--- a/arch/powerpc/kernel/crash_dump.c
+++ b/arch/powerpc/kernel/crash_dump.c
@@ -86,6 +86,8 @@ ssize_t copy_oldmem_page(struct iov_iter *iter, unsigned long pfn,
 		csize = copy_to_iter(vaddr + offset, csize, iter);
 	} else {
 		vaddr = ioremap_cache(paddr, PAGE_SIZE);
+		if (!vaddr)
+			return -ENOMEM;
 		csize = copy_to_iter(vaddr + offset, csize, iter);
 		iounmap(vaddr);
 	}

-- 
2.53.0

[PATCH RFC 2/4] sh/crash_dump: check ioremap() in copy_oldmem_page()

[Christian Brauner]

copy_oldmem_page() maps a page of the old kernel with ioremap() and
copies from it without checking whether the mapping worked. If it
didn't, the copy reads from an offset into the NULL page.

Return -ENOMEM like the other architectures do. read_from_oldmem() turns
that into -EFAULT like any other short copy.

Fixes: 4d5ade5b29c6 ("sh: kdump support.")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
 arch/sh/kernel/crash_dump.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/sh/kernel/crash_dump.c b/arch/sh/kernel/crash_dump.c
index 19ce6a950aaca..85c0e58f1a59f 100644
--- a/arch/sh/kernel/crash_dump.c
+++ b/arch/sh/kernel/crash_dump.c
@@ -20,6 +20,9 @@ ssize_t copy_oldmem_page(struct iov_iter *iter, unsigned long pfn,
 		return 0;
 
 	vaddr = ioremap(pfn << PAGE_SHIFT, PAGE_SIZE);
+	if (!vaddr)
+		return -ENOMEM;
+
 	csize = copy_to_iter(vaddr + offset, csize, iter);
 	iounmap(vaddr);
 

-- 
2.53.0

[PATCH RFC 3/4] crash_dump: recover from a machine check in copy_oldmem_page()

[Christian Brauner]

A capture kernel reads the memory of the crashed kernel, and that memory
may well have uncorrectable errors. That is after all what the first
kernel often died of. Every architecture that maps a page of the old
kernel and copies it out does so with copy_to_iter(), and a machine
check in that copy takes the capture kernel down.

On x86 a machine check in the kernel is only recovered from if the
instruction that took it has a machine check safe exception table entry
or copies from userspace (cf. error_context()). The copy of an old page
is neither. Its source is kernel memory, whether it goes to the buffer
of a read() or, since commit 4a22fd20379c ("vmcore: convert
__read_vmcore to use an iov_iter"), into a kernel page for splice(),
sendfile() and copy_file_range(). So a read of /proc/vmcore that runs
into a poisoned page panics the capture kernel, and so do vmcore's own
reads of the ELF headers and notes. Breno sees the result on a fleet:
the first kernel dies of a machine check and the capture kernel produces
no usable vmcore at all (cf. [1]).

On book3s64 a machine check in the kernel is recovered from if the
instruction that took it has an exception table entry (cf.
mce_common_process_ue()). The user copy has them, so a read() comes up
short there and read_from_oldmem() returns -EFAULT. The copies into
kernel pages have none and panic the same way. Other powerpc platforms
don't recover from a machine check in such a copy at all.

Copy with _copy_mc_to_iter() instead. x86_64 and PPC64 select
ARCH_HAS_COPY_MC, and on x86_64 and book3s64 the machine check safe copy
turns the machine check into a short copy, which read_from_oldmem()
turns into -EFAULT like any other short copy. On x86 that holds for the
fragile and the enhanced fast string variant, a CPU with neither gets
the plain copy it has today. Everywhere else _copy_mc_to_iter() is
_copy_to_iter(). Put the call into a helper, copy_oldmem_to_iter(), so
that the copy of a page of the old kernel lives in one place and an
architecture that gains a machine check safe copy later gets this for
free. The helper does the same check_copy_size() as copy_to_iter(), so
hardened usercopy keeps checking the copy.

With a v7.4-rc1 capture kernel reading /proc/vmcore and a machine check
injected into the copy of an old page the capture kernel is gone. A
machine check panic prints no trace of its own, this one comes from
panic_sys_info=all_bt:

[    0.580568] mce: [Hardware Error]: CPU 0: Machine Check Exception: 7 Bank 1: bd80000000000134
[    0.580574] mce: [Hardware Error]: RIP 10:<ffffffff81909b11> {_copy_to_iter+0x81/0x850}
[    0.580584] mce: [Hardware Error]: TSC 202f2117f ADDR 10000000 MISC 8c
[    0.580587] mce: [Hardware Error]: PROCESSOR 2:aa0f02 TIME 1794493617 SOCKET 0 APIC 0 microcode aa0021c
[    0.580589] mce: [Hardware Error]: Machine check: Uncorrected unrecoverable error in kernel context
[    0.580591] Kernel panic - not syncing: Fatal local machine check
[    0.582587] CPU: 0 UID: 0 PID: 1 Comm: init Not tainted 7.4.0-rc1-g6628e7d4c6b2 #1 PREEMPT(lazy)
[    0.583101] Call Trace:
[    0.583198]  <#MC>
[    0.583279]  dump_stack_lvl+0x4d/0x70
[    0.583419]  nmi_cpu_backtrace.cold+0x18/0x6e
[    0.583584]  ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10
[    0.583772]  nmi_trigger_cpumask_backtrace+0xba/0xf0
[    0.583955]  sys_info+0x83/0xb0
[    0.584075]  vpanic+0x1b4/0x303
[    0.584197]  panic+0x66/0x70
[    0.584488]  mce_panic+0x19e/0x290
[    0.584799]  do_machine_check+0x627/0x9a0
[    0.584953]  ? _copy_to_iter+0x81/0x850
[    0.585099]  exc_machine_check+0x68/0xb0
[    0.585246]  asm_exc_machine_check+0x1e/0x40
[    0.587747]  </#MC>
[    0.587831]  <TASK>
[    0.588092]  ? iomem_map_sanity_check+0x98/0xb0
[    0.588430]  ? __ioremap_caller.isra.0+0x1a9/0x300
[    0.588604]  ? __copy_oldmem_page+0x3d/0xb0
[    0.588928]  __copy_oldmem_page+0x5e/0xb0
[    0.589079]  read_from_oldmem.part.0+0xe3/0x140
[    0.589247]  read_vmcore+0x137/0x280
[    0.589381]  proc_reg_read_iter+0x49/0x90
[    0.589533]  vfs_read+0x348/0x490
[    0.589666]  ksys_read+0x76/0x100
[    0.589792]  do_syscall_64+0xde/0x4b0
[    0.590103]  entry_SYSCALL_64_after_hwframe+0x77/0x7f

With this patch the same injection ends the read() with -EFAULT, the
capture kernel logs the machine check and keeps running.

[1]: https://lore.kernel.org/all/avRXzzCSzT9Qj2FC@gmail.com/

Reported-by: Chris Mason <mason@kernel.org>
Suggested-by: Breno Leitao <leitao@debian.org>
Fixes: 4ae362be5093 ("[PATCH] kdump: read previous kernel's memory")
Fixes: 54c32021eb6f ("[PATCH] powerpc: Add arch-dependent copy_oldmem_page")
Fixes: 4a22fd20379c ("vmcore: convert __read_vmcore to use an iov_iter")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
 arch/powerpc/kernel/crash_dump.c |  4 ++--
 arch/x86/kernel/crash_dump_64.c  |  2 +-
 include/linux/crash_dump.h       | 22 ++++++++++++++++++++++
 3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/kernel/crash_dump.c b/arch/powerpc/kernel/crash_dump.c
index 1543917bd3e1d..f784fc5cb0030 100644
--- a/arch/powerpc/kernel/crash_dump.c
+++ b/arch/powerpc/kernel/crash_dump.c
@@ -83,12 +83,12 @@ ssize_t copy_oldmem_page(struct iov_iter *iter, unsigned long pfn,
 
 	if (memblock_is_region_memory(paddr, csize)) {
 		vaddr = __va(paddr);
-		csize = copy_to_iter(vaddr + offset, csize, iter);
+		csize = copy_oldmem_to_iter(vaddr + offset, csize, iter);
 	} else {
 		vaddr = ioremap_cache(paddr, PAGE_SIZE);
 		if (!vaddr)
 			return -ENOMEM;
-		csize = copy_to_iter(vaddr + offset, csize, iter);
+		csize = copy_oldmem_to_iter(vaddr + offset, csize, iter);
 		iounmap(vaddr);
 	}
 
diff --git a/arch/x86/kernel/crash_dump_64.c b/arch/x86/kernel/crash_dump_64.c
index 32d710f7eb84c..e10dada855b70 100644
--- a/arch/x86/kernel/crash_dump_64.c
+++ b/arch/x86/kernel/crash_dump_64.c
@@ -29,7 +29,7 @@ static ssize_t __copy_oldmem_page(struct iov_iter *iter, unsigned long pfn,
 	if (!vaddr)
 		return -ENOMEM;
 
-	csize = copy_to_iter(vaddr + offset, csize, iter);
+	csize = copy_oldmem_to_iter(vaddr + offset, csize, iter);
 
 	iounmap((void __iomem *)vaddr);
 	return csize;
diff --git a/include/linux/crash_dump.h b/include/linux/crash_dump.h
index 8315270e27b7a..12aeaa40c1c94 100644
--- a/include/linux/crash_dump.h
+++ b/include/linux/crash_dump.h
@@ -6,6 +6,7 @@
 #include <linux/proc_fs.h>
 #include <linux/elf.h>
 #include <linux/pgtable.h>
+#include <linux/uio.h>
 #include <uapi/linux/vmcore.h>
 
 /* For IS_ENABLED(CONFIG_CRASH_DUMP) */
@@ -33,6 +34,27 @@ ssize_t copy_oldmem_page(struct iov_iter *i, unsigned long pfn, size_t csize,
 ssize_t copy_oldmem_page_encrypted(struct iov_iter *iter, unsigned long pfn,
 				   size_t csize, unsigned long offset);
 
+/**
+ * copy_oldmem_to_iter - copy from the crashed kernel's memory
+ * @src: where in the mapped page of the crashed kernel to copy from
+ * @count: how many bytes to copy
+ * @iter: where to copy them
+ *
+ * The memory of the crashed kernel may well have uncorrectable errors.
+ * Where the architecture has a machine check safe copy a machine check
+ * in the copy ends it short, like a fault would, instead of taking the
+ * capture kernel down. Everywhere else this is copy_to_iter().
+ *
+ * Return: the number of bytes copied, like copy_to_iter().
+ */
+static inline size_t copy_oldmem_to_iter(const void *src, size_t count,
+					 struct iov_iter *iter)
+{
+	if (check_copy_size(src, count, true))
+		return _copy_mc_to_iter(src, count, iter);
+	return 0;
+}
+
 void vmcore_cleanup(void);
 
 /* Architecture code defines this if there are other possible ELF

-- 
2.53.0

[PATCH RFC 4/4] crash_dump: use copy_oldmem_to_iter() everywhere

[Christian Brauner]

Make the remaining copy_oldmem_page() implementations copy the page of
the crashed kernel with copy_oldmem_to_iter() like x86_64 and powerpc
do. None of these architectures has a machine check safe copy today, so
for them this is copy_to_iter() under another name. But the copy of a
page of the old kernel is in one place now, and an architecture that
gains ARCH_HAS_COPY_MC later gets the recovery without touching its
crash dump code.

s390 stays as it is. It copies the old kernel's memory through its real
address mode window in memcpy_real_iter(), and an uncorrected storage
error is fatal on s390 anyway (cf. s390_handle_damage()).

No functional changes.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
 arch/arm/kernel/crash_dump.c       | 2 +-
 arch/arm64/kernel/crash_dump.c     | 2 +-
 arch/loongarch/kernel/crash_dump.c | 2 +-
 arch/mips/kernel/crash_dump.c      | 2 +-
 arch/riscv/kernel/crash_dump.c     | 2 +-
 arch/sh/kernel/crash_dump.c        | 2 +-
 arch/x86/kernel/crash_dump_32.c    | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/arch/arm/kernel/crash_dump.c b/arch/arm/kernel/crash_dump.c
index 938bd932df9a0..0f2628872b00c 100644
--- a/arch/arm/kernel/crash_dump.c
+++ b/arch/arm/kernel/crash_dump.c
@@ -28,7 +28,7 @@ ssize_t copy_oldmem_page(struct iov_iter *iter, unsigned long pfn,
 	if (!vaddr)
 		return -ENOMEM;
 
-	csize = copy_to_iter(vaddr + offset, csize, iter);
+	csize = copy_oldmem_to_iter(vaddr + offset, csize, iter);
 
 	iounmap(vaddr);
 	return csize;
diff --git a/arch/arm64/kernel/crash_dump.c b/arch/arm64/kernel/crash_dump.c
index 670e4ce818223..c774b3aba107d 100644
--- a/arch/arm64/kernel/crash_dump.c
+++ b/arch/arm64/kernel/crash_dump.c
@@ -24,7 +24,7 @@ ssize_t copy_oldmem_page(struct iov_iter *iter, unsigned long pfn,
 	if (!vaddr)
 		return -ENOMEM;
 
-	csize = copy_to_iter(vaddr + offset, csize, iter);
+	csize = copy_oldmem_to_iter(vaddr + offset, csize, iter);
 
 	memunmap(vaddr);
 
diff --git a/arch/loongarch/kernel/crash_dump.c b/arch/loongarch/kernel/crash_dump.c
index e559307c10929..03a136b8be8da 100644
--- a/arch/loongarch/kernel/crash_dump.c
+++ b/arch/loongarch/kernel/crash_dump.c
@@ -15,7 +15,7 @@ ssize_t copy_oldmem_page(struct iov_iter *iter, unsigned long pfn,
 	if (!vaddr)
 		return -ENOMEM;
 
-	csize = copy_to_iter(vaddr + offset, csize, iter);
+	csize = copy_oldmem_to_iter(vaddr + offset, csize, iter);
 
 	memunmap(vaddr);
 
diff --git a/arch/mips/kernel/crash_dump.c b/arch/mips/kernel/crash_dump.c
index 6e50f49024094..078c0d1e8df46 100644
--- a/arch/mips/kernel/crash_dump.c
+++ b/arch/mips/kernel/crash_dump.c
@@ -12,7 +12,7 @@ ssize_t copy_oldmem_page(struct iov_iter *iter, unsigned long pfn,
 		return 0;
 
 	vaddr = kmap_local_pfn(pfn);
-	csize = copy_to_iter(vaddr + offset, csize, iter);
+	csize = copy_oldmem_to_iter(vaddr + offset, csize, iter);
 	kunmap_local(vaddr);
 
 	return csize;
diff --git a/arch/riscv/kernel/crash_dump.c b/arch/riscv/kernel/crash_dump.c
index ea2158cee97b3..0820e3db12603 100644
--- a/arch/riscv/kernel/crash_dump.c
+++ b/arch/riscv/kernel/crash_dump.c
@@ -21,7 +21,7 @@ ssize_t copy_oldmem_page(struct iov_iter *iter, unsigned long pfn,
 	if (!vaddr)
 		return -ENOMEM;
 
-	csize = copy_to_iter(vaddr + offset, csize, iter);
+	csize = copy_oldmem_to_iter(vaddr + offset, csize, iter);
 
 	memunmap(vaddr);
 	return csize;
diff --git a/arch/sh/kernel/crash_dump.c b/arch/sh/kernel/crash_dump.c
index 85c0e58f1a59f..2a5988b6e9d7a 100644
--- a/arch/sh/kernel/crash_dump.c
+++ b/arch/sh/kernel/crash_dump.c
@@ -23,7 +23,7 @@ ssize_t copy_oldmem_page(struct iov_iter *iter, unsigned long pfn,
 	if (!vaddr)
 		return -ENOMEM;
 
-	csize = copy_to_iter(vaddr + offset, csize, iter);
+	csize = copy_oldmem_to_iter(vaddr + offset, csize, iter);
 	iounmap(vaddr);
 
 	return csize;
diff --git a/arch/x86/kernel/crash_dump_32.c b/arch/x86/kernel/crash_dump_32.c
index 5f4ae5476e193..cb202d4e1f703 100644
--- a/arch/x86/kernel/crash_dump_32.c
+++ b/arch/x86/kernel/crash_dump_32.c
@@ -40,7 +40,7 @@ ssize_t copy_oldmem_page(struct iov_iter *iter, unsigned long pfn, size_t csize,
 		return -EFAULT;
 
 	vaddr = kmap_local_pfn(pfn);
-	csize = copy_to_iter(vaddr + offset, csize, iter);
+	csize = copy_oldmem_to_iter(vaddr + offset, csize, iter);
 	kunmap_local(vaddr);
 
 	return csize;

-- 
2.53.0

Re: [PATCH RFC 0/4] crash_dump: recover from machine checks in copy_oldmem_page()

[Christian Brauner]

On Thu, Nov 12, 2026 at 05:37:06PM +0100, Christian Brauner wrote:
> A capture kernel reads the memory of the crashed kernel. That memory
> may have uncorrectable errors in it. Which is likely also what murdered
> the first kernel.
> 
> On x86 a machine check in the copy that /proc/vmcore does out of an old
> page panics the capture kernel. On book3s64 the read() comes up short
> and splice() panics. Breno has observed that on a fleet iiuc. The first
> kernel dies of a machine check and then there's no vmcore either.
> 
> I had the powerpc half of this as a fix in part 1 of the procfs series
> because Chris ran into it there. Breno pointed out that x86 has the same
> hole.
> 
> I think that likely makes this a kdump problem and not a procfs problem.
> So I moved this out together with the ioremap_cache() fix.

So I'm not super familiar with the machine check stuff. I know that
@Linus has some familiarity with this. So I guess a yay or nay would be
nice. Not sure if really a localized fix for the architectures that have
mc support makes more sense. A common helper seems less fragile to me.