From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752117AbdL0SG0 (ORCPT <rfc822;w@1wt.eu>);
        Wed, 27 Dec 2017 13:06:26 -0500
Received: from Galois.linutronix.de ([146.0.238.70]:60312 "EHLO
        Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751781AbdL0SGZ (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 27 Dec 2017 13:06:25 -0500
Date: Wed, 27 Dec 2017 19:05:51 +0100 (CET)
From: Thomas Gleixner <tglx@linutronix.de>
To: kernel test robot <xiaolong.ye@intel.com>
cc: Ingo Molnar <mingo@kernel.org>, Andy Lutomirski <luto@kernel.org>,
        Boris Ostrovsky <boris.ostrovsky@oracle.com>,
        Borislav Petkov <bp@alien8.de>, Brian Gerst <brgerst@gmail.com>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        David Laight <David.Laight@aculab.com>,
        Denys Vlasenko <dvlasenk@redhat.com>,
        Eduardo Valentin <eduval@amazon.com>,
        Greg KH <gregkh@linuxfoundation.org>, "H. Peter Anvin" <hpa@zytor.com>,
        Josh Poimboeuf <jpoimboe@redhat.com>, Juergen Gross <jgross@suse.com>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Peter Zijlstra <peterz@infradead.org>,
        Will Deacon <will.deacon@arm.com>, LKML <linux-kernel@vger.kernel.org>,
        tipbuild@zytor.com, lkp@01.org,
        Andrey Ryabinin <aryabinin@virtuozzo.com>,
        Alexander Potapenko <glider@google.com>,
        Dmitry Vyukov <dvyukov@google.com>, kasan-dev@googlegroups.com
Subject: Re: [lkp-robot] [x86/cpu_entry_area] 10043e02db:
 kernel_BUG_at_arch/x86/mm/physaddr.c
In-Reply-To: <20171226020335.GA3172@yexl-desktop>
Message-ID: <alpine.DEB.2.20.1712271849490.2431@nanos>
References: <20171226020335.GA3172@yexl-desktop>
User-Agent: Alpine 2.20 (DEB 67 2015-01-07)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
X-Linutronix-Spam-Score: -1.0
X-Linutronix-Spam-Level: -
X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required,  ALL_TRUSTED=-1,SHORTCIRCUIT=-0.0001
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, 26 Dec 2017, kernel test robot wrote:

> 
> FYI, we noticed the following commit (built with gcc-6):
> 
> commit: 10043e02db7f8a4161f76434931051e7d797a5f6 ("x86/cpu_entry_area: Add debugstore entries to cpu_entry_area")
> https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git WIP.x86/pti

...

> [    0.000000] kernel BUG at arch/x86/mm/physaddr.c:27!
> PANIC: early exception 0x06 IP 10:ffffffff8115586f error 0 cr2 0xffff88000e468000
> [    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 4.14.0-00160-g10043e02 #1
> [    0.000000] task: ffffffff8a4683c0 task.stack: ffffffff8a400000
> [    0.000000] RIP: 0010:__phys_addr+0x268/0x276
> [    0.000000] RSP: 0000:ffffffff8a407bd8 EFLAGS: 00010002 ORIG_RAX: 0000000000000000
> [    0.000000] RAX: 0000000000000000 RBX: 0000780000000000 RCX: 1ffffffff17a9a01
> [    0.000000] RDX: dffffc0000000000 RSI: 0000000000000003 RDI: ffffffff8bd4d340
> [    0.000000] RBP: ffffffff8a407bf8 R08: 0000000000000001 R09: ffffffff8a407a48
> [    0.000000] R10: ffff880000010000 R11: ffff880000010fff R12: 0000000000000001
> [    0.000000] R13: 0000000000000001 R14: 0000000000000000 R15: fffffbd00c401000
> [    0.000000] FS:  0000000000000000(0000) GS:ffffffff8cb4d000(0000) knlGS:0000000000000000
> [    0.000000] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [    0.000000] CR2: ffff88000e468000 CR3: 000000000cde8000 CR4: 00000000000406b0
> [    0.000000] Call Trace:
> [    0.000000]  kasan_populate_shadow+0x3f2/0x497

So this dies simply because kasan_populate_shadow() runs out of memory and
has no sanity check whatsoever.

static __init void *early_alloc(size_t size, int nid)
{
        return memblock_virt_alloc_try_nid_nopanic(size, size,
                __pa(MAX_DMA_ADDRESS), BOOTMEM_ALLOC_ACCESSIBLE, nid);
}

kasan_populate_pmd()
{
	.....

                p = early_alloc(PAGE_SIZE, nid);
                entry = pfn_pte(PFN_DOWN(__pa(p)), PAGE_KERNEL);

I've instrumented the whole thing and early_alloc() returns NULL at some
point and then __pa(NULL) dies in the VIRTUAL_DEBUG code. Well, it would
die with VIRTUAL_DEBUG=n as well at some other place.

Not really a problem caused by the patch above, it's merily exposing a code
path which relies blindly on "enough memory available" assumptions.

Throwing more memory at the VM makes the problem go away...

Thanks,

	tglx