From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753127AbdEEIUJ (ORCPT ); Fri, 5 May 2017 04:20:09 -0400 Received: from terminus.zytor.com ([65.50.211.136]:39775 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751660AbdEEIUH (ORCPT ); Fri, 5 May 2017 04:20:07 -0400 Date: Fri, 5 May 2017 01:11:16 -0700 From: tip-bot for Baoquan He Message-ID: Cc: peterz@infradead.org, tglx@linutronix.de, linux-kernel@vger.kernel.org, dan.j.williams@intel.com, dyoung@redhat.com, yasu.isimatu@gmail.com, mingo@kernel.org, hpa@zytor.com, jinb.park7@gmail.com, jpoimboe@redhat.com, thgarnie@google.com, dvlasenk@redhat.com, bhe@redhat.com, kirill.shutemov@linux.intel.com, dave.hansen@linux.intel.com, akpm@linux-foundation.org, luto@kernel.org, yinghai@kernel.org, jmoyer@redhat.com, brgerst@gmail.com, keescook@chromium.org, torvalds@linux-foundation.org, bp@alien8.de Reply-To: dan.j.williams@intel.com, dyoung@redhat.com, peterz@infradead.org, tglx@linutronix.de, linux-kernel@vger.kernel.org, hpa@zytor.com, jinb.park7@gmail.com, jpoimboe@redhat.com, mingo@kernel.org, yasu.isimatu@gmail.com, akpm@linux-foundation.org, jmoyer@redhat.com, yinghai@kernel.org, luto@kernel.org, kirill.shutemov@linux.intel.com, dave.hansen@linux.intel.com, thgarnie@google.com, bhe@redhat.com, dvlasenk@redhat.com, bp@alien8.de, brgerst@gmail.com, torvalds@linux-foundation.org, keescook@chromium.org In-Reply-To: <1493864747-8506-1-git-send-email-bhe@redhat.com> References: <1493864747-8506-1-git-send-email-bhe@redhat.com> To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/urgent] x86/mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds() Git-Commit-ID: fc5f9d5f151c9fff21d3d1d2907b888a5aec3ff7 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: fc5f9d5f151c9fff21d3d1d2907b888a5aec3ff7 Gitweb: http://git.kernel.org/tip/fc5f9d5f151c9fff21d3d1d2907b888a5aec3ff7 Author: Baoquan He AuthorDate: Thu, 4 May 2017 10:25:47 +0800 Committer: Ingo Molnar CommitDate: Fri, 5 May 2017 08:21:24 +0200 x86/mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds() Jeff Moyer reported that on his system with two memory regions 0~64G and 1T~1T+192G, and kernel option "memmap=192G!1024G" added, enabling KASLR will make the system hang intermittently during boot. While adding 'nokaslr' won't. The back trace is: Oops: 0000 [#1] SMP RIP: memcpy_erms() [ .... ] Call Trace: pmem_rw_page() bdev_read_page() do_mpage_readpage() mpage_readpages() blkdev_readpages() __do_page_cache_readahead() force_page_cache_readahead() page_cache_sync_readahead() generic_file_read_iter() blkdev_read_iter() __vfs_read() vfs_read() SyS_read() entry_SYSCALL_64_fastpath() This crash happens because the for loop count calculation in sync_global_pgds() is not correct. When a mapping area crosses PGD entries, we should calculate the starting address of region which next PGD covers and assign it to next for loop count, but not add PGDIR_SIZE directly. The old code works right only if the mapping area is an exact multiple of PGDIR_SIZE, otherwize the end region could be skipped so that it can't be synchronized to all other processes from kernel PGD init_mm.pgd. In Jeff's system, emulated pmem area [1024G, 1216G) is smaller than PGDIR_SIZE. While 'nokaslr' works because PAGE_OFFSET is 1T aligned, it makes this area be mapped inside one PGD entry. With KASLR enabled, this area could cross two PGD entries, then the next PGD entry won't be synced to all other processes. That is why we saw empty PGD. Fix it. Reported-by: Jeff Moyer Signed-off-by: Baoquan He Cc: Andrew Morton Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Dan Williams Cc: Dave Hansen Cc: Dave Young Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Jinbum Park Cc: Josh Poimboeuf Cc: Kees Cook Cc: Kirill A. Shutemov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Garnier Cc: Thomas Gleixner Cc: Yasuaki Ishimatsu Cc: Yinghai Lu Link: http://lkml.kernel.org/r/1493864747-8506-1-git-send-email-bhe@redhat.com Signed-off-by: Ingo Molnar --- arch/x86/mm/init_64.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c index 745e5e1..97fe887 100644 --- a/arch/x86/mm/init_64.c +++ b/arch/x86/mm/init_64.c @@ -94,10 +94,10 @@ __setup("noexec32=", nonx32_setup); */ void sync_global_pgds(unsigned long start, unsigned long end) { - unsigned long address; + unsigned long addr; - for (address = start; address <= end; address += PGDIR_SIZE) { - pgd_t *pgd_ref = pgd_offset_k(address); + for (addr = start; addr <= end; addr = ALIGN(addr + 1, PGDIR_SIZE)) { + pgd_t *pgd_ref = pgd_offset_k(addr); const p4d_t *p4d_ref; struct page *page; @@ -106,7 +106,7 @@ void sync_global_pgds(unsigned long start, unsigned long end) * handle synchonization on p4d level. */ BUILD_BUG_ON(pgd_none(*pgd_ref)); - p4d_ref = p4d_offset(pgd_ref, address); + p4d_ref = p4d_offset(pgd_ref, addr); if (p4d_none(*p4d_ref)) continue; @@ -117,8 +117,8 @@ void sync_global_pgds(unsigned long start, unsigned long end) p4d_t *p4d; spinlock_t *pgt_lock; - pgd = (pgd_t *)page_address(page) + pgd_index(address); - p4d = p4d_offset(pgd, address); + pgd = (pgd_t *)page_address(page) + pgd_index(addr); + p4d = p4d_offset(pgd, addr); /* the pgt_lock only for Xen */ pgt_lock = &pgd_page_get_mm(page)->page_table_lock; spin_lock(pgt_lock);