linux-kernel - memory corruption, possibly caused by i915

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:	Wed, 2 Jan 2013 10:52:33 -0500
From:	Dave Jones <davej@...hat.com>
To:	Linux Kernel <linux-kernel@...r.kernel.org>
Cc:	Daniel Vetter <daniel.vetter@...ll.ch>,
	Chris Mason <chris.mason@...ionio.com>
Subject: memory corruption, possibly caused by i915

We've had a increased number of reports in the last six months or so
from Fedora users getting corrupted page tables.
At first I wrote it off to bad hardware, but they started happening frequently
enough that I began to wonder if it was a real problem.

The only common thing I could think of was that now that gnome-shell is
our default desktop, we're making a lot more use of DRI than we used to.

To test a hypothesis, I played a whole lot of quake3 over the holidays,
and was finally able to make it happen too.

After playing the game for a few hours, I exited it, and all was well.
But when I then went to shut down the laptop, I saw this..

[52460.280346] BUG: Bad page map in process panel-6-systray  pte:ffff8800b665a0e8 pmd:b6659067
[52460.280848] addr:00000038bf3fd000 vm_flags:00000070 anon_vma:          (null) mapping:ffff88011052fd98 index:1fd
[52460.281547] vma->vm_ops->fault: filemap_fault+0x0/0x470
[52460.281878] vma->vm_file->f_op->mmap: btrfs_file_mmap+0x0/0x60 [btrfs]
[52460.282286] Modules linked in: iptable_mangle bridge stp llc ip6table_filter ip6_tables dm_crypt xfs snd_hda_codec_hdmi arc4 iwldvm mac80211 c
oretemp crc32c_intel snd_hda_codec_realtek ghash_clmulni_intel snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm iwlwifi thinkpad_acpi snd_page_alloc btusb 
iTCO_wdt microcode tpm_tis vhost_net iTCO_vendor_support cfg80211 snd_timer bluetooth snd e1000e tpm pcspkr tun macvtap lpc_ich soundcore tpm_bios rfkill wmi hwmon mfd_core me
i macvlan kvm_intel kvm nfsd auth_rpcgss nfs_acl lockd sunrpc btrfs libcrc32c zlib_deflate i915 i2c_algo_bit drm_kms_helper drm sdhci_pci sdhci led_class mmc_core i2c_core vid
eo
[52460.286556] Pid: 1317, comm: panel-6-systray Not tainted 3.7.0+ #15
[52460.286926] Call Trace:
[52460.287086]  [<ffffffff8114c662>] print_bad_pte+0x1e2/0x250
[52460.287445]  [<ffffffff8114ea1d>] unmap_single_vma+0x5dd/0x8a0
[52460.287804]  [<ffffffff8114f541>] unmap_vmas+0x51/0xa0
[52460.288087]  [<ffffffff81158628>] exit_mmap+0x98/0x170
[52460.288388]  [<ffffffff81047808>] mmput+0x78/0xe0
[52460.288651]  [<ffffffff8104ffae>] do_exit+0x24e/0xa30
[52460.288944]  [<ffffffff8119394e>] ? ____fput+0xe/0x10
[52460.289268]  [<ffffffff8106af3c>] ? task_work_run+0xac/0xe0
[52460.289608]  [<ffffffff8105081f>] do_group_exit+0x3f/0xa0
[52460.289937]  [<ffffffff81050897>] sys_exit_group+0x17/0x20
[52460.290288]  [<ffffffff815f5699>] system_call_fastpath+0x16/0x1b
[52460.290652] Disabling lock debugging due to kernel taint
[52460.290972] BUG: Bad page map in process panel-6-systray  pte:ffffffff81033f52 pmd:b6659067
[52460.291477] addr:00000038bf3fe000 vm_flags:00000070 anon_vma:          (null) mapping:ffff88011052fd98 index:1fe
[52460.292083] vma->vm_ops->fault: filemap_fault+0x0/0x470
[52460.292427] vma->vm_file->f_op->mmap: btrfs_file_mmap+0x0/0x60 [btrfs]
[52460.292816] Modules linked in: iptable_mangle bridge stp llc ip6table_filter ip6_tables dm_crypt xfs snd_hda_codec_hdmi arc4 iwldvm mac80211 c
oretemp crc32c_intel snd_hda_codec_realtek ghash_clmulni_intel snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm iwlwifi thinkpad_acpi snd_page_alloc btusb 
iTCO_wdt microcode tpm_tis vhost_net iTCO_vendor_support cfg80211 snd_timer bluetooth snd e1000e tpm pcspkr tun macvtap lpc_ich soundcore tpm_bios rfkill wmi hwmon mfd_core me
i macvlan kvm_intel kvm nfsd auth_rpcgss nfs_acl lockd sunrpc btrfs libcrc32c zlib_deflate i915 i2c_algo_bit drm_kms_helper drm sdhci_pci sdhci led_class mmc_core i2c_core vid
eo
[52460.297010] Pid: 1317, comm: panel-6-systray Tainted: G    B        3.7.0+ #15
[52460.297455] Call Trace:
[52460.297617]  [<ffffffff8114c662>] print_bad_pte+0x1e2/0x250
[52460.297954]  [<ffffffff81033f52>] ? __change_page_attr_set_clr+0x772/0xc00
[52460.298383]  [<ffffffff81033f52>] ? __change_page_attr_set_clr+0x772/0xc00
[52460.298796]  [<ffffffff8114db8d>] vm_normal_page+0x6d/0x90
[52460.299143]  [<ffffffff8114e90f>] unmap_single_vma+0x4cf/0x8a0
[52460.299497]  [<ffffffff8114f541>] unmap_vmas+0x51/0xa0
[52460.299810]  [<ffffffff81158628>] exit_mmap+0x98/0x170
[52460.300142]  [<ffffffff81047808>] mmput+0x78/0xe0
[52460.300432]  [<ffffffff8104ffae>] do_exit+0x24e/0xa30
[52460.300738]  [<ffffffff8119394e>] ? ____fput+0xe/0x10
[52460.301041]  [<ffffffff8106af3c>] ? task_work_run+0xac/0xe0
[52460.301363]  [<ffffffff8105081f>] do_group_exit+0x3f/0xa0
[52460.301669]  [<ffffffff81050897>] sys_exit_group+0x17/0x20
[52460.301974]  [<ffffffff815f5699>] system_call_fastpath+0x16/0x1b


It's falling over in btrfs's mmap op, but I think it's just the victim here,
of something else corrupting what had been mmaped in the panel process.

Daniel, can you think of additional sanity checks that could be added to
the i915 driver ? (Even if at the expense of speed: a CONFIG_DEBUG option
to prove correctness would be very worthwhile imo)

	Dave

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/