linux-kernel - [PATCH 2/2] drivers/base/node.c: skip non-present sections in register_mem_sect_under

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 27 Aug 2015 16:43:50 +0200
From:	Jan Stancek <jstancek@...hat.com>
To:	gregkh@...uxfoundation.org, linux-kernel@...r.kernel.org
Cc:	jstancek@...hat.com
Subject: [PATCH 2/2] drivers/base/node.c: skip non-present sections in register_mem_sect_under_node

Skip non-present sections in mem_blk to avoid crashing during boot
at register_mem_sect_under_node()->get_nid_for_pfn():

  Unable to handle kernel paging request for data at address 0xf000000000080020
  Faulting instruction address: 0xc00000000866b480
  Oops: Kernel access of bad area, sig: 11 [#1]
  SMP NR_CPUS=2048 NUMA pSeries
  Modules linked in:
  CPU: 14 PID: 1 Comm: swapper/14 Not tainted 4.2.0-rc8+ #6
  task: c00000001e480000 ti: c00000001e500000 task.ti: c00000001e500000
  NIP: c00000000866b480 LR: c00000000851aecc CTR: 0000000000000400
  ...
  NIP [c00000000866b480] get_nid_for_pfn+0x10/0x30
  LR [c00000000851aecc] register_mem_sect_under_node+0x9c/0x190
  Call Trace:
  [c00000001e503b10] [c0000000084f89a4] put_device+0x24/0x40 (unreliable)
  [c00000001e503b60] [c00000000851b3d4] register_one_node+0x2b4/0x390
  [c00000001e503bc0] [c000000008ae7a50] topology_init+0x4c/0x1e8
  [c00000001e503c30] [c00000000800b3bc] do_one_initcall+0x10c/0x260
  [c00000001e503d00] [c000000008ae41b4] kernel_init_freeable+0x27c/0x364
  [c00000001e503dc0] [c00000000800bc14] kernel_init+0x24/0x130
  [c00000001e503e30] [c000000008009530] ret_from_kernel_thread+0x5c/0xac
  Instruction dump:
  4e800020 60000000 60000000 60420000 3b80ffed 4bffffc8 00000000 00000000
  3920ffff 78633664 792900c4 7d434a14 <e94a0020> 2faa0000 41de0010 7c63482a
  ---[ end trace e9ab4a173e0cee14 ]---

This has been observed during kdump kernel boot on ppc64le KVM guest
(page size: 65536, sections_per_block: 16, PAGES_PER_SECTION: 256)
where kdump adds "rtas" to list of usable regions:
  # hexdump -C /sys/firmware/devicetree/base/rtas/linux,rtas-base
  00000000  2f ff 00 00                                       |/...|

[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000001fffffff]
[    0.000000]   node   0: [mem 0x000000002fff0000-0x000000002fffffff]

Crash happens when register_mem_sect_under_node goes over mem_blk that
spans sections 32-47, 32-46 are not present, 47 is present:
  32 * 256 * 65536 == 0x20000000
  47 * 256 * 65536 == 0x2f000000
It tries to access page for first pfn of this mem_blk (8192 == 32 * 256)
and crashes.

Signed-off-by: Jan Stancek <jstancek@...hat.com>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
---
 drivers/base/node.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/base/node.c b/drivers/base/node.c
index 4c7423a4b5f4..e638cfde7486 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -390,6 +390,9 @@ int register_mem_sect_under_node(struct memory_block *mem_blk, int nid)
 		sect_no <= mem_blk->end_section_nr;
 		sect_no++) {
 
+		if (!present_section_nr(sect_no))
+			continue;
+
 		sect_start_pfn = section_nr_to_pfn(sect_no);
 		sect_end_pfn = sect_start_pfn + PAGES_PER_SECTION - 1;
 
-- 
1.8.3.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/