| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <478B9183.3020101@goop.org>
Date: Mon, 14 Jan 2008 08:44:51 -0800
From: Jeremy Fitzhardinge <jeremy@...p.org>
To: Andi Kleen <andi@...stfloor.org>
CC: Ingo Molnar <mingo@...e.hu>, tglx@...utronix.de,
linux-kernel@...r.kernel.org
Subject: Re: unify pagetable accessors patch causes double fault II
Andi Kleen wrote:
> On Mon, Jan 14, 2008 at 02:06:20PM +0100, Ingo Molnar wrote:
>
>> * Andi Kleen <andi@...stfloor.org> wrote:
>>
>>
>>> Subject was wrong of course -- it was a recursive oops, not a double
>>> fault. Sorry for the inaccuracy.
>>>
>>> Hopefully it can be fixed soon because it inhibits further testing
>>> here.
>>>
>> no context. Your first mail did not seem to make it to lkml. (yet)
>>
>
> Sorry. Not sure what happened. Here is it again:
>
> ----
>
> This is as of 2f42671697ea9abc7d10ea7f663d6ef6e8ec6358 git-x86 HEAD:
>
> One of my test machines here when booted with git-x86 gives a double
> fault on entering user space. I bisected it down to the following commit.
>
> commit c64ba9309275f2e89bd18adbe4d932b6ecc7eb07
> Author: Jeremy Fitzhardinge <jeremy@...p.org>
> Date: Fri Jan 11 18:11:41 2008 +0100
>
> x86/pgtable: unify pagetable accessors
>
> Unify functions to test and set bits in pagetable entries.
>
> This is with PAE and seems to only happen with enough RAM (6GB);
> a 2GB system boots. 64bit also works.
>
Thanks, I'll have a close look at it. Presumably a pfn is getting
truncated to 20/32-bits somewhere.
J
> -Andi
>
> VFS: Mounted root (nfs filesystem).
> Freeing unused kernel memory: 260k freed
> boot[1151]: segfault at 00000000 ip 00000000 sp bfe5c1fc error 14
> Bad page state in process 'boot'
> page:c27f8000 flags:0x80080010 mapping:00000000 mapcount:0 count:0
> Trying to fix it up, but a reboot is needed
> Backtrace:
> Pid: 1151, comm: boot Not tainted 2.6.24-rc7-gc64ba930 #10
> [<c01474eb>] bad_page+0x48/0x6f
> [<c01478de>] free_hot_cold_page+0x5b/0x148
> [<c01479e3>] __pagevec_free+0x18/0x22
> [<c014a03d>] release_pages+0x13f/0x147
> [<c0151191>] free_pgtables+0x86/0x93
> [<c01568bb>] free_pages_and_swap_cache+0x6a/0x7e
> [<c01521e1>] exit_mmap+0xa2/0xcd
> [<c011fece>] mmput+0x25/0x79
> [<c01245fa>] do_exit+0x1a9/0x5eb
> [<c0124aa7>] sys_exit_group+0x0/0xd
> [<c012bda2>] get_signal_to_deliver+0x3e3/0x405
> [<c043577c>] do_page_fault+0x0/0x6a4
> [<c01043de>] do_notify_resume+0x7d/0x64e
> [<c0122346>] printk+0x14/0x18
> [<c0435b3a>] do_page_fault+0x3be/0x6a4
> [<c0435e17>] do_page_fault+0x69b/0x6a4
> [<c043577c>] do_page_fault+0x0/0x6a4
> [<c0104d26>] work_notifysig+0x13/0x19
> =======================
> Bad page state in process 'boot'
> page:c27f8120 flags:0x80000000 mapping:00000000 mapcount:1 count:1
> Trying to fix it up, but a reboot is needed
> Backtrace:
> Pid: 1153, comm: boot Tainted: G B 2.6.24-rc7-gc64ba930 #10
> [<c01474eb>] bad_page+0x48/0x6f
> [<c0147f27>] get_page_from_freelist+0x242/0x30f
> [<c014807f>] __alloc_pages+0x67/0x2c5
> [<c014e9b5>] do_wp_page+0x20e/0x494
> [<c0150ac2>] handle_mm_fault+0x6c1/0x75a
> [<c0435a2b>] do_page_fault+0x2af/0x6a4
> [<c043577c>] do_page_fault+0x0/0x6a4
> [<c043455a>] error_code+0x72/0x78
> [<c02122aa>] __put_user_4+0x12/0x18
> [<c011e09c>] schedule_tail+0x52/0x55
> [<c0104b6e>] ret_from_fork+0x6/0x1c
> =======================
> boot[1153]: segfault at 0574c985 ip b7d9488a sp bfe5bfd8 error 6
> Eeek! page_mapcount(page) went negative! (-1)
> page pfn = bfc09
> page->flags = 80000060
> page->count = 1
> page->mapping = f702d091
> vma->vm_ops = 0x0
> ------------[ cut here ]------------
> kernel BUG at /home/lsrc/git-arch-x86/linux-2.6-x86/mm/rmap.c:631!
> invalid opcode: 0000 [#1] SMP
> Modules linked in:
>
> Pid: 1153, comm: boot Tainted: G B (2.6.24-rc7-gc64ba930 #10)
> EIP: 0060:[<c0154bd6>] EFLAGS: 00010246 CPU: 2
> EIP is at page_remove_rmap+0xcc/0xe7
> EAX: 00000000 EBX: c27f8120 ECX: 00000046 EDX: 00000046
> ESI: f7074948 EDI: c27f8120 EBP: f7078198 ESP: f709ddfc
> DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
> Process boot (pid: 1153, ti=f709c000 task=f7460000 task.ti=f709c000)
> Stack: bfc09045 00000000 c014f18f 00000000 f7074948 f709de80 bfc09045 00000000
> 00000000 00000001 b7e37000 f7070010 f70468c0 c4825240 ffffffff 00000000
> c16e0f0c 00000000 f70aadf8 003f9ed9 b7e37000 b7e37000 00000000 b7e33000
> Call Trace:
> [<c014f18f>] unmap_vmas+0x334/0x5c9
> [<c015219e>] exit_mmap+0x5f/0xcd
> [<c011fece>] mmput+0x25/0x79
> [<c01245fa>] do_exit+0x1a9/0x5eb
> [<c0124aa7>] sys_exit_group+0x0/0xd
> [<c012bda2>] get_signal_to_deliver+0x3e3/0x405
> [<c043577c>] do_page_fault+0x0/0x6a4
> [<c01043de>] do_notify_resume+0x7d/0x64e
> [<c0122346>] printk+0x14/0x18
> [<c0435b3a>] do_page_fault+0x3be/0x6a4
> [<c0435e17>] do_page_fault+0x69b/0x6a4
> [<c043577c>] do_page_fault+0x0/0x6a4
> [<c0104d26>] work_notifysig+0x13/0x19
> =======================
> Code: 8b 46 44 8b 50 08 b8 e3 aa 50 c0 e8 c0 ab fe ff 8b 46 4c 85 c0 74 14 8b 40 10 85 c0 74 0d 8b 50 2c b8 01 ab 50 c0 e8 a5 ab fe ff <0f> 0b eb fe 8b 53 10 89 d8 5b 5e 83 e2 01 f7 da 83 c2 04 e9 e1
> EIP: [<c0154bd6>] page_remove_rmap+0xcc/0xe7 SS:ESP 0068:f709ddfc
> ---[ end trace 8cd8c46e6dae67bc ]---
> Fixing recursive fault but reboot is needed!
> eth0: no IPv6 routers present
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists