linux-kernel - Re: mm,x86: warning at arch/x86/mm/pat.c:781 untrack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <alpine.LSU.2.11.1406092127180.1505@eggly.anvils>
Date:	Mon, 9 Jun 2014 21:35:21 -0700 (PDT)
From:	Hugh Dickins <hughd@...gle.com>
To:	Sasha Levin <sasha.levin@...cle.com>
cc:	"linux-mm@...ck.org" <linux-mm@...ck.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Konstantin Khlebnikov <koct9i@...il.com>,
	suresh.b.siddha@...el.com, Ingo Molnar <mingo@...nel.org>,
	"H. Peter Anvin" <hpa@...or.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Dave Jones <davej@...hat.com>
Subject: Re: mm,x86: warning at arch/x86/mm/pat.c:781
 untrack_pfn+0x65/0xb0()

On Sat, 7 Jun 2014, Sasha Levin wrote:
> On 04/11/2014 08:50 AM, Sasha Levin wrote:
> > Hi all,
> > 
> > While fuzzing with trinity inside a KVM tools guest running the latest -next
> > kernel I've stumbled on the following:
> 
> Ping? Still happening (rarely on -next):
> 
> [ 5818.038245] WARNING: CPU: 4 PID: 22726 at arch/x86/mm/pat.c:781 untrack_pfn+0x65/0xb0()
> [ 5818.044203] Modules linked in:
> [ 5818.045172] CPU: 4 PID: 22726 Comm: trinity-c239 Tainted: G        W     3.15.0-rc8-next-20140606-sasha-00021-ga9d3a0b-dirty #596
> [ 5818.048317]  0000000000000009 ffff8800024d3be8 ffffffff9e50fe6b 0000000000000001
> [ 5818.050516]  0000000000000000 ffff8800024d3c28 ffffffff9b15f96c ffff8800024d3c38
> [ 5818.052567]  ffff88000203f400 0000000000000000 ffff8800024d3d68 ffff8800024d3d68
> [ 5818.053785] Call Trace:
> [ 5818.054483] dump_stack (lib/dump_stack.c:52)
> [ 5818.055586] warn_slowpath_common (kernel/panic.c:430)
> [ 5818.056763] warn_slowpath_null (kernel/panic.c:465)
> [ 5818.057789] untrack_pfn (arch/x86/mm/pat.c:781 (discriminator 3))
> [ 5818.059412] unmap_single_vma (mm/memory.c:1327)
> [ 5818.061530] ? pagevec_lru_move_fn (include/linux/pagevec.h:44 mm/swap.c:435)
> [ 5818.063412] unmap_vmas (mm/memory.c:1377 (discriminator 1))
> [ 5818.064610] unmap_region (mm/mmap.c:2363 (discriminator 3))
> [ 5818.065453] ? validate_mm_rb (mm/mmap.c:404)
> [ 5818.066422] ? vma_rb_erase (mm/mmap.c:449 include/linux/rbtree_augmented.h:219 include/linux/rbtree_augmented.h:227 mm/mmap.c:488)
> [ 5818.067316] do_munmap (mm/mmap.c:3359 mm/mmap.c:2561)
> [ 5818.068126] move_vma (mm/mremap.c:313)
> [ 5818.069000] SyS_mremap (mm/mremap.c:446 mm/mremap.c:508 mm/mremap.c:477)
> [ 5818.069839] tracesys (arch/x86/kernel/entry_64.S:542)

I could easily be wrong, but I think of this one as another manifestation
of the filemap.c:202 BUG_ON(page_mapped(page)) bug, whatever that is.

In each case, we have a BUG or WARNING at the point where we detect that
there should have been a pte in a page table, but it somehow disappeared.

VM_PFNMAP in this case, an ordinary file mapping in the other case; and
nothing to show in the anonymous case, there the page would just leak.

Hugh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/