linux-kernel - Re: Hang on large copy_from_user with PREEMPT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <55231A82.6010505@oracle.com>
Date:	Mon, 06 Apr 2015 19:45:06 -0400
From:	Sasha Levin <sasha.levin@...cle.com>
To:	Borislav Petkov <bp@...en8.de>
CC:	Linus Torvalds <torvalds@...ux-foundation.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Rusty Russell <rusty@...tcorp.com.au>,
	Dave Jones <davej@...hat.com>, Michal Hocko <mhocko@...e.cz>,
	the arch/x86 maintainers <x86@...nel.org>
Subject: Re: Hang on large copy_from_user with PREEMPT_NONE

On 04/06/2015 03:36 PM, Borislav Petkov wrote:
> On Mon, Apr 06, 2015 at 03:08:24PM -0400, Sasha Levin wrote:
>> > Your patch just makes it hang in memset instead:
>> > 
>> > [  963.104556] NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [trinity-c224:9845]
>> > [  963.104556] Modules linked in:
>> > [  963.104556] irq event stamp: 3773324
>> > [  963.104556] hardirqs last  enabled at (3773323): [<ffffffffb7af8e3c>] restore_args+0x0/0x34
>> > [  963.104556] hardirqs last disabled at (3773324): [<ffffffffb7af919e>] apic_timer_interrupt+0x6e/0x80
>> > [  963.104556] softirqs last  enabled at (3773322): [<ffffffffad1f6589>] __do_softirq+0x709/0xd40
>> > [  963.104556] softirqs last disabled at (3773317): [<ffffffffad1f746d>] irq_exit+0x29d/0x320
>> > [  963.104556] CPU: 1 PID: 9845 Comm: trinity-c224 Not tainted 4.0.0-rc6-next-20150402-sasha-00039-ge0bdae3-dirty #2130
>> > [  963.104556] task: ffff8802a3560000 ti: ffff8802a3568000 task.ti: ffff8802a3568000
>> > [  963.104556] RIP: 0010:[<ffffffffaefbd173>]  [<ffffffffaefbd173>] memset_orig+0x33/0xb0
> memset_orig?
> 
> Hmmm, your box doesn't set X86_FEATURE_REP_GOOD. And looking at your
> dmesg I can see why - that's a kvm guest and you're emulating some qemu
> -cpu kvm64 or so thing, AFAICT.
> 
> Can you give me your full command line?

I'm running kvmtool rather than qemu.

I've changed the cpu that the guest sees, and it just moved to the optimized memset:

[  843.403237] NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [trinity-c123:9780]
[  843.403265] Modules linked in:
[  843.403265] irq event stamp: 7340472
[  843.403265] hardirqs last  enabled at (7340471): [<ffffffffafaf8e3c>] restore_args+0x0/0x34
[  843.403265] hardirqs last disabled at (7340472): [<ffffffffafaf919e>] apic_timer_interrupt+0x6e/0x80
[  843.403265] softirqs last  enabled at (7340470): [<ffffffffa51f6589>] __do_softirq+0x709/0xd40
[  843.403265] softirqs last disabled at (7340455): [<ffffffffa51f746d>] irq_exit+0x29d/0x320
[  843.403265] CPU: 0 PID: 9780 Comm: trinity-c123 Not tainted 4.0.0-rc6-next-20150402-sasha-00039-ge0bda
e3-dirty #2130
[  843.403265] task: ffff88034ffb0000 ti: ffff88034ffb8000 task.ti: ffff88034ffb8000
[  843.403265] RIP: 0010:[<ffffffffa6fbd124>]  [<ffffffffa6fbd124>] __memset+0x24/0x30
[  843.403265] RSP: 0000:ffff88034ffbfdf0  EFLAGS: 00010206
[  843.403265] RAX: 0000000000000000 RBX: 00000000fffff000 RCX: 0000000004a8a000
[  843.403265] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc900ecdbd000
[  843.403265] RBP: ffff88034ffbfe18 R08: 000000001ffffe00 R09: ffffc9001220e000
[  843.403265] R10: ffffc9011220cfff R11: fffff52022441a00 R12: 000000001ffffe00
[  843.403265] R13: fffff52022399988 R14: 000000001ffffe00 R15: fffff520224419ff
[  843.403265] FS:  00007f0600ec4700(0000) GS:ffff880050600000(0000) knlGS:0000000000000000
[  843.403265] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  843.403265] CR2: 00000000ff355000 CR3: 000000034f73f000 CR4: 00000000000007f0
[  843.403265] Stack:
[  843.403265]  ffffffffa563b4ac ffffffffafafd69c 00000000fffff000 ffff88034ffbfe78
[  843.403265]  ffff88034ffbff18 ffff88034ffbfe38 ffffffffa6fbd759 0000000000010246
[  843.403265]  1ffff10069ff7fcb ffff88034ffbff48 ffffffffa53c5ef0 ffffc9001220e000
[  843.403265] Call Trace:
[  843.403265]  [<ffffffffa563b4ac>] ? memset+0x2c/0x40
[  843.403265]  [<ffffffffafafd69c>] ? bad_to_user+0x66/0x1391
[  843.403265]  [<ffffffffa6fbd759>] copy_user_handle_tail+0x69/0x80
[  843.403265]  [<ffffffffa53c5ef0>] SyS_init_module+0x150/0x210
[  843.403265]  [<ffffffffa53c5da0>] ? load_module+0x96a0/0x96a0
[  843.403265]  [<ffffffffafafad49>] ia32_do_call+0x13/0x13
[  843.403265] Code: 90 90 90 90 90 90 90 66 66 90 66 90 49 89 f9 48 89 d1 83 e2 07 48 c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 <f3> 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1
> 
> Btw, maybe you should try to trigger this on real metal, just in case,
> to rule out virt issues. Or have you, already?

I'll give it a go tomorrow.


Thanks,
Sasha
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/