linux-kernel - Re: [lkp-robot] [x86/cpu_entry_area] 10043e02db: kernel_BUG_at

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ba1bc259-9db7-64d8-f136-c889d2c967e0@virtuozzo.com>
Date:   Thu, 28 Dec 2017 19:18:33 +0300
From:   Andrey Ryabinin <aryabinin@...tuozzo.com>
To:     Dmitry Vyukov <dvyukov@...gle.com>,
        Thomas Gleixner <tglx@...utronix.de>
Cc:     kernel test robot <xiaolong.ye@...el.com>,
        Ingo Molnar <mingo@...nel.org>,
        Andy Lutomirski <luto@...nel.org>,
        Boris Ostrovsky <boris.ostrovsky@...cle.com>,
        Borislav Petkov <bp@...en8.de>,
        Brian Gerst <brgerst@...il.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        David Laight <David.Laight@...lab.com>,
        Denys Vlasenko <dvlasenk@...hat.com>,
        Eduardo Valentin <eduval@...zon.com>,
        Greg KH <gregkh@...uxfoundation.org>,
        "H. Peter Anvin" <hpa@...or.com>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Juergen Gross <jgross@...e.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Will Deacon <will.deacon@....com>,
        LKML <linux-kernel@...r.kernel.org>, tipbuild@...or.com,
        LKP <lkp@...org>, Alexander Potapenko <glider@...gle.com>,
        kasan-dev <kasan-dev@...glegroups.com>
Subject: Re: [lkp-robot] [x86/cpu_entry_area] 10043e02db:
 kernel_BUG_at_arch/x86/mm/physaddr.c



On 12/28/2017 02:54 PM, Dmitry Vyukov wrote:
> On Thu, Dec 28, 2017 at 12:51 PM, Thomas Gleixner <tglx@...utronix.de> wrote:
>> On Wed, 27 Dec 2017, Dmitry Vyukov wrote:
>>> On Wed, Dec 27, 2017 at 7:05 PM, Thomas Gleixner <tglx@...utronix.de> wrote:
>>>> So this dies simply because kasan_populate_shadow() runs out of memory and
>>>> has no sanity check whatsoever.
>>>>
>>>> static __init void *early_alloc(size_t size, int nid)
>>>> {
>>>>         return memblock_virt_alloc_try_nid_nopanic(size, size,
>>>>                 __pa(MAX_DMA_ADDRESS), BOOTMEM_ALLOC_ACCESSIBLE, nid);
>>>> }
>>>>
>>>> kasan_populate_pmd()
>>>> {
>>>>         .....
>>>>
>>>>                 p = early_alloc(PAGE_SIZE, nid);
>>>>                 entry = pfn_pte(PFN_DOWN(__pa(p)), PAGE_KERNEL);
>>>>
>>>> I've instrumented the whole thing and early_alloc() returns NULL at some
>>>> point and then __pa(NULL) dies in the VIRTUAL_DEBUG code. Well, it would
>>>> die with VIRTUAL_DEBUG=n as well at some other place.
>>>>
>>>> Not really a problem caused by the patch above, it's merily exposing a code
>>>> path which relies blindly on "enough memory available" assumptions.
>>>>
>>>> Throwing more memory at the VM makes the problem go away...
>>>
>>> Hi Thomas,
>>>
>>> We just need a check inside of early_alloc() to properly diagnose such
>>> situation, right?
>>
>> At least you want to panic with a proper out of memory message. But letting
>> the thing die at a random place is a bad idea.
> 
> Thanks. I will cook a patch (if Andrey won't beat me to it).
> 

We probably should panic only if PAGE_SIZE allocation failed. PUD_SIZE,PMD_SIZE allocations have
failure fallback. I would suggest add 'bool panic' param  to early_alloc() and call
memblock_virt_alloc_try_nid() if it's true.