linux-kernel - [mainline][libhugetlbfs][ppc] stack_grow_into

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1518167611.647.39.camel@abdul.in.ibm.com>
Date:   Fri, 09 Feb 2018 14:43:31 +0530
From:   Abdul Haleem <abdhalee@...ux.vnet.ibm.com>
To:     linuxppc-dev <linuxppc-dev@...ts.ozlabs.org>
Cc:     linux-kernel <linux-kernel@...r.kernel.org>,
        "aneesh.kumar" <aneesh.kumar@...ux.vnet.ibm.com>,
        linuxram <linuxram@...ibm.com>, mpe <mpe@...erman.id.au>,
        sachinp <sachinp@...ux.vnet.ibm.com>,
        linux-mm <linux-mm@...ck.org>,
        khandual <khandual@...ux.vnet.ibm.com>
Subject: [mainline][libhugetlbfs][ppc] stack_grow_into_huge test results in
 kernel Oops

Greetings,

Today's mainline kernel Oops when running stack_grow_into_huge

Machine: Power 8 bare-metal 
Kernel: 4.15.0
Config: attached
gcc: 4.8.5
Test: libhugetlbfs

stack_grow_into_huge (16M: 64) resulted in kernel Oops message and the
bad address maps to:

# gdb -batch vmlinux -ex 'list *(0xc000000000a15a18)'
0xc000000000a15a18 is in _raw_spin_lock
(./arch/powerpc/include/asm/spinlock.h:82).
77	 */
78	static inline unsigned long __arch_spin_trylock(arch_spinlock_t
*lock)
79	{
80		unsigned long tmp, token;
81	
82		token = LOCK_TOKEN;
83		__asm__ __volatile__(
84	"1:	" PPC_LWARX(%0,0,%2,1) "\n\
85		cmpwi		0,%0,0\n\
86		bne-		2f\n\

trace logs:
-----------
stack_grow_into[71525]: unhandled signal 11 at 00007effefbc10f0 nip 0000000010001764 lr 000000001000173c code 1
Unable to handle kernel paging request for data at address
0xf000400000000030
Faulting instruction address: 0xc000000000a15a18
Oops: Kernel access of bad area, sig: 11 [#3]
LE SMP NR_CPUS=2048 NUMA PowerNV
Modules linked in: iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4
iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4
xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp tun bridge
stp llc kvm_hv kvm iptable_filter vmx_crypto ipmi_powernv ipmi_devintf
ipmi_msghandler powernv_rng leds_powernv led_class powernv_op_panel
rng_core nfsd binfmt_misc ip_tables x_tables autofs4
CPU: 32 PID: 71525 Comm: stack_grow_into Tainted: G      D          4.15.0-11704-ga2e5790-dirty #1
NIP:  c000000000a15a18 LR: c00000000028a0a0 CTR: c000000000065880
REGS: c000000db6fd75e0 TRAP: 0300   Tainted: G      D           (4.15.0-11704-ga2e5790-dirty)
MSR:  900000000280b033 <SF,HV,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  CR: 28022888  XER: 00000000
CFAR: c00000000000884c DAR: f000400000000030 DSISR: 40000000 SOFTE: 0
GPR00: c00000000028a0a0 c000000db6fd7860 c0000000010e3300 f000400000000030
GPR04: 0000000000000001 0000000000000002 0000000000000000 0000000000000000
GPR08: c000000000000000 c100000000000000 0000000080000020 c0000007ec745468
GPR12: 0000000000002200 c00000000fd0c000 00007fc9a0000000 0000000000000001
GPR16: c00000052401fd80 0000000000000000 00000007fef60000 c000000000da54f8
GPR20: 0000000000000001 0000000000000000 0000000000000000 f000400000000000
GPR24: c0000007e9070d00 c100000000000000 c000000db6fd78b0 c0000007ec745100
GPR28: fe7fffffffffefff ffffffffffffffff c000000db6fd7a50 f000400000000030
NIP [c000000000a15a18] _raw_spin_lock+0x28/0xc0
LR [c00000000028a0a0] unmap_page_range+0x4b0/0xf70
Call Trace:
[c000000db6fd7860] [c000000db6fd7890] 0xc000000db6fd7890 (unreliable)
[c000000db6fd7890] [c00000000028a0a0] unmap_page_range+0x4b0/0xf70
[c000000db6fd79e0] [c00000000028aee4] unmap_vmas+0x74/0xf0
[c000000db6fd7a30] [c000000000298cfc] exit_mmap+0x9c/0x1c0
[c000000db6fd7af0] [c0000000000e9744] mmput+0x94/0x190
[c000000db6fd7b20] [c0000000000f33c0] do_exit+0x330/0xcc0
[c000000db6fd7be0] [c0000000000f3e0c] do_group_exit+0x5c/0xf0
[c000000db6fd7c20] [c0000000001031a8] get_signal+0x1f8/0x6f0
[c000000db6fd7d10] [c00000000001be98] do_signal+0x78/0x2e0
[c000000db6fd7e00] [c00000000001c294] do_notify_resume+0xd4/0xf0
[c000000db6fd7e30] [c00000000000bf44] ret_from_except_lite+0x70/0x74
Instruction dump:
990d028c 4bffffc8 3c4c006d 3842d910 7c0802a6 fbe1fff8 7c7f1b78 f8010010
f821ffd1 39400000 994d028c 814d0008 <7d201829> 2c090000 40c20010 7d40192d
---[ end trace b21abd323ba17f9e ]---

Fixing recursive fault but reboot is needed!


-- 
Regard's

Abdul Haleem
IBM Linux Technology Centre



View attachment "Tul-NV-config" of type "text/plain" (91816 bytes)