| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 21 Jan 2019 13:22:54 +0100
From: Marc Gonzalez <marc.w.gonzalez@...e.fr>
To: Catalin Marinas <catalin.marinas@....com>,
Rob Herring <robh+dt@...nel.org>,
Frank Rowand <frowand.list@...il.com>,
Marek Szyprowski <m.szyprowski@...sung.com>,
Bjorn Andersson <bjorn.andersson@...aro.org>
Cc: Robin Murphy <robin.murphy@....com>,
Mark Rutland <mark.rutland@....com>,
Arnd Bergmann <arnd@...db.de>,
Ard Biesheuvel <ard.biesheuvel@...aro.org>,
Oscar Salvador <osalvador@...e.de>,
Wei Yang <richard.weiyang@...il.com>,
Michal Hocko <mhocko@...e.com>,
Andrew Morton <akpm@...ux-foundation.org>,
Linus Torvalds <torvalds@...ux-foundation.org>,
Sachin Nikam <snikam@...dia.com>, Qian Cai <cai@....pw>,
LKML <linux-kernel@...r.kernel.org>
Subject: Re: kmemleak panic
On 21/01/2019 12:57, Marc Gonzalez wrote:
> On 19/01/2019 14:28, Catalin Marinas wrote:
>
>> As per Robin's remark, this address seems to be pretty easy to
>> reproduce. It also happens via scan_gray_list() which indicates an
>> object kmemleak was informed about via kmemleak_alloc() (so this
>> excludes the pfn that Qian noticed).
>>
>> Can you configure the kernel with CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN off
>> just to avoid the bug being triggered early and run:
>>
>> mount -t debugfs nodev /sys/kernel/debug/
>> echo dump=0xffffffc021e00000 > /sys/kernel/debug/kmemleak
>>
>> Then run another scan to make sure this is the address that triggered
>> the page fault:
>>
>> echo scan > /sys/kernel/debug/kmemleak
>>
>> The above should tell us where the object that kmemleak is trying to
>> scan came from.
>
> Here are the remap requests on my system:
>
> REMAP: PA=17a00000 VA=ffffff8010040000 SIZE=10000
> REMAP: PA=17b00000 VA=ffffff8010c00000 SIZE=100000
> REMAP: PA=17920000 VA=ffffff8010005000 SIZE=1000
> REMAP: PA=17921000 VA=ffffff801000d000 SIZE=1000
> REMAP: PA=17921000 VA=ffffff8010015000 SIZE=1000
> REMAP: PA=01f40000 VA=ffffff8010fa0000 SIZE=20000
> REMAP: PA=86000000 VA=ffffff8011000000 SIZE=200000
> REMAP: PA=00100000 VA=ffffff8011300000 SIZE=b0000
> REMAP: PA=17911000 VA=ffffff8010025000 SIZE=1000
> REMAP: PA=00778000 VA=ffffff80115d0000 SIZE=7000
> REMAP: PA=0c1b0000 VA=ffffff801002d000 SIZE=1000
>
>
> # echo dump=0xffffffc021e00000 > /sys/kernel/debug/kmemleak
> kmemleak: Object 0xffffffc021e00000 (size 2097152):
> kmemleak: comm "swapper/0", pid 0, jiffies 4294892296
> kmemleak: min_count = 0
> kmemleak: count = 0
> kmemleak: flags = 0x1
> kmemleak: checksum = 0
> kmemleak: backtrace:
> kmemleak_alloc_phys+0x48/0x60
> memblock_alloc_range_nid+0x8c/0xa4
> memblock_alloc_base_nid+0x4c/0x60
> __memblock_alloc_base+0x3c/0x4c
> early_init_dt_alloc_reserved_memory_arch+0x54/0xa4
> fdt_init_reserved_mem+0x308/0x3ec
> early_init_fdt_scan_reserved_mem+0x88/0xb0
> arm64_memblock_init+0x1dc/0x254
> setup_arch+0x1c8/0x4ec
> start_kernel+0x84/0x44c
> 0xffffffffffffffff
>
> # echo scan > /sys/kernel/debug/kmemleak
> Unable to handle kernel paging request at virtual address ffffffc021e00000
> Mem abort info:
> ESR = 0x96000006
> Exception class = DABT (current EL), IL = 32 bits
> SET = 0, FnV = 0
> EA = 0, S1PTW = 0
> Data abort info:
> ISV = 0, ISS = 0x00000006
> CM = 0, WnR = 0
> swapper pgtable: 4k pages, 39-bit VAs, pgdp = (____ptrval____)
> [ffffffc021e00000] pgd=000000017e3ba803, pud=000000017e3ba803, pmd=0000000000000000
> Internal error: Oops: 96000006 [#1] PREEMPT SMP
> CPU: 4 PID: 508 Comm: sh Tainted: G S 5.0.0-rc1 #11
> Hardware name: Qualcomm Technologies, Inc. MSM8998 v1 MTP (DT)
> pstate: 80000085 (Nzcv daIf -PAN -UAO)
> pc : scan_block+0x70/0x180
> lr : scan_block+0x6c/0x180
> sp : ffffff8011a2bb40
> x29: ffffff8011a2bb40 x28: ffffffc0f8375e80
> x27: ffffff8010b8a000 x26: 0000000000000080
> x25: ffffff8010b8a668 x24: ffffffc0f8cc0000
> x23: ffffff8010b8a000 x22: ffffff8010a4b8c8
> x21: ffffffc021e00ff9 x20: ffffffc021e01000
> x19: ffffffc021e00000 x18: 0000000000000000
> x17: 0000000000000200 x16: 0000000000000000
> x15: ffffffffffffffff x14: ffffffff00000000
> x13: ffffffffffffffff x12: 0000000000000020
> x11: 0101010101010101 x10: 00000000004bfd20
> x9 : 7f7f7f7f7f7f7f7f x8 : fefeff096d606272
> x7 : 00000000dc3c0000 x6 : 0000000000000018
> x5 : ffffffbf03f8efc8 x4 : ffffffbf03f8efc7
> x3 : 5b36396f4e7d4000 x2 : ffffffc0f8cc0000
> x1 : ffffffc0f6689880 x0 : 0000000000000000
> Process sh (pid: 508, stack limit = 0x(____ptrval____))
> Call trace:
> scan_block+0x70/0x180
> scan_gray_list+0xe0/0x190
> kmemleak_scan+0x2bc/0x540
> kmemleak_write+0x328/0x3d0
> full_proxy_write+0x68/0xa0
> __vfs_write+0x60/0x190
> vfs_write+0xac/0x1a0
> ksys_write+0x6c/0xe0
> __arm64_sys_write+0x24/0x30
> el0_svc_handler+0xb8/0x140
> el0_svc+0x8/0xc
> Code: f9000fb4 d503201f 97ffffd2 35000540 (f9400260)
> ---[ end trace 754cbd2624bb2b91 ]---
> note: sh[508] exited with preempt_count 2
>
>
> __reserved_mem_alloc_size() printed:
> OF: reserved mem: allocated memory for 'rmtfs' node: base 0x00000000a1e00000, size 2 MiB
>
> See git show c7833949564ec
>
> The corresponding node is:
>
> reserved-memory {
> #address-cells = <2>;
> #size-cells = <2>;
> ranges;
>
> memory@...00000 {
> reg = <0x0 0x85800000 0x0 0x800000>;
> no-map;
> };
>
> smem_mem: smem-mem@...00000 {
> reg = <0x0 0x86000000 0x0 0x200000>;
> no-map;
> };
>
> memory@...00000 {
> reg = <0x0 0x86200000 0x0 0x2600000>;
> no-map;
> };
>
> rmtfs {
> compatible = "qcom,rmtfs-mem";
>
> size = <0x0 0x200000>;
> alloc-ranges = <0x0 0xa0000000 0x0 0x2000000>;
> no-map;
>
> qcom,client-id = <1>;
> qcom,vmid = <15>;
> };
> };
Complete boot log using 'loglevel=7 memblock=debug'
https://pastebin.ubuntu.com/p/2BN2csSYkx/
Regards.
Powered by blists - more mailing lists