| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <291b8bcd-df68-3f5e-2985-fcaa46c1ff38@redhat.com>
Date: Wed, 21 Aug 2019 10:30:29 +0200
From: David Hildenbrand <david@...hat.com>
To: Nadav Amit <namit@...are.com>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: Arnd Bergmann <arnd@...db.de>,
"VMware, Inc." <pv-drivers@...are.com>,
linux-kernel@...r.kernel.org,
Thomas Hellstrom <thellstrom@...are.com>
Subject: Re: [PATCH] vmw_balloon: Fix offline page marking with compaction
On 20.08.19 18:01, Nadav Amit wrote:
> The compaction code already marks pages as offline when it enqueues
> pages in the ballooned page list, and removes the mapping when the pages
> are removed from the list. VMware balloon also updates the flags,
> instead of letting the balloon-compaction logic handle it, which causes
> the assertion VM_BUG_ON_PAGE(!PageOffline(page)) to fire, when
> __ClearPageOffline is called the second time. This causes the following
> crash.
>
> [ 487.104520] kernel BUG at include/linux/page-flags.h:749!
> [ 487.106364] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
> [ 487.107681] CPU: 7 PID: 1106 Comm: kworker/7:3 Not tainted 5.3.0-rc5balloon #227
> [ 487.109196] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
> [ 487.111452] Workqueue: events_freezable vmballoon_work [vmw_balloon]
> [ 487.112779] RIP: 0010:vmballoon_release_page_list+0xaa/0x100 [vmw_balloon]
> [ 487.114200] Code: fe 48 c1 e7 06 4c 01 c7 8b 47 30 41 89 c1 41 81 e1 00 01 00 f0 41 81 f9 00 00 00 f0 74 d3 48 c7 c6 08 a1 a1 c0 e8 06 0d e7 ea <0f> 0b 44 89 f6 4c 89 c7 e8 49 9c e9 ea 49 8d 75 08 49 8b 45 08 4d
> [ 487.118033] RSP: 0018:ffffb82f012bbc98 EFLAGS: 00010246
> [ 487.119135] RAX: 0000000000000037 RBX: 0000000000000001 RCX: 0000000000000006
> [ 487.120601] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9a85b6bd7620
> [ 487.122071] RBP: ffffb82f012bbcc0 R08: 0000000000000001 R09: 0000000000000000
> [ 487.123536] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb82f012bbd00
> [ 487.125002] R13: ffffe97f4598d9c0 R14: 0000000000000000 R15: ffffb82f012bbd34
> [ 487.126463] FS: 0000000000000000(0000) GS:ffff9a85b6bc0000(0000) knlGS:0000000000000000
> [ 487.128110] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 487.129316] CR2: 00007ffe6e413ea0 CR3: 0000000230b18001 CR4: 00000000003606e0
> [ 487.130812] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 487.132283] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [ 487.133749] Call Trace:
> [ 487.134333] vmballoon_deflate+0x22c/0x390 [vmw_balloon]
> [ 487.135468] vmballoon_work+0x6e7/0x913 [vmw_balloon]
> [ 487.136711] ? process_one_work+0x21a/0x5e0
> [ 487.138581] process_one_work+0x298/0x5e0
> [ 487.139926] ? vmballoon_migratepage+0x310/0x310 [vmw_balloon]
> [ 487.141610] ? process_one_work+0x298/0x5e0
> [ 487.143053] worker_thread+0x41/0x400
> [ 487.144389] kthread+0x12b/0x150
> [ 487.145582] ? process_one_work+0x5e0/0x5e0
> [ 487.146937] ? kthread_create_on_node+0x60/0x60
> [ 487.148637] ret_from_fork+0x3a/0x50
>
> Fix it by updating the PageOffline indication only when a 2MB page is
> enqueued and dequeued. The 4KB pages will be handled correctly by the
> balloon compaction logic.
>
> Fixes: 83a8afa72e9c ("vmw_balloon: Compaction support")
> Cc: David Hildenbrand <david@...hat.com>
> Reported-by: Thomas Hellstrom <thellstrom@...are.com>
> Signed-off-by: Nadav Amit <namit@...are.com>
> ---
> drivers/misc/vmw_balloon.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c
> index 8840299420e0..5e6be1527571 100644
> --- a/drivers/misc/vmw_balloon.c
> +++ b/drivers/misc/vmw_balloon.c
> @@ -691,7 +691,6 @@ static int vmballoon_alloc_page_list(struct vmballoon *b,
> }
>
> if (page) {
> - vmballoon_mark_page_offline(page, ctl->page_size);
> /* Success. Add the page to the list and continue. */
> list_add(&page->lru, &ctl->pages);
> continue;
> @@ -930,7 +929,6 @@ static void vmballoon_release_page_list(struct list_head *page_list,
>
> list_for_each_entry_safe(page, tmp, page_list, lru) {
> list_del(&page->lru);
> - vmballoon_mark_page_online(page, page_size);
> __free_pages(page, vmballoon_page_order(page_size));
> }
>
> @@ -1005,6 +1003,7 @@ static void vmballoon_enqueue_page_list(struct vmballoon *b,
> enum vmballoon_page_size_type page_size)
> {
> unsigned long flags;
> + struct page *page;
>
> if (page_size == VMW_BALLOON_4K_PAGE) {
> balloon_page_list_enqueue(&b->b_dev_info, pages);
> @@ -1014,6 +1013,11 @@ static void vmballoon_enqueue_page_list(struct vmballoon *b,
> * for the balloon compaction mechanism.
> */
> spin_lock_irqsave(&b->b_dev_info.pages_lock, flags);
> +
> + list_for_each_entry(page, pages, lru) {
> + vmballoon_mark_page_offline(page, VMW_BALLOON_2M_PAGE);
> + }
> +
> list_splice_init(pages, &b->huge_pages);
> __count_vm_events(BALLOON_INFLATE, *n_pages *
> vmballoon_page_in_frames(VMW_BALLOON_2M_PAGE));
> @@ -1056,6 +1060,8 @@ static void vmballoon_dequeue_page_list(struct vmballoon *b,
> /* 2MB pages */
> spin_lock_irqsave(&b->b_dev_info.pages_lock, flags);
> list_for_each_entry_safe(page, tmp, &b->huge_pages, lru) {
> + vmballoon_mark_page_online(page, VMW_BALLOON_2M_PAGE);
> +
> list_move(&page->lru, pages);
> if (++i == n_req_pages)
> break;
>
Or check in vmballoon_mark_page_online/vmballoon_mark_page_offline if
already properly marked, adding a comment. But what you have should also
work.
--
Thanks,
David / dhildenb
Powered by blists - more mailing lists