linux-kernel - Re: [PATCH v1] drivers/base/memory.c: indicate all memory blocks as removable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 27 Mar 2020 10:00:08 +0100
From:   David Hildenbrand <david@...hat.com>
To:     Michal Hocko <mhocko@...nel.org>,
        Dan Williams <dan.j.williams@...el.com>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Linux MM <linux-mm@...ck.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "Rafael J. Wysocki" <rafael@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        powerpc-utils-devel@...glegroups.com, util-linux@...r.kernel.org,
        Badari Pulavarty <pbadari@...ibm.com>,
        Nathan Fontenot <nfont@...ux.vnet.ibm.com>,
        Robert Jennings <rcj@...ux.vnet.ibm.com>,
        Heiko Carstens <heiko.carstens@...ibm.com>,
        Karel Zak <kzak@...hat.com>,
        "Scargall, Steve" <steve.scargall@...el.com>
Subject: Re: [PATCH v1] drivers/base/memory.c: indicate all memory blocks as
 removable

On 27.03.20 08:47, Michal Hocko wrote:
> On Thu 26-03-20 23:24:08, Dan Williams wrote:
> [...]
>> David, Andrew,
>>
>> I'd like to recommend this patch for -stable as it likely (test
>> underway) solves this crash report from Steve:
>>
>> [  148.796036] page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p))
>> [  148.796074] ------------[ cut here ]------------
>> [  148.796098] kernel BUG at include/linux/mm.h:1087!
>> [  148.796126] invalid opcode: 0000 [#1] SMP NOPTI
>> [  148.796146] CPU: 63 PID: 5471 Comm: lsmem Not tainted 5.5.10-200.fc31.x8=
>> 6_64+debug #1
>> [  148.796173] Hardware name: Intel Corporation S2600WFD/S2600WFD, BIOS SE5=
>> C620.86B.02.01.0010.010620200716 01/06/2020
>> [  148.796212] RIP: 0010:is_mem_section_removable+0x1a4/0x1b0
>> [  148.796561] Call Trace:
>> [  148.796591]  removable_show+0x6e/0xa0
>> [  148.796608]  dev_attr_show+0x19/0x40
>> [  148.796625]  sysfs_kf_seq_show+0xa9/0x100
>> [  148.796640]  seq_read+0xd5/0x450
>> [  148.796657]  vfs_read+0xc5/0x180
>> [  148.796672]  ksys_read+0x68/0xe0
>> [  148.796688]  do_syscall_64+0x5c/0xa0
>> [  148.796704]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
>> [  148.796721] RIP: 0033:0x7f3ab1646412
>>
>> ...on a non-debug kernel it just crashes.
>>
>> In this case lsmem is failing when reading memory96:
>>
>> openat(3, "memory96/removable", O_RDONLY|O_CLOEXEC) = 4
>> fcntl(4, F_GETFL)                       = 0x8000 (flags O_RDONLY|O_LARGEFILE)
>> fstat(4, {st_mode=S_IFREG|0444, st_size=4096, ...}) = 0
>> read(4,  <unfinished ...>)              = ?
>> +++ killed by SIGSEGV +++
>> Segmentation fault (core dumped)
>>
>> ...which is phys_index 0x60 => memory address 0x3000000000
>>
>> On this platform that lands us here:
>>
>> 100000000-303fffffff : System RAM
>>   291f000000-291fe00f70 : Kernel code
>>   2920000000-292051efff : Kernel rodata
>>   2920600000-292093b0bf : Kernel data
>>   29214f3000-2922dfffff : Kernel bss
>> 3040000000-305fffffff : Reserved
>> 3060000000-1aa5fffffff : Persistent Memory
> 
> OK, 2GB memblocks and that would mean [0x3000000000, 0x3080000000]
> 
>> ...where the last memory block of System RAM is shared with persistent
>> memory. I.e. the block is only partially online which means that
>> page_to_nid() in is_mem_section_removable() will assert or crash for
>> some of the offline pages in that block.
> 
> Yes, this patch is a simple workaround. Normal memory hotplug will not
> blow up because it should be able to find out that test_pages_in_a_zone
> is false. Who knows how other potential pfn walkers handle that.

All other pfn walkers now correctly use pfn_to_online_page() - which
will also result in false positives in this scenario and is still to be
fixed by Dan IIRC. [1]

> 
> Risking to sound like a broken record I will remind that I have been
> pushing for having _all_ existing struct pages initialized and we
> wouldn't have problems like this popping out here and there.

The real issue is that we have uninitialized memmap within a section
that is marked to contain initialized/online memmap. As I said, even
pfn_to_online_page()/SECTION_IS_ONLINE does not help here.

Also, there is no way to mark devmem to have a initialized memmap
(something like SECTION_IS_ONLINE). I expressed my feeling about that
already.

[1] contains a discussion how it could be addressed.

> 
> That being said, I do not have any objections to backporting to stable
> trees.
> 

This one is one of the remaining places where we don't use
pfn_to_online_page(). So yeah, this patch shouldn't hurt.

[1] https://lkml.kernel.org/r/20191024120938.11237-1-david@redhat.com

-- 
Thanks,

David / dhildenb