| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1593641660-13254-2-git-send-email-bhsharma@redhat.com>
Date: Thu, 2 Jul 2020 03:44:19 +0530
From: Bhupesh Sharma <bhsharma@...hat.com>
To: cgroups@...r.kernel.org, linux-mm@...ck.org,
linux-arm-kernel@...ts.infradead.org
Cc: bhsharma@...hat.com, bhupesh.linux@...il.com,
Johannes Weiner <hannes@...xchg.org>,
Michal Hocko <mhocko@...nel.org>,
Vladimir Davydov <vdavydov.dev@...il.com>,
James Morse <james.morse@....com>,
Mark Rutland <mark.rutland@....com>,
Will Deacon <will@...nel.org>,
Catalin Marinas <catalin.marinas@....com>,
linux-kernel@...r.kernel.org, kexec@...ts.infradead.org
Subject: [PATCH 1/2] mm/memcontrol: Fix OOPS inside mem_cgroup_get_nr_swap_pages()
Prabhakar reported an OOPS inside mem_cgroup_get_nr_swap_pages()
function in a corner case seen on some arm64 boards when kdump kernel
runs with "cgroup_disable=memory" passed to the kdump kernel via
bootargs.
The root-cause behind the same is that currently mem_cgroup_swap_init()
function is implemented as a subsys_initcall() call instead of a
core_initcall(), this means 'cgroup_memory_noswap' still
remains set to the default value (false) even when memcg is disabled via
"cgroup_disable=memory" boot parameter.
This may result in premature OOPS inside mem_cgroup_get_nr_swap_pages()
function in corner cases:
[ 0.265617] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000188
[ 0.274495] Mem abort info:
[ 0.277311] ESR = 0x96000006
[ 0.280389] EC = 0x25: DABT (current EL), IL = 32 bits
[ 0.285751] SET = 0, FnV = 0
[ 0.288830] EA = 0, S1PTW = 0
[ 0.291995] Data abort info:
[ 0.294897] ISV = 0, ISS = 0x00000006
[ 0.298765] CM = 0, WnR = 0
[ 0.301757] [0000000000000188] user address but active_mm is swapper
[ 0.308174] Internal error: Oops: 96000006 [#1] SMP
[ 0.313097] Modules linked in:
<..snip..>
[ 0.331384] pstate: 00400009 (nzcv daif +PAN -UAO BTYPE=--)
[ 0.337014] pc : mem_cgroup_get_nr_swap_pages+0x9c/0xf4
[ 0.342289] lr : mem_cgroup_get_nr_swap_pages+0x68/0xf4
[ 0.347564] sp : fffffe0012b6f800
[ 0.350905] x29: fffffe0012b6f800 x28: fffffe00116b3000
[ 0.356268] x27: fffffe0012b6fb00 x26: 0000000000000020
[ 0.361631] x25: 0000000000000000 x24: fffffc00723ffe28
[ 0.366994] x23: fffffe0010d5b468 x22: fffffe00116bfa00
[ 0.372357] x21: fffffe0010aabda8 x20: 0000000000000000
[ 0.377720] x19: 0000000000000000 x18: 0000000000000010
[ 0.383082] x17: 0000000043e612f2 x16: 00000000a9863ed7
[ 0.388445] x15: ffffffffffffffff x14: 202c303d70617773
[ 0.393808] x13: 6f6e5f79726f6d65 x12: 6d5f70756f726763
[ 0.399170] x11: 2073656761705f70 x10: 6177735f726e5f74
[ 0.404533] x9 : fffffe00100e9580 x8 : fffffe0010628160
[ 0.409895] x7 : 00000000000000a8 x6 : fffffe00118f5e5e
[ 0.415258] x5 : 0000000000000001 x4 : 0000000000000000
[ 0.420621] x3 : 0000000000000000 x2 : 0000000000000000
[ 0.425983] x1 : 0000000000000000 x0 : fffffc0060079000
[ 0.431346] Call trace:
[ 0.433809] mem_cgroup_get_nr_swap_pages+0x9c/0xf4
[ 0.438735] shrink_lruvec+0x404/0x4f8
[ 0.442516] shrink_node+0x1a8/0x688
[ 0.446121] do_try_to_free_pages+0xe8/0x448
[ 0.450429] try_to_free_pages+0x110/0x230
[ 0.454563] __alloc_pages_slowpath.constprop.106+0x2b8/0xb48
[ 0.460366] __alloc_pages_nodemask+0x2ac/0x2f8
[ 0.464938] alloc_page_interleave+0x20/0x90
[ 0.469246] alloc_pages_current+0xdc/0xf8
[ 0.473379] atomic_pool_expand+0x60/0x210
[ 0.477514] __dma_atomic_pool_init+0x50/0xa4
[ 0.481910] dma_atomic_pool_init+0xac/0x158
[ 0.486220] do_one_initcall+0x50/0x218
[ 0.490091] kernel_init_freeable+0x22c/0x2d0
[ 0.494489] kernel_init+0x18/0x110
[ 0.498007] ret_from_fork+0x10/0x18
[ 0.501614] Code: aa1403e3 91106000 97f82a27 14000011 (f940c663)
[ 0.507770] ---[ end trace 9795948475817de4 ]---
[ 0.512429] Kernel panic - not syncing: Fatal exception
[ 0.517705] Rebooting in 10 seconds..
Cc: Johannes Weiner <hannes@...xchg.org>
Cc: Michal Hocko <mhocko@...nel.org>
Cc: Vladimir Davydov <vdavydov.dev@...il.com>
Cc: James Morse <james.morse@....com>
Cc: Mark Rutland <mark.rutland@....com>
Cc: Will Deacon <will@...nel.org>
Cc: Catalin Marinas <catalin.marinas@....com>
Cc: cgroups@...r.kernel.org
Cc: linux-mm@...ck.org
Cc: linux-arm-kernel@...ts.infradead.org
Cc: linux-kernel@...r.kernel.org
Cc: kexec@...ts.infradead.org
Reported-by: Prabhakar Kushwaha <pkushwaha@...vell.com>
Signed-off-by: Bhupesh Sharma <bhsharma@...hat.com>
---
mm/memcontrol.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 19622328e4b5..8323e4b7b390 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -7186,6 +7186,13 @@ static struct cftype memsw_files[] = {
{ }, /* terminate */
};
+/*
+ * If mem_cgroup_swap_init() is implemented as a subsys_initcall()
+ * instead of a core_initcall(), this could mean cgroup_memory_noswap still
+ * remains set to false even when memcg is disabled via "cgroup_disable=memory"
+ * boot parameter. This may result in premature OOPS inside
+ * mem_cgroup_get_nr_swap_pages() function in corner cases.
+ */
static int __init mem_cgroup_swap_init(void)
{
/* No memory control -> no swap control */
@@ -7200,6 +7207,6 @@ static int __init mem_cgroup_swap_init(void)
return 0;
}
-subsys_initcall(mem_cgroup_swap_init);
+core_initcall(mem_cgroup_swap_init);
#endif /* CONFIG_MEMCG_SWAP */
--
2.7.4
Powered by blists - more mailing lists