linux-kernel - RE: [PATCH 2/3] mm/memory_hotplug: harden try_offline

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AM6PR08MB40697FCA7F2374EBE6459FE4F7690@AM6PR08MB4069.eurprd08.prod.outlook.com>
Date:   Mon, 6 Jul 2020 13:45:13 +0000
From:   Justin He <Justin.He@....com>
To:     David Hildenbrand <david@...hat.com>
CC:     Andrew Morton <akpm@...ux-foundation.org>,
        Mike Rapoport <rppt@...ux.ibm.com>,
        Baoquan He <bhe@...hat.com>,
        Chuhong Yuan <hslester96@...il.com>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        Kaly Xin <Kaly.Xin@....com>,
        Catalin Marinas <Catalin.Marinas@....com>,
        Will Deacon <will@...nel.org>
Subject: RE: [PATCH 2/3] mm/memory_hotplug: harden try_offline_node against
 bogus nid

Hi David

> -----Original Message-----
> From: David Hildenbrand <david@...hat.com>
> Sent: Monday, July 6, 2020 3:58 PM
> To: Justin He <Justin.He@....com>; Catalin Marinas
> <Catalin.Marinas@....com>; Will Deacon <will@...nel.org>
> Cc: Andrew Morton <akpm@...ux-foundation.org>; Mike Rapoport
> <rppt@...ux.ibm.com>; Baoquan He <bhe@...hat.com>; Chuhong Yuan
> <hslester96@...il.com>; linux-arm-kernel@...ts.infradead.org; linux-
> kernel@...r.kernel.org; linux-mm@...ck.org; Kaly Xin <Kaly.Xin@....com>
> Subject: Re: [PATCH 2/3] mm/memory_hotplug: harden try_offline_node
> against bogus nid
> 
> On 06.07.20 03:19, Jia He wrote:
> > When testing the remove_memory path of dax pmem, there will be a panic
> with
> > call trace:
> >   try_remove_memory+0x84/0x170
> >   remove_memory+0x38/0x58
> >   dev_dax_kmem_remove+0x3c/0x84 [kmem]
> >   device_release_driver_internal+0xfc/0x1c8
> >   device_release_driver+0x28/0x38
> >   bus_remove_device+0xd4/0x158
> >   device_del+0x160/0x3a0
> >   unregister_dev_dax+0x30/0x68
> >   devm_action_release+0x20/0x30
> >   release_nodes+0x150/0x240
> >   devres_release_all+0x6c/0x1d0
> >   device_release_driver_internal+0x10c/0x1c8
> >   driver_detach+0xac/0x170
> >   bus_remove_driver+0x64/0x130
> >   driver_unregister+0x34/0x60
> >   dax_pmem_exit+0x14/0xffc4 [dax_pmem]
> >   __arm64_sys_delete_module+0x18c/0x2d0
> >   el0_svc_common.constprop.2+0x78/0x168
> >   do_el0_svc+0x34/0xa0
> >   el0_sync_handler+0xe0/0x188
> >   el0_sync+0x164/0x180
> >
> > It is caused by the bogus nid (-1). Although the root cause is pmem dax
> > translates from pxm to node_id incorrectly due to numa_off, it is worth
> > hardening the codes in try_offline_node(), quiting if !pgdat.
> >
> > Signed-off-by: Jia He <justin.he@....com>
> > ---
> >  mm/memory_hotplug.c | 3 +++
> >  1 file changed, 3 insertions(+)
> >
> > diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
> > index da374cd3d45b..e1e290577b45 100644
> > --- a/mm/memory_hotplug.c
> > +++ b/mm/memory_hotplug.c
> > @@ -1680,6 +1680,9 @@ void try_offline_node(int nid)
> >  	pg_data_t *pgdat = NODE_DATA(nid);
> >  	int rc;
> >
> > +	if (WARN_ON(!pgdat))
> > +		return;
> > +
> >  	/*
> >  	 * If the node still spans pages (especially ZONE_DEVICE), don't
> >  	 * offline it. A node spans memory after move_pfn_range_to_zone(),
> >
> 
> Hm. If I am not wrong, somebody used add_memory() with another nid than
> try_remove_memory()?
> 

Yes after commit fa6d9ec790550, it can prevent this possibility.
I will drop this single patch. Thanks
--
Cheers,
Justin (Jia He)