linux-kernel - Re: [PATCH v2 1/3] mm/debug_vm_pgtable: remove pte entry from the page table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+CK2bAWHsgnrH=xKvwEX14J2cwaJ2PHRMK4LXt2f602Yamxtg@mail.gmail.com>
Date:   Fri, 21 Jan 2022 09:03:45 -0500
From:   Pasha Tatashin <pasha.tatashin@...een.com>
To:     Anshuman Khandual <anshuman.khandual@....com>
Cc:     LKML <linux-kernel@...r.kernel.org>, linux-mm <linux-mm@...ck.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        David Rientjes <rientjes@...gle.com>,
        Paul Turner <pjt@...gle.com>, Wei Xu <weixugc@...gle.com>,
        Greg Thelen <gthelen@...gle.com>,
        Ingo Molnar <mingo@...hat.com>, Will Deacon <will@...nel.org>,
        Mike Rapoport <rppt@...nel.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        "Aneesh Kumar K.V" <aneesh.kumar@...ux.ibm.com>,
        Jiri Slaby <jirislaby@...nel.org>,
        Muchun Song <songmuchun@...edance.com>,
        Fusion Future <qydwhotmail@...il.com>,
        Hugh Dickins <hughd@...gle.com>, Zi Yan <ziy@...dia.com>
Subject: Re: [PATCH v2 1/3] mm/debug_vm_pgtable: remove pte entry from the
 page table

Hi Anshuman,

Thanks for looking into this. See my replies below.

> > CONFIG_DEBUG_VM_PGTABLE=y
> > CONFIG_PAGE_TABLE_CHECK=y
> > CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
>
> Assuming this is on latest mainline.
>
> I could enable PAGE_TABLE_CHECK on arm64 after some hacks. It did not build
> on the platform otherwise. But enabling DEBUG_VM_PGTABLE afterwards did not
> create below mentioned problems. Is the problem x86 specific ?

This is not x86 specific problem, but page_table_check does not have
support for other arches yet. The arm64 support is on my todo list.
The patch for arm64 would look something like this:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d283d422c6c4f0264fe8ecf5ae80036bf73f4594

>
> >
> > During the boot the following BUG is printed:
> >
> > [    7.483050][    T1] debug_vm_pgtable: [debug_vm_pgtable         ]:
> > Validating architecture page tabs
> > [    7.490930][    T1] ------------[ cut here ]------------
> > [    7.494926][    T1] kernel BUG at mm/page_table_check.c:194!
>
> Which BUG() is this ? mm/page_table_check.c:194 on latest mainline ..
>
> void __page_table_check_pud_clear(struct mm_struct *mm, unsigned long addr,
>                                   pud_t pud) <----

It turns out I pasted the backtrace from the modified kernel. Here the
snippet of backtrace from the mainline:
[    2.276826] ------------[ cut here ]------------
[    2.280426] kernel BUG at mm/page_table_check.c:162!
[    2.284118] invalid opcode: 0000 [#1] PREEMPT SMP PTI
...

Which corresponds to:
152 void __page_table_check_zero(struct page *page, unsigned int order)
153 {
154         struct page_ext *page_ext = lookup_page_ext(page);
155         int i;
156
157         BUG_ON(!page_ext);
158         for (i = 0; i < (1 << order); i++) {
159                 struct page_table_check *ptc =
get_page_table_check(page_ext);
160
161                 BUG_ON(atomic_read(&ptc->anon_map_count));
162                 BUG_ON(atomic_read(&ptc->file_map_count));

I will update the bug log with the mainline backtrace.

>
> > [    7.499172][    T1] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
> > [    7.503610][    T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.16.0+
> > [    7.508600][    T1] Hardware name: QEMU Standard PC (i440FX + PIIX,
> > ...
> >
> > The entry should be properly removed from the page table before the page
> > is released to the free list.
> >
> > Fixes: a5c3b9ffb0f4 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers")
> I am not sure whether this really fixes an existing problem.

What is detected is that a page that potentially has a PTE entry in a
user page table was put on a free list. It is not an issue for this
test, but would be an issue if it happened elsewhere.

>
> >
> > Signed-off-by: Pasha Tatashin <pasha.tatashin@...een.com>
> > Reviewed-by: Zi Yan <ziy@...dia.com>
> > Tested-by: Zi Yan <ziy@...dia.com>
> > ---
> >  mm/debug_vm_pgtable.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/mm/debug_vm_pgtable.c b/mm/debug_vm_pgtable.c
> > index a7ac97c76762..db2abd9e415b 100644
> > --- a/mm/debug_vm_pgtable.c
> > +++ b/mm/debug_vm_pgtable.c
> > @@ -171,6 +171,8 @@ static void __init pte_advanced_tests(struct pgtable_debug_args *args)
> >       ptep_test_and_clear_young(args->vma, args->vaddr, args->ptep);
> >       pte = ptep_get(args->ptep);
> >       WARN_ON(pte_young(pte));
> > +
> > +     ptep_get_and_clear_full(args->mm, args->vaddr, args->ptep, 1);
> >  }
>
> Although I dont see any problem on arm64 after this change.

This is because page_table_check does not have support for anything
beside x86 at the moment.

>
> >
> >  static void __init pte_savedwrite_tests(struct pgtable_debug_args *args)
> >

Pasha