| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 3 Jul 2023 22:05:59 +0000
From: SeongJae Park <sj@...nel.org>
To: Sidhartha Kumar <sidhartha.kumar@...cle.com>
Cc: linux-kernel@...r.kernel.org, linux-mm@...ck.org,
akpm@...ux-foundation.org, willy@...radead.org
Subject: Re: [PATCH 3/4] mm/memory: convert do_shared_fault() to folios
Hi Sidharta,
On Sun, 2 Jul 2023 22:58:49 -0700 Sidhartha Kumar <sidhartha.kumar@...cle.com> wrote:
> Saves three implicit calls to compound_head().
>
> Signed-off-by: Sidhartha Kumar <sidhartha.kumar@...cle.com>
> ---
> mm/memory.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/mm/memory.c b/mm/memory.c
> index 93480e846ace6..33bf13431974c 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -4594,6 +4594,7 @@ static vm_fault_t do_shared_fault(struct vm_fault *vmf)
> {
> struct vm_area_struct *vma = vmf->vma;
> vm_fault_t ret, tmp;
> + struct folio *folio = page_folio(vmf->page);
>
> ret = __do_fault(vmf);
> if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY)))
> @@ -4604,11 +4605,11 @@ static vm_fault_t do_shared_fault(struct vm_fault *vmf)
> * about to become writable
> */
> if (vma->vm_ops->page_mkwrite) {
> - unlock_page(vmf->page);
> + folio_unlock(folio);
> tmp = do_page_mkwrite(vmf);
> if (unlikely(!tmp ||
> (tmp & (VM_FAULT_ERROR | VM_FAULT_NOPAGE)))) {
> - put_page(vmf->page);
> + folio_put(folio);
> return tmp;
> }
> }
> @@ -4616,8 +4617,8 @@ static vm_fault_t do_shared_fault(struct vm_fault *vmf)
> ret |= finish_fault(vmf);
> if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE |
> VM_FAULT_RETRY))) {
> - unlock_page(vmf->page);
> - put_page(vmf->page);
> + folio_unlock(folio);
> + folio_put(folio);
> return ret;
> }
I found the latest mm-unstable tree fails booting with stacktraces like below,
and bisecting points this patch (commit a43f078c7a3b of mm-unstable). Do you
have any idea?
[ 7.388551] BUG: kernel NULL pointer dereference, address: 0000000000000008
[ 7.389149] systemd[1]: Starting Load Kernel Module pstore_zone...
[ 7.390101] #PF: supervisor read access in kernel mode
[ 7.392370] #PF: error_code(0x0000) - not-present page
[ 7.392372] PGD 0 P4D 0
[ 7.392376] Oops: 0000 [#1] PREEMPT SMP PTI
[ 7.392379] CPU: 9 PID: 594 Comm: systemd-journal Not tainted 6.4.0+ #8
[ S7t.a3r9t2i3n82] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-4
[ 7.392384] RIP: 0010:_compound_head (include/linux/page-flags.h:245)
[ 7.400935] Code: e8 35 b5 cd ff 5d c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90f
Code starting with the faulting instruction
===========================================
0: e8 35 b5 cd ff callq 0xffffffffffcdb53a
5: 5d pop %rbp
6: c3 retq
7: cc int3
8: cc int3
9: cc int3
a: cc int3
b: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1)
12: 00 00 00 00
16: 0f 1f 40 00 nopl 0x0(%rax)
1a: 90 nop
1b: 0f .byte 0xf
[ 7.405283] RSP: 0000:ffffb86140cd3d58 EFLAGS: 00010202
[ 7.406551] RAX: ffff96d3c19c4d38 RBX: ffffffffa103f080 RCX: 00000001019c4067
[ 7.408233] RDX: 0000000000000000 RSI: ffff96d2c0000d38 RDI: 0000000000000000
[ 7.409893] RBP: ffffb86140cd3d90 R08: ffff96d3c19c4d38 R09: 0000000000000067
[ 7.411457] R10: 0000000000000000 R11: 00007f2ae19d5fff R12: ffffb86140cd3dd0
[ 7.412792] R13: 0000000000000001 R14: ffff96d3cb7aa450 R15: 0000000000000860
[ 7.414139] FS: 00007f2ae0f40980(0000) GS:ffff96f1fd640000(0000) knlGS:0000000000000000
[ 7.415699] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 7.416780] CR2: 0000000000000008 CR3: 0000000104830000 CR4: 00000000000006e0
[ 7.418115] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 7.419492] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 7.420830] Call Trace:
[ 7.421308] <TASK>
[ 7.421722] ? show_regs (arch/x86/kernel/dumpstack.c:479)
[ 7.422411] ? __die_body (arch/x86/kernel/dumpstack.c:421)
[ 7.423113] ? __die (arch/x86/kernel/dumpstack.c:435)
[ 7.423716] ? page_fault_oops (arch/x86/mm/fault.c:707)
[ 7.424504] ? search_bpf_extables (kernel/bpf/core.c:751)
[ 7.425329] ? __pfx__compound_head (include/linux/page-flags.h:245)
[ 7.426171] ? search_exception_tables (kernel/extable.c:64)
[ 7.427084] ? kernelmode_fixup_or_oops (arch/x86/mm/fault.c:762)
[ 7.427995] ? __bad_area_nosemaphore (arch/x86/mm/fault.c:860)
[ 7.428891] ? up_read (arch/x86/include/asm/preempt.h:104 kernel/locking/rwsem.c:1354 kernel/locking/rwsem.c:1616)
[ 7.429514] ? bad_area_nosemaphore (arch/x86/mm/fault.c:867)
[ 7.430367] ? do_user_addr_fault (arch/x86/mm/fault.c:1458)
[ 7.431238] ? exc_page_fault (arch/x86/include/asm/paravirt.h:695 arch/x86/mm/fault.c:1495 arch/x86/mm/fault.c:1543)
[ 7.431998] ? asm_exc_page_fault (arch/x86/include/asm/idtentry.h:570)
[ 7.432802] ? __pfx__compound_head (include/linux/page-flags.h:245)
[ 7.433640] ? do_pte_missing (mm/memory.c:4610 mm/memory.c:4682 mm/memory.c:3670)
[ 7.434425] __handle_mm_fault (mm/memory.c:4947 mm/memory.c:5087)
[ 7.435234] handle_mm_fault (mm/memory.c:5252)
[ 7.435976] do_user_addr_fault (arch/x86/mm/fault.c:1393)
[ 7.436786] exc_page_fault (arch/x86/include/asm/paravirt.h:695 arch/x86/mm/fault.c:1495 arch/x86/mm/fault.c:1543)
[ 7.437517] asm_exc_page_fault (arch/x86/include/asm/idtentry.h:570)
[ 7.438294] RIP: 0033:0x7f2ae1480ace
[ 7.439035] Code: 8d a0 48 00 00 00 49 8b 44 24 08 48 0b 85 48 00 00 00 74 28 48 8d 3d f1 63 1d 00 e8f
Code starting with the faulting instruction
===========================================
0: 8d a0 48 00 00 00 lea 0x48(%rax),%esp
6: 49 8b 44 24 08 mov 0x8(%r12),%rax
b: 48 0b 85 48 00 00 00 or 0x48(%rbp),%rax
12: 74 28 je 0x3c
14: 48 8d 3d f1 63 1d 00 lea 0x1d63f1(%rip),%rdi # 0x1d640c
1b: 8f .byte 0x8f
[ 7.442519] RSP: 002b:00007ffdfa53bc70 EFLAGS: 00010246
[ 7.443524] RAX: 0000000000000000 RBX: 00007f2ae19a7028 RCX: fffffffffffff000
[ 7.444857] RDX: 00007f2ae0f412e0 RSI: a3d70a3d70a3d70b RDI: 00007f2ae1656eb0
[ 7.446195] RBP: 00007f2ae0f40828 R08: 0000000000000001 R09: 00007f2ae19a7000
[ 7.447572] R10: 000055f8d50a1010 R11: 0000000000000246 R12: 00007f2ae0f40870
[ 7.448939] R13: 000055f8d50a7110 R14: 000055f8d50a2fd0 R15: 0000000000000001
[ 7.450277] </TASK>
[ 7.450725] Modules linked in: ip_tables x_tables autofs4 raid10 raid456 libcrc32c async_raid6_recov 4
[ 7.454653] Dumping ftrace buffer:
[ 7.455321] (ftrace buffer empty)
[ 7.456014] CR2: 0000000000000008
[ 7.456686] ---[ end trace 0000000000000000 ]---
[ 7.457576] RIP: 0010:_compound_head (include/linux/page-flags.h:245)
[ 7.458440] Code: e8 35 b5 cd ff 5d c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90f
Code starting with the faulting instruction
===========================================
0: e8 35 b5 cd ff callq 0xffffffffffcdb53a
5: 5d pop %rbp
6: c3 retq
7: cc int3
8: cc int3
9: cc int3
a: cc int3
b: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1)
12: 00 00 00 00
16: 0f 1f 40 00 nopl 0x0(%rax)
1a: 90 nop
1b: 0f .byte 0xf
[ 7.461986] RSP: 0000:ffffb86140cd3d58 EFLAGS: 00010202
[ 7.463014] RAX: ffff96d3c19c4d38 RBX: ffffffffa103f080 RCX: 00000001019c4067
[ 7.464374] RDX: 0000000000000000 RSI: ffff96d2c0000d38 RDI: 0000000000000000
[ 7.465731] RBP: ffffb86140cd3d90 R08: ffff96d3c19c4d38 R09: 0000000000000067
[ 7.467114] R10: 0000000000000000 R11: 00007f2ae19d5fff R12: ffffb86140cd3dd0
[ 7.468469] R13: 0000000000000001 R14: ffff96d3cb7aa450 R15: 0000000000000860
[ 7.469824] FS: 00007f2ae0f40980(0000) GS:ffff96f1fd640000(0000) knlGS:0000000000000000
[ 7.471383] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 7.472482] CR2: 0000000000000008 CR3: 0000000104830000 CR4: 00000000000006e0
[ 7.473835] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 7.475216] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Thanks,
SJ
Powered by blists - more mailing lists