| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CABXGCsMSb1=4krh0d2LYNAN4BYxyuktjthuQdRQSKsANKoeOJA@mail.gmail.com>
Date: Thu, 23 May 2024 11:34:37 +0500
From: Mikhail Gavrilov <mikhail.v.gavrilov@...il.com>
To: Peter Xu <peterx@...hat.com>
Cc: David Hildenbrand <david@...hat.com>, Pavel Tatashin <pasha.tatashin@...een.com>,
axelrasmussen@...gle.com, nadav.amit@...il.com,
Andrew Morton <akpm@...ux-foundation.org>,
Linux Memory Management List <linux-mm@...ck.org>,
Linux List Kernel Mailing <linux-kernel@...r.kernel.org>
Subject: Re: 6.10/bisected/regression - commit 8430557fc584 cause warning at
mm/page_table_check.c:198 __page_table_check_ptes_set+0x306
On Wed, May 22, 2024 at 9:10 PM Peter Xu <peterx@...hat.com> wrote:
>
> ===8<===
> From c10cde00b14d2d305390dd418a8a8855d3e6437f Mon Sep 17 00:00:00 2001
> From: Peter Xu <peterx@...hat.com>
> Date: Wed, 22 May 2024 12:04:33 -0400
> Subject: [PATCH] drop RANDOM_ORVALUE bits
>
> Signed-off-by: Peter Xu <peterx@...hat.com>
> ---
> mm/debug_vm_pgtable.c | 30 ++++--------------------------
> 1 file changed, 4 insertions(+), 26 deletions(-)
>
> diff --git a/mm/debug_vm_pgtable.c b/mm/debug_vm_pgtable.c
> index f1c9a2c5abc0..b5d7be05063a 100644
> --- a/mm/debug_vm_pgtable.c
> +++ b/mm/debug_vm_pgtable.c
> @@ -40,22 +40,7 @@
> * Please refer Documentation/mm/arch_pgtable_helpers.rst for the semantics
> * expectations that are being validated here. All future changes in here
> * or the documentation need to be in sync.
> - *
> - * On s390 platform, the lower 4 bits are used to identify given page table
> - * entry type. But these bits might affect the ability to clear entries with
> - * pxx_clear() because of how dynamic page table folding works on s390. So
> - * while loading up the entries do not change the lower 4 bits. It does not
> - * have affect any other platform. Also avoid the 62nd bit on ppc64 that is
> - * used to mark a pte entry.
> */
> -#define S390_SKIP_MASK GENMASK(3, 0)
> -#if __BITS_PER_LONG == 64
> -#define PPC64_SKIP_MASK GENMASK(62, 62)
> -#else
> -#define PPC64_SKIP_MASK 0x0
> -#endif
> -#define ARCH_SKIP_MASK (S390_SKIP_MASK | PPC64_SKIP_MASK)
> -#define RANDOM_ORVALUE (GENMASK(BITS_PER_LONG - 1, 0) & ~ARCH_SKIP_MASK)
> #define RANDOM_NZVALUE GENMASK(7, 0)
>
> struct pgtable_debug_args {
> @@ -511,8 +496,7 @@ static void __init pud_clear_tests(struct pgtable_debug_args *args)
> return;
>
> pr_debug("Validating PUD clear\n");
> - pud = __pud(pud_val(pud) | RANDOM_ORVALUE);
> - WRITE_ONCE(*args->pudp, pud);
> + WARN_ON(pud_none(pud));
> pud_clear(args->pudp);
> pud = READ_ONCE(*args->pudp);
> WARN_ON(!pud_none(pud));
> @@ -548,8 +532,7 @@ static void __init p4d_clear_tests(struct pgtable_debug_args *args)
> return;
>
> pr_debug("Validating P4D clear\n");
> - p4d = __p4d(p4d_val(p4d) | RANDOM_ORVALUE);
> - WRITE_ONCE(*args->p4dp, p4d);
> + WARN_ON(p4d_none(p4d));
> p4d_clear(args->p4dp);
> p4d = READ_ONCE(*args->p4dp);
> WARN_ON(!p4d_none(p4d));
> @@ -582,8 +565,7 @@ static void __init pgd_clear_tests(struct pgtable_debug_args *args)
> return;
>
> pr_debug("Validating PGD clear\n");
> - pgd = __pgd(pgd_val(pgd) | RANDOM_ORVALUE);
> - WRITE_ONCE(*args->pgdp, pgd);
> + WARN_ON(pgd_none(pgd));
> pgd_clear(args->pgdp);
> pgd = READ_ONCE(*args->pgdp);
> WARN_ON(!pgd_none(pgd));
> @@ -634,9 +616,6 @@ static void __init pte_clear_tests(struct pgtable_debug_args *args)
> if (WARN_ON(!args->ptep))
> return;
>
> -#ifndef CONFIG_RISCV
> - pte = __pte(pte_val(pte) | RANDOM_ORVALUE);
> -#endif
> set_pte_at(args->mm, args->vaddr, args->ptep, pte);
> flush_dcache_page(page);
> barrier();
> @@ -650,8 +629,7 @@ static void __init pmd_clear_tests(struct pgtable_debug_args *args)
> pmd_t pmd = READ_ONCE(*args->pmdp);
>
> pr_debug("Validating PMD clear\n");
> - pmd = __pmd(pmd_val(pmd) | RANDOM_ORVALUE);
> - WRITE_ONCE(*args->pmdp, pmd);
> + WARN_ON(pmd_none(pmd));
> pmd_clear(args->pmdp);
> pmd = READ_ONCE(*args->pmdp);
> WARN_ON(!pmd_none(pmd));
> --
> 2.45.0
>
> --
> Peter Xu
>
Good news the patch works and the warning at mm/page_table_check.c:198
__page_table_check_ptes_set+0x306 is gone.
Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@...il.com>
Bad news the testing terminated with an old annoying problem which
appeared during the 6.9 release cycle [1] and looks like it has not
been fixed yet.
[24119.281379] BUG: Bad page state in process kcompactd0 pfn:3ae37e
[24119.281387] page: refcount:0 mapcount:0 mapping:00000000d16c2d75
index:0x272ea3200 pfn:0x3ae37e
[24119.281390] aops:btree_aops ino:1
[24119.281395] flags:
0x17ffffc000020c(referenced|uptodate|workingset|node=0|zone=2|lastcpupid=0x1fffff)
[24119.281400] raw: 0017ffffc000020c dead000000000100 dead000000000122
ffff888136ecd220
[24119.281402] raw: 0000000272ea3200 0000000000000000 00000000ffffffff
0000000000000000
[24119.281403] page dumped because: non-NULL mapping
[24119.281405] Modules linked in: overlay tun crypto_user uinput
snd_seq_dummy snd_hrtimer rfcomm nf_conntrack_netbios_ns
nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib
nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct
nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set
nf_tables qrtr uhid bnep sunrpc binfmt_misc amd_atl intel_rapl_msr
intel_rapl_common mt76x2u mt76x2_common mt7921e mt7921_common
mt76x02_usb mt76_usb mt792x_lib mt76x02_lib mt76_connac_lib vfat mt76
fat mac80211 snd_hda_codec_hdmi snd_hda_intel edac_mce_amd
snd_intel_dspcfg snd_intel_sdw_acpi snd_usb_audio uvcvideo
snd_hda_codec kvm_amd btusb snd_usbmidi_lib uvc snd_hda_core snd_ump
btrtl videobuf2_vmalloc btintel videobuf2_memops snd_rawmidi snd_hwdep
videobuf2_v4l2 btbcm btmtk snd_seq videobuf2_common libarc4
snd_seq_device kvm bluetooth ledtrig_netdev videodev snd_pcm cfg80211
joydev asus_nb_wmi eeepc_wmi mc snd_timer asus_wmi sparse_keymap rapl
apple_mfi_fastcharge snd wmi_bmof platform_profile
[24119.281465] pcspkr igc k10temp soundcore i2c_piix4 rfkill
gpio_amdpt gpio_generic loop nfnetlink zram amdgpu crct10dif_pclmul
crc32_pclmul crc32c_intel amdxcp polyval_clmulni i2c_algo_bit
polyval_generic drm_ttm_helper ttm nvme drm_exec ghash_clmulni_intel
gpu_sched drm_suballoc_helper sha512_ssse3 drm_buddy nvme_core ccp
sha256_ssse3 drm_display_helper sha1_ssse3 sp5100_tco video nvme_auth
wmi hid_apple ip6_tables ip_tables fuse
[24119.281496] CPU: 30 PID: 221 Comm: kcompactd0 Tainted: G W
L 6.9.0-test-5f16eb0549ab-with-drop-RANDOM_ORVALUE-bits+ #34
[24119.281498] Hardware name: ASUS System Product Name/ROG STRIX
B650E-I GAMING WIFI, BIOS 2611 04/07/2024
[24119.281500] Call Trace:
[24119.281502] <TASK>
[24119.281503] dump_stack_lvl+0x84/0xd0
[24119.281508] bad_page.cold+0xbe/0xe0
[24119.281510] ? __pfx_bad_page+0x10/0x10
[24119.281514] ? page_bad_reason+0x9d/0x1f0
[24119.281517] free_unref_page+0x838/0x10e0
[24119.281520] __folio_put+0x1ba/0x2b0
[24119.281523] ? __pfx___folio_put+0x10/0x10
[24119.281525] ? __pfx___might_resched+0x10/0x10
[24119.281528] ? migrate_folio_done+0x1de/0x2b0
[24119.281531] migrate_pages_batch+0xe73/0x2880
[24119.281534] ? __pfx_compaction_alloc+0x10/0x10
[24119.281536] ? __pfx_compaction_free+0x10/0x10
[24119.281539] ? __pfx_migrate_pages_batch+0x10/0x10
[24119.281543] ? rcu_is_watching+0x12/0xc0
[24119.281546] migrate_pages+0x194f/0x22f0
[24119.281548] ? __pfx_compaction_alloc+0x10/0x10
[24119.281550] ? __pfx_compaction_free+0x10/0x10
[24119.281553] ? __pfx_migrate_pages+0x10/0x10
[24119.281555] ? rcu_is_watching+0x12/0xc0
[24119.281557] ? isolate_migratepages_block+0x2b02/0x4560
[24119.281561] ? __pfx_isolate_migratepages_block+0x10/0x10
[24119.281563] ? folio_putback_lru+0x5e/0xb0
[24119.281566] compact_zone+0x1a7c/0x3860
[24119.281569] ? rcu_is_watching+0x12/0xc0
[24119.281571] ? __pfx___free_object+0x10/0x10
[24119.281575] ? __pfx_compact_zone+0x10/0x10
[24119.281577] ? rcu_is_watching+0x12/0xc0
[24119.281579] ? lock_acquire+0x457/0x540
[24119.281581] ? kcompactd+0x2fa/0xc70
[24119.281583] ? rcu_is_watching+0x12/0xc0
[24119.281585] compact_node+0x144/0x240
[24119.281588] ? __pfx_compact_node+0x10/0x10
[24119.281593] ? rcu_is_watching+0x12/0xc0
[24119.281595] kcompactd+0x686/0xc70
[24119.281598] ? __pfx_kcompactd+0x10/0x10
[24119.281600] ? __pfx_autoremove_wake_function+0x10/0x10
[24119.281603] ? __kthread_parkme+0xb1/0x1d0
[24119.281605] ? __pfx_kcompactd+0x10/0x10
[24119.281608] ? __pfx_kcompactd+0x10/0x10
[24119.281610] kthread+0x2d2/0x3a0
[24119.281612] ? _raw_spin_unlock_irq+0x28/0x60
[24119.281614] ? __pfx_kthread+0x10/0x10
[24119.281616] ret_from_fork+0x31/0x70
[24119.281618] ? __pfx_kthread+0x10/0x10
[24119.281620] ret_from_fork_asm+0x1a/0x30
[24119.281624] </TASK>
[24171.367867] watchdog: BUG: soft lockup - CPU#25 stuck for 26s!
[kworker/u130:3:2474335]
I attached the full kernel log below.
[1] https://lore.kernel.org/linux-kernel/CABXGCsPktcHQOvKTbPaTwegMExije=Gpgci5NW=hqORo-s7diA@mail.gmail.com/
--
Best Regards,
Mike Gavrilov.
Download attachment "dmesg.zip" of type "application/zip" (78203 bytes)
Powered by blists - more mailing lists