linux-kernel - [PATCH] sched:add panic to remind that wake_q_node should be WAKE_Q

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240717161901.2375-1-buckzhang1212@yeah.net>
Date: Wed, 17 Jul 2024 09:19:01 -0700
From: buckzhang1212@...h.net
To: Ingo Molnar <mingo@...hat.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Juri Lelli <juri.lelli@...hat.com>,
	Vincent Guittot <vincent.guittot@...aro.org>
Cc: Dietmar Eggemann <dietmar.eggemann@....com>,
	Steven Rostedt <rostedt@...dmis.org>,
	Ben Segall <bsegall@...gle.com>,
	Mel Gorman <mgorman@...e.de>,
	Daniel Bristot de Oliveira <bristot@...hat.com>,
	Valentin Schneider <vschneid@...hat.com>,
	Nathan Chancellor <nathan@...nel.org>,
	Nick Desaulniers <ndesaulniers@...gle.com>,
	Bill Wendling <morbo@...gle.com>,
	Justin Stitt <justinstitt@...gle.com>,
	llvm@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	buckzhang1212@...h.net
Subject: [PATCH] sched:add panic to remind that wake_q_node should be WAKE_Q_TAIL when emtpy

From: "weihui.zhang" <buckzhang1212@...h.net>

Here is a kernel exception ,wake_q_node is NULL.
when wake_q_node empty ,it must be WAKE_Q_TAIL instead of NULL Logically.
Maybe a hardware bitflip corrupted the node ,add panic to call attention.
kernel crash:
Unable to handle kernel NULL pointer dereference at virtual address 00000
pc : wake_up_q+0x58/0xf4
lr : wake_up_q+0x7c/0xf4
sp : ffffffc0138cbb50
x29: ffffffc0138cbb50 x28: ffffff8080d49e08 x27: ffffff808206a500
x26: ffffff8085cc5c00 x25: b40000704f903000 x24: 0000000000000fd0
x23: 0000000000000000 x22: 0000000000000001 x21: 0000000000000000
x20: ffffff8092695c80 x19: ffffffc0138cbba8 x18: ffffffc013715048
x17: 0000000000000000 x16: 00000000000002a0 x15: 00000000000000cb
x14: 0000000000000000 x13: 0000000000000006 x12: 00000016201f7e4a
x8 : 0000000000000002 x7 : 0000000000000000 x6 : 0000000000000002
x5 : 0000000000000003 x4 : 0000000000000000 x3 : ffffffc0138cba20
x2 : ffffffc008258efc x1 : ffffffc008258efc x0 : ffffff8092695cb8
Call trace:
wake_up_q+0x58/0xf4
futex_wake+0x2c4/0x450
do_futex+0x1b0/0x890
__arm64_sys_futex+0x148/0x198
invoke_syscall+0x6c/0x15c
el0_svc_common.llvm.385418249754134116+0xd4/0x120
do_el0_svc+0x34/0xa4
el0_svc+0x28/0x90
el0t_64_sync_handler+0x88/0xec
el0t_64_sync+0x1b8/0x1bc
//x0:head ffffffc0138cbba8:  ffffff8092696508 *node = head->first
0xffffffc008258ea8 <wake_up_q+0x28>:	ldr	x21, [x0] 
//cmp WAKE_Q_TAIL if eq jump,but here is NULL.
0xffffffc008258ecc <wake_up_q+0x4c>:	cmp	x21, #0x1 
0xffffffc008258ed4 <wake_up_q+0x54>:	mov	x23, x21  //ffffff8092696508
0xffffffc008258ed8 <wake_up_q+0x58>:	ldr	x21, [x21]//kernelcrash
x21=NULL  [ffffff8092696508]=0000000000000000 node->next=NULL
init node fist:
|wake_q_init
 |head->first = WAKE_Q_TAIL;
empty node next：
 |__wake_a_add
   |cmpxchg_relaxed(node->next,NULL,WAKE_Q_TAIL)

Signed-off-by: weihui.zhang <buckzhang1212@...h.net>
---
 kernel/sched/core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 9116bcc90..ed755c2ab 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1015,6 +1015,10 @@ void wake_up_q(struct wake_q_head *head)
 	struct wake_q_node *node = head->first;
 
 	while (node != WAKE_Q_TAIL) {
+		if (node == NULL) {
+			pr_err("BUG:wake_q_node corrupted,node should be WAKE_Q_TAIL when emtpy\n");
+			panic("wake_q_node corrupted\n");
+		}
 		struct task_struct *task;
 
 		task = container_of(node, struct task_struct, wake_q);
-- 
2.17.1