linux-kernel - Re: [PATCH v12 1/3] ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <bf984773-2a8e-4528-9af1-9775fdc7c4e2@linux.alibaba.com>
Date: Thu, 5 Sep 2024 11:04:04 +0800
From: Shuai Xue <xueshuai@...ux.alibaba.com>
To: Jarkko Sakkinen <jarkko@...nel.org>, bp@...en8.de, rafael@...nel.org,
 wangkefeng.wang@...wei.com, tanxiaofei@...wei.com, mawupeng1@...wei.com,
 tony.luck@...el.com, linmiaohe@...wei.com, naoya.horiguchi@....com,
 james.morse@....com, tongtiangen@...wei.com, gregkh@...uxfoundation.org,
 will@...nel.org
Cc: linux-acpi@...r.kernel.org, linux-mm@...ck.org,
 linux-kernel@...r.kernel.org, akpm@...ux-foundation.org,
 linux-edac@...r.kernel.org, x86@...nel.org, justin.he@....com,
 ardb@...nel.org, ying.huang@...el.com, ashish.kalra@....com,
 baolin.wang@...ux.alibaba.com, tglx@...utronix.de, mingo@...hat.com,
 dave.hansen@...ux.intel.com, lenb@...nel.org, hpa@...or.com,
 robert.moore@...el.com, lvying6@...wei.com, xiexiuqi@...wei.com,
 zhuo.song@...ux.alibaba.com
Subject: Re: [PATCH v12 1/3] ACPI: APEI: send SIGBUS to current task if
 synchronous memory error not recovered



在 2024/9/4 00:09, Jarkko Sakkinen 写道:
> On Mon Sep 2, 2024 at 6:00 AM EEST, Shuai Xue wrote:
>> Synchronous error was detected as a result of user-space process accessing
>> a 2-bit uncorrected error. The CPU will take a synchronous error exception
>> such as Synchronous External Abort (SEA) on Arm64. The kernel will queue a
>> memory_failure() work which poisons the related page, unmaps the page, and
>> then sends a SIGBUS to the process, so that a system wide panic can be
>> avoided.
>>
>> However, no memory_failure() work will be queued unless all bellow
>> preconditions check passed:
>>
>> - `if (!(mem_err->validation_bits & CPER_MEM_VALID_PA))` in ghes_handle_memory_failure()
>> - `if (flags == -1)` in ghes_handle_memory_failure()
>> - `if (!IS_ENABLED(CONFIG_ACPI_APEI_MEMORY_FAILURE))` in ghes_do_memory_failure()
>> - `if (!pfn_valid(pfn) && !arch_is_platform_page(physical_addr)) ` in ghes_do_memory_failure()
>>
>> In such case, the user-space process will trigger SEA again.  This loop
>> can potentially exceed the platform firmware threshold or even trigger a
>> kernel hard lockup, leading to a system reboot.
>>
>> Fix it by performing a force kill if no memory_failure() work is queued
>> for synchronous errors.
>>
>> Suggested-by: Xiaofei Tan <tanxiaofei@...wei.com>
>> Signed-off-by: Shuai Xue <xueshuai@...ux.alibaba.com>
>>
>> ---
>>   drivers/acpi/apei/ghes.c | 10 ++++++++++
>>   1 file changed, 10 insertions(+)
>>
>> diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
>> index 623cc0cb4a65..b0b20ee533d9 100644
>> --- a/drivers/acpi/apei/ghes.c
>> +++ b/drivers/acpi/apei/ghes.c
>> @@ -801,6 +801,16 @@ static bool ghes_do_proc(struct ghes *ghes,
>>   		}
>>   	}
>>   
>> +	/*
>> +	 * If no memory failure work is queued for abnormal synchronous
>> +	 * errors, do a force kill.
>> +	 */
>> +	if (sync && !queued) {
>> +		pr_err("Sending SIGBUS to %s:%d due to hardware memory corruption\n",
>> +			current->comm, task_pid_nr(current));
> 
> Hmm... doest this need "hardware" or would "memory corruption" be
> enough?
> 
> Also, does this need to say that it is sending SIGBUS when the signal
> itself tells that already?
> 
> I.e. could "%s:%d has memory corruption" be enough information?

Hi, Jarkko,

Thank you for your suggestion. Maybe it could.

There are some similar error info which use "hardware memory error", e.g.

	static void kill_me_maybe(struct callback_head *cb)
	{
		pr_err("Uncorrected hardware memory error in user-access at %llx", 
p->mce_addr);
		...
		pr_err("Memory error not recovered");
		kill_me_now(cb);
	}
	
	static int kill_proc(struct to_kill *tk, unsigned long pfn, int flags)
	{
		pr_err("%#lx: Sending SIGBUS to %s:%d due to hardware memory 
corruption\n",
				pfn, t->comm, task_pid_nr(t));
		...
			ret = force_sig_mceerr(BUS_MCEERR_AR,
					 (void __user *)tk->addr, addr_lsb);
	
	}	

So, personally, I prefer this info to be consistent with them.


Best Regards,
Shuai