| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <385da45a-16df-4c8b-ae5e-33734e21f827@lucifer.local>
Date: Wed, 2 Oct 2024 21:22:13 +0100
From: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>
To: Bert Karwatzki <spasswolf@....de>
Cc: "Liam R . Howlett" <Liam.Howlett@...cle.com>,
Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org,
linux-kernel@...r.kernel.org
Subject: Re: [PATCH v8 14/21] mm/mmap: Avoid zeroing vma tree in mmap_region()
On Wed, Oct 02, 2024 at 10:06:34PM GMT, Bert Karwatzki wrote:
[snip]
> >
> > diff --git a/mm/internal.h b/mm/internal.h
> > index 93083bbeeefa..cd9414b4651d 100644
> > --- a/mm/internal.h
> > +++ b/mm/internal.h
> > @@ -1443,4 +1443,19 @@ static inline void accept_page(struct page *page)
> > }
> > #endif /* CONFIG_UNACCEPTED_MEMORY */
> >
> > +static inline bool check_interesting(unsigned long start, unsigned long end)
> > +{
> > + const unsigned long interesting_start = 0x1740000;
> > + /* Include off-by-one on purpose.*/
> > + const unsigned long interesting_end = 0x68000000 + 1;
>
> In an earlier patch you requested this to be changed to 0x798b1000, is this
> correct?
>
Yes, please leave it as it is for now.
> > +
> > + /* interesting_start interesting_end
> > + * |--------------------------|
> > + * ============================> end
> > + * <============================= start
> > + */
> > + return end > interesting_start && /* after or overlaps... */
> > + start < interesting_end; /* ...overlaps. */
> > +}
> > +
> > #endif /* __MM_INTERNAL_H */
> > diff --git a/mm/mmap.c b/mm/mmap.c
> > index dd4b35a25aeb..8a1d5c0da86f 100644
> > --- a/mm/mmap.c
> > +++ b/mm/mmap.c
> > @@ -1341,6 +1341,18 @@ struct vm_area_struct *expand_stack(struct mm_struct *mm, unsigned long addr)
> > return vma;
> > }
> >
> > +static void ljs_dump(struct mm_struct *mm,
> > + unsigned long addr, unsigned long len,
> > + vm_flags_t vm_flags, bool is_unmap)
> > +{
> > + if (!check_interesting(addr, addr + len))
> > + return;
> > +
> > + pr_err("LJS: %s mm=%p [0x%lx, 0x%lx) [vm_flags=%lu]\n",
> > + is_unmap ? "munmap" : "mmap", mm, addr, addr + len,
> > + vm_flags);
> > +}
> > +
> > /* do_munmap() - Wrapper function for non-maple tree aware do_munmap() calls.
> > * @mm: The mm_struct
> > * @start: The start address to munmap
> > @@ -1354,6 +1366,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len,
> > {
> > VMA_ITERATOR(vmi, mm, start);
> >
> > + ljs_dump(mm, start, len, 0, true);
> > +
> > return do_vmi_munmap(&vmi, mm, start, len, uf, false);
> > }
> >
> > @@ -1375,6 +1389,8 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
> > VMA_ITERATOR(vmi, mm, addr);
> > VMG_STATE(vmg, mm, &vmi, addr, end, vm_flags, pgoff);
> >
> > + ljs_dump(mm, addr, len, vm_flags, false);
> > +
> > vmg.file = file;
> > /* Find the first overlapping VMA */
> > vma = vma_find(&vmi, end);
> > @@ -1390,6 +1406,12 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
> >
> > vmg.next = vms.next;
> > vmg.prev = vms.prev;
> > +
> > + if (check_interesting(addr, addr + len))
> > + pr_err("LJS: prev=[%lx, %lx), next=[%lx, %lx)\n",
> > + vmg.prev ? vmg.prev->vm_start : 0, vmg.prev ? vmg.prev->vm_end : 0,
> > + vmg.next ? vmg.next->vm_start : 0, vmg.next ? vmg.next->vm_end : 0);
> > +
> > vma = NULL;
> > } else {
> > vmg.next = vma_iter_next_rewind(&vmi, &vmg.prev);
> > @@ -1413,9 +1435,29 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
> > vmg.flags = vm_flags;
> > }
> >
> > + if (check_interesting(addr, addr + len)) {
> > + char *special = vm_flags & VM_SPECIAL ? "special" : "";
> > + char *has_file = file ? "file-backed" : "";
> > +
> > + pr_err("LJS: Interesting [%lx, %lx) flags=%lu, special=[%s] file=[%s]\n",
> > + addr, addr+len, vm_flags, special, has_file);
> > + }
> > +
> > vma = vma_merge_new_range(&vmg);
> > - if (vma)
> > + if (vma) {
> > + if (check_interesting(addr, addr + len)) {
> > + pr_err("LJS: Merged to [%lx, %lx), addr=%lx, end=%lx\n",
> > + vma->vm_start, vma->vm_end, vma_iter_addr(&vmi),
> > + vma_iter_end(&vmi));
> > +
> > + mt_validate(&mm->mm_mt);
> > + }
> > +
> > goto expanded;
> > + } else if (check_interesting(addr, addr + len)) {
> > + pr_err("LJS: Failed to merge [%lx, %lx), reset...\n",
> > + addr, addr + len);
> > + }
> > /*
> > * Determine the object being mapped and call the appropriate
> > * specific mapper. the address has already been validated, but
> > @@ -1441,6 +1483,11 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
> > if (error)
> > goto unmap_and_free_vma;
> >
> > + if (check_interesting(addr, addr + len)) {
> > + pr_err("LJS: call_mmap() on [%lx, %lx) old_flags=%lu new_flags=%lu new range=[%lx, %lx)\n",
> > + addr, addr + end, vm_flags, vma->vm_flags, vma->vm_start, vma->vm_end);
> > + }
> > +
> > if (vma_is_shared_maywrite(vma)) {
> > error = mapping_map_writable(file->f_mapping);
> > if (error)
> > @@ -1467,6 +1514,11 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
> > /* If this fails, state is reset ready for a reattempt. */
> > merge = vma_merge_new_range(&vmg);
> >
> > + if (check_interesting(addr, addr + len))
> > + pr_err("LJS: flags changed for [%lx, %lx) from %lu to %lu %s",
> > + vma->vm_start, vma->vm_end, vm_flags, vma->vm_flags,
> > + merge ? "merged" : "");
> > +
> > if (merge) {
> > /*
> > * ->mmap() can change vma->vm_file and fput
> > @@ -1510,10 +1562,18 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
> >
> > /* Lock the VMA since it is modified after insertion into VMA tree */
> > vma_start_write(vma);
> > +
> > + if (check_interesting(addr, addr + len))
> > + pr_err("LJS: mm=%p: iter store addr=%lx, end=%lx, vma=[%lx, %lx)\n",
> > + mm, vma_iter_addr(&vmi), vma_iter_end(&vmi), vma->vm_start, vma->vm_end);
> > +
> > vma_iter_store(&vmi, vma);
> > mm->map_count++;
> > vma_link_file(vma);
> >
> > + if (check_interesting(addr, addr + len))
> > + mt_validate(&mm->mm_mt);
> > +
> > /*
> > * vma_merge_new_range() calls khugepaged_enter_vma() too, the below
> > * call covers the non-merge case.
> > @@ -1530,6 +1590,10 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
> > perf_event_mmap(vma);
> >
> > /* Unmap any existing mapping in the area */
> > +
> > + if (check_interesting(addr, addr + len))
> > + mt_validate(&mm->mm_mt);
> > +
> > vms_complete_munmap_vmas(&vms, &mas_detach);
> >
> > vm_stat_account(mm, vm_flags, pglen);
> > diff --git a/mm/vma.c b/mm/vma.c
> > index 4737afcb064c..33f80e82704b 100644
> > --- a/mm/vma.c
> > +++ b/mm/vma.c
> > @@ -1108,8 +1108,13 @@ void vms_clean_up_area(struct vma_munmap_struct *vms,
> > vms_clear_ptes(vms, mas_detach, true);
> > mas_set(mas_detach, 0);
> > mas_for_each(mas_detach, vma, ULONG_MAX)
> > - if (vma->vm_ops && vma->vm_ops->close)
> > + if (vma->vm_ops && vma->vm_ops->close) {
> > + if (check_interesting(vma->vm_start, vma->vm_end))
> > + pr_err("LJS: mm=%p Closing [%lx, %lx)\n",
> > + vma->vm_mm, vma->vm_start, vma->vm_end);
> > +
> > vma->vm_ops->close(vma);
> > + }
> > vms->closed_vm_ops = true;
> > }
> >
> > @@ -1179,6 +1184,10 @@ int vms_gather_munmap_vmas(struct vma_munmap_struct *vms,
> > struct vm_area_struct *next = NULL;
> > int error;
> >
> > + if (check_interesting(vms->vma->vm_start, vms->vma->vm_end))
> > + pr_err("LJS2 vms->start=%lx, vms->vma->vm_start=%lx\n",
> > + vms->start, vms->vma->vm_start);
> > +
> > /*
> > * If we need to split any vma, do it now to save pain later.
> > * Does it split the first one?
> > @@ -1202,6 +1211,11 @@ int vms_gather_munmap_vmas(struct vma_munmap_struct *vms,
> > goto start_split_failed;
> > }
> >
> > + if (check_interesting(vms->vma->vm_start, vms->vma->vm_end))
> > + pr_err("LJS: mm=%p vms=[%lx, %lx) split START of [%lx, %lx)\n",
> > + vms->vma->vm_mm, vms->start, vms->end,
> > + vms->vma->vm_start, vms->vma->vm_end);
> > +
> > error = __split_vma(vms->vmi, vms->vma, vms->start, 1);
> > if (error)
> > goto start_split_failed;
> > @@ -1217,12 +1231,23 @@ int vms_gather_munmap_vmas(struct vma_munmap_struct *vms,
> > for_each_vma_range(*(vms->vmi), next, vms->end) {
> > long nrpages;
> >
> > + if (check_interesting(vms->vma->vm_start, vms->vma->vm_end))
> > + pr_err("LJS: mm=%p vms=[%lx, %lx) UNMAP [%lx, %lx)\n",
> > + vms->vma->vm_mm, vms->start, vms->end,
> > + next->vm_start, next->vm_end);
> > +
> > if (!can_modify_vma(next)) {
> > error = -EPERM;
> > goto modify_vma_failed;
> > }
> > /* Does it split the end? */
> > if (next->vm_end > vms->end) {
> > +
> > + if (check_interesting(next->vm_start, next->vm_end))
> > + pr_err("LJS: mm=%p vms=[%lx, %lx) split END of [%lx, %lx)\n",
> > + next->vm_mm, vms->start, vms->end,
> > + next->vm_start, next->vm_end);
> > +
> > error = __split_vma(vms->vmi, next, vms->end, 0);
> > if (error)
> > goto end_split_failed;
> > @@ -1295,9 +1320,14 @@ int vms_gather_munmap_vmas(struct vma_munmap_struct *vms,
> > }
> > #endif
> >
> > - while (vma_iter_addr(vms->vmi) > vms->start)
> > + while (vma_iter_addr(vms->vmi) > vms->start) {
> > vma_iter_prev_range(vms->vmi);
> >
> > + if (check_interesting(vms->vma->vm_start, vms->vma->vm_end))
> > + pr_err("LJS3: addr=%lx, vms->start=%lx\n",
> > + vma_iter_addr(vms->vmi), vms->start);
> > + }
> > +
> > vms->clear_ptes = true;
> > return 0;
> >
> > --
> > 2.46.2
>
> I just tested the "hunch" commit (without this patch) and it crashed in the same
> way. Here are more detailed instructions of how I create the crash:
>
> The game used is Rogue Heroes: Ruins of Tasos (which is basically Zelda). The
> game itself does not work anymore (even on unaffected kernel versions), it has
> been crashing with a
>
> Unhandled Exception:
> Microsoft.Xna.Framework.Graphics.NoSuitableGraphicsDeviceException: Failed to
> create graphics device! ---> System.TypeInitializationException: The type
> initializer for 'Microsoft.Xna.Framework.Graphics.GraphicsAdapter' threw an
> exception. ---> SharpDX.SharpDXException: HRESULT: [0x80004005], Module:
> [General], ApiCode: [E_FAIL/Unspecified error], Message: Call failed.
>
> error for sometime (probably a year).
>
> 1. Go to Properties->Compatibility and select "Force the use of specific Steam
> Play compatibility tool" and the select Proton 7.0-6
> 2. start the game, the game should then crash with the Xna error above
> 3. Go to Properties->Compatibility and unselect "Force the use of specific Steam
> Play compatibility tool"
> 4. start the game again, this will usually give the vma error (on two occasions
> so far the whole procedure (1-4) had to be done twice to get the error.
>
Thanks for this, however the game does work for me, at least on nvidia :)) I
continue to suspect an amd-specific issue here. I will try on my intel gpu
laptop too.
> Bert Karwatzki
>
Powered by blists - more mailing lists