linux-kernel - Re: Regression from a9b3c355c2e6 ("asm-generic: pgalloc: provide generic __pgd_{alloc,free}") with CONFIG_DEBUG_VM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z_-lj5kCg084MXRI@casper.infradead.org>
Date: Wed, 16 Apr 2025 13:41:51 +0100
From: Matthew Wilcox <willy@...radead.org>
To: Petr Vaněk <arkamar@...as.cz>
Cc: linux-kernel@...r.kernel.org, Kevin Brodsky <kevin.brodsky@....com>,
	Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org,
	x86@...nel.org, xen-devel@...ts.xenproject.org,
	linux-arch@...r.kernel.org
Subject: Re: Regression from a9b3c355c2e6 ("asm-generic: pgalloc: provide
 generic __pgd_{alloc,free}") with CONFIG_DEBUG_VM_PGFLAGS=y and Xen

On Wed, Apr 16, 2025 at 02:07:20PM +0200, Petr Vaněk wrote:
> I have discovered a regression introduced in commit a9b3c355c2e6
> ("asm-generic: pgalloc: provide generic __pgd_{alloc,free}") [1,2] in
> kernel version 6.14. The problem occurs when the x86 kernel is
> configured with CONFIG_DEBUG_VM_PGFLAGS=y and is run as a PV Dom0 in Xen
> 4.19.1. During the startup, the kernel panics with the error log below.

You also have to have CONFIG_MITIGATION_PAGE_TABLE_ISOLATION enabled
to hit this problem, otherwise we allocate an order-0 page.

> The commit changed PGD allocation path.  In the new implementation
> _pgd_alloc allocates memory with __pgd_alloc, which indirectly calls 
> 
>   alloc_pages_noprof(gfp | __GFP_COMP, order);
> 
> This is in contrast to the old behavior, where __get_free_pages was
> used, which indirectly called
> 
>   alloc_pages_noprof(gfp_mask & ~__GFP_HIGHMEM, order);
> 
> The key difference is that the new allocator can return a compound page.
> When xen_pin_page is later called on such a page, it call
> TestSetPagePinned function, which internally uses the PF_NO_COMPOUND
> macro. This macro enforces VM_BUG_ON_PGFLAGS if PageCompound is true,
> triggering the panic when CONFIG_DEBUG_VM_PGFLAGS is enabled.

I suspect the right thing to do here is to change the PF_NO_COMPOUND to
PF_HEAD.  Probably for all of these:

/* Xen */
PAGEFLAG(Pinned, pinned, PF_NO_COMPOUND)
        TESTSCFLAG(Pinned, pinned, PF_NO_COMPOUND)
PAGEFLAG(SavePinned, savepinned, PF_NO_COMPOUND);
PAGEFLAG(Foreign, foreign, PF_NO_COMPOUND);
PAGEFLAG(XenRemapped, xen_remapped, PF_NO_COMPOUND)
        TESTCLEARFLAG(XenRemapped, xen_remapped, PF_NO_COMPOUND)

Could you give that a try?