linux-kernel - Re: Regression from a9b3c355c2e6 ("asm-generic: pgalloc: provide generic __pgd_{alloc,free}") with CONFIG_DEBUG_VM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2025416135325-Z_-2VTPsw81jMgCm-arkamar@atlas.cz>
Date: Wed, 16 Apr 2025 15:53:25 +0200
From: Petr Vaněk <arkamar@...as.cz>
To: Matthew Wilcox <willy@...radead.org>
Cc: Juergen Gross <jgross@...e.com>, linux-kernel@...r.kernel.org,
	Kevin Brodsky <kevin.brodsky@....com>,
	Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org,
	x86@...nel.org, xen-devel@...ts.xenproject.org,
	linux-arch@...r.kernel.org
Subject: Re: Regression from a9b3c355c2e6 ("asm-generic: pgalloc: provide
 generic __pgd_{alloc,free}") with CONFIG_DEBUG_VM_PGFLAGS=y and Xen

On Wed, Apr 16, 2025 at 01:41:51PM +0100, Matthew Wilcox wrote:
> On Wed, Apr 16, 2025 at 02:07:20PM +0200, Petr Vaněk wrote:
> > I have discovered a regression introduced in commit a9b3c355c2e6
> > ("asm-generic: pgalloc: provide generic __pgd_{alloc,free}") [1,2] in
> > kernel version 6.14. The problem occurs when the x86 kernel is
> > configured with CONFIG_DEBUG_VM_PGFLAGS=y and is run as a PV Dom0 in Xen
> > 4.19.1. During the startup, the kernel panics with the error log below.
> 
> You also have to have CONFIG_MITIGATION_PAGE_TABLE_ISOLATION enabled
> to hit this problem, otherwise we allocate an order-0 page.

Indeed, the issue disappears when I disable
CONFIG_MITIGATION_PAGE_TABLE_ISOLATION.

> > The commit changed PGD allocation path.  In the new implementation
> > _pgd_alloc allocates memory with __pgd_alloc, which indirectly calls 
> > 
> >   alloc_pages_noprof(gfp | __GFP_COMP, order);
> > 
> > This is in contrast to the old behavior, where __get_free_pages was
> > used, which indirectly called
> > 
> >   alloc_pages_noprof(gfp_mask & ~__GFP_HIGHMEM, order);
> > 
> > The key difference is that the new allocator can return a compound page.
> > When xen_pin_page is later called on such a page, it call
> > TestSetPagePinned function, which internally uses the PF_NO_COMPOUND
> > macro. This macro enforces VM_BUG_ON_PGFLAGS if PageCompound is true,
> > triggering the panic when CONFIG_DEBUG_VM_PGFLAGS is enabled.
> 
> I suspect the right thing to do here is to change the PF_NO_COMPOUND to
> PF_HEAD.  Probably for all of these:
> 
> /* Xen */
> PAGEFLAG(Pinned, pinned, PF_NO_COMPOUND)
>         TESTSCFLAG(Pinned, pinned, PF_NO_COMPOUND)
> PAGEFLAG(SavePinned, savepinned, PF_NO_COMPOUND);
> PAGEFLAG(Foreign, foreign, PF_NO_COMPOUND);
> PAGEFLAG(XenRemapped, xen_remapped, PF_NO_COMPOUND)
>         TESTCLEARFLAG(XenRemapped, xen_remapped, PF_NO_COMPOUND)
> 
> Could you give that a try?

Yes, I could. Changing PF_NO_COMPOUND to PF_HEAD in those lines resolves
the issue for me.

Petr