From: Steven Rostedt <rostedt@goodmis.org>
To: linux-kernel@vger.kernel.org,
linux-rt-users <linux-rt-users@vger.kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>,
Carsten Emde <C.Emde@osadl.org>,
Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
John Kacur <jkacur@redhat.com>, Julia Cartwright <julia@ni.com>,
Daniel Wagner <wagi@monom.org>, Tom Zanussi <zanussi@kernel.org>
Subject: [PATCH RT 26/32] Revert "ARM: Initialize split page table locks for vector page"
Date: Fri, 17 Jan 2020 12:41:37 -0500 [thread overview]
Message-ID: <20200117174131.301899171@goodmis.org> (raw)
In-Reply-To: 20200117174111.282847363@goodmis.org
4.19.94-rt39-rc1 stable review patch.
If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit 247074c44d8c3e619dfde6404a52295d8d671d38 ]
I'm dropping this patch, with its original description:
|ARM: Initialize split page table locks for vector page
|
|Without this patch, ARM can not use SPLIT_PTLOCK_CPUS if
|PREEMPT_RT_FULL=y because vectors_user_mapping() creates a
|VM_ALWAYSDUMP mapping of the vector page (address 0xffff0000), but no
|ptl->lock has been allocated for the page. An attempt to coredump
|that page will result in a kernel NULL pointer dereference when
|follow_page() attempts to lock the page.
|
|The call tree to the NULL pointer dereference is:
|
| do_notify_resume()
| get_signal_to_deliver()
| do_coredump()
| elf_core_dump()
| get_dump_page()
| __get_user_pages()
| follow_page()
| pte_offset_map_lock() <----- a #define
| ...
| rt_spin_lock()
|
|The underlying problem is exposed by mm-shrink-the-page-frame-to-rt-size.patch.
The patch named mm-shrink-the-page-frame-to-rt-size.patch was dropped
from the RT queue once the SPLIT_PTLOCK_CPUS feature (in a slightly
different shape) went upstream (somewhere between v3.12 and v3.14).
I can see that the patch still allocates a lock which wasn't there
before. However I can't trigger a kernel oops like described in the
patch by triggering a coredump.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
---
arch/arm/kernel/process.c | 24 ------------------------
1 file changed, 24 deletions(-)
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 8d3c7ce34c24..82ab015bf42b 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -324,30 +324,6 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
}
#ifdef CONFIG_MMU
-/*
- * CONFIG_SPLIT_PTLOCK_CPUS results in a page->ptl lock. If the lock is not
- * initialized by pgtable_page_ctor() then a coredump of the vector page will
- * fail.
- */
-static int __init vectors_user_mapping_init_page(void)
-{
- struct page *page;
- unsigned long addr = 0xffff0000;
- pgd_t *pgd;
- pud_t *pud;
- pmd_t *pmd;
-
- pgd = pgd_offset_k(addr);
- pud = pud_offset(pgd, addr);
- pmd = pmd_offset(pud, addr);
- page = pmd_page(*(pmd));
-
- pgtable_page_ctor(page);
-
- return 0;
-}
-late_initcall(vectors_user_mapping_init_page);
-
#ifdef CONFIG_KUSER_HELPERS
/*
* The vectors page is always readable from user space for the
--
2.24.1
next prev parent reply other threads:[~2020-01-17 17:42 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-17 17:41 [PATCH RT 00/32] Linux 4.19.94-rt39-rc1 Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 01/32] i2c: exynos5: Remove IRQF_ONESHOT Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 02/32] i2c: hix5hd2: " Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 03/32] sched/deadline: Ensure inactive_timer runs in hardirq context Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 04/32] thermal/x86_pkg_temp: make pkg_temp_lock a raw spinlock Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 05/32] dma-buf: Use seqlock_t instread disabling preemption Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 06/32] KVM: arm/arm64: Let the timer expire in hardirq context on RT Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 07/32] x86: preempt: Check preemption level before looking at lazy-preempt Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 08/32] hrtimer: Use READ_ONCE to access timer->base in hrimer_grab_expiry_lock() Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 09/32] hrtimer: Dont grab the expiry lock for non-soft hrtimer Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 10/32] hrtimer: Prevent using hrtimer_grab_expiry_lock() on migration_base Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 11/32] hrtimer: Add a missing bracket and hide `migration_base on !SMP Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 12/32] posix-timers: Unlock expiry lock in the early return Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 14/32] sched: __set_cpus_allowed_ptr: Check cpus_mask, not cpus_ptr Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 15/32] sched: Remove dead __migrate_disabled() check Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 16/32] sched: migrate disable: Protect cpus_ptr with lock Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 17/32] lib/smp_processor_id: Dont use cpumask_equal() Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 18/32] futex: Make the futex_hash_bucket spinlock_t again and bring back its old state Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 19/32] locking/rtmutex: Clean ->pi_blocked_on in the error case Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 20/32] lib/ubsan: Dont seralize UBSAN report Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 21/32] kmemleak: Change the lock of kmemleak_object to raw_spinlock_t Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 22/32] sched: migrate_enable: Use select_fallback_rq() Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 23/32] sched: Lazy migrate_disable processing Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 24/32] sched: migrate_enable: Use stop_one_cpu_nowait() Steven Rostedt
2020-01-22 8:31 ` Sebastian Andrzej Siewior
2020-01-22 11:33 ` Steven Rostedt
2020-01-22 18:39 ` Scott Wood
2020-01-22 19:07 ` Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 25/32] Revert "cpufreq: drop K8s driver from beeing selected" Steven Rostedt
2020-01-22 8:38 ` Sebastian Andrzej Siewior
2020-01-22 11:34 ` Steven Rostedt
2020-01-17 17:41 ` Steven Rostedt [this message]
2020-01-17 17:41 ` [PATCH RT 28/32] locking: Make spinlock_t and rwlock_t a RCU section on RT Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 29/32] sched/core: migrate_enable() must access takedown_cpu_task on !HOTPLUG_CPU Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 30/32] lib/smp_processor_id: Adjust check_preemption_disabled() Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 31/32] sched: migrate_enable: Busy loop until the migration request is completed Steven Rostedt
2020-01-17 17:41 ` [PATCH RT 32/32] Linux 4.19.94-rt39-rc1 Steven Rostedt
[not found] ` <20200117174131.455165326@goodmis.org>
2020-01-22 8:43 ` [PATCH RT 27/32] x86/fpu: Dont cache access to fpu_fpregs_owner_ctx Sebastian Andrzej Siewior
2020-01-22 11:34 ` Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200117174131.301899171@goodmis.org \
--to=rostedt@goodmis.org \
--cc=C.Emde@osadl.org \
--cc=bigeasy@linutronix.de \
--cc=jkacur@redhat.com \
--cc=julia@ni.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rt-users@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=wagi@monom.org \
--cc=zanussi@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).