From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755354AbbFYAeN (ORCPT ); Wed, 24 Jun 2015 20:34:13 -0400 Received: from mail.efficios.com ([78.47.125.74]:37533 "EHLO mail.efficios.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754442AbbFYAeD convert rfc822-to-8bit (ORCPT ); Wed, 24 Jun 2015 20:34:03 -0400 Date: Thu, 25 Jun 2015 00:33:52 +0000 (UTC) From: Mathieu Desnoyers To: Linus Torvalds Cc: Thomas Gleixner , Linux Kernel Mailing List , Ingo Molnar , "H. Peter Anvin" , the arch/x86 maintainers Message-ID: <319273741.2640.1435192432022.JavaMail.zimbra@efficios.com> In-Reply-To: <1022548323.2631.1435190096462.JavaMail.zimbra@efficios.com> References: <1435162498-23082-1-git-send-email-mathieu.desnoyers@efficios.com> <609198255.2568.1435171747039.JavaMail.zimbra@efficios.com> <1022548323.2631.1435190096462.JavaMail.zimbra@efficios.com> Subject: Re: [RFC PATCH] Fix: x86 unaligned __memcpy to/from virtual memory MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8BIT X-Originating-IP: [78.47.125.74] X-Mailer: Zimbra 8.6.0_GA_1153 (ZimbraWebClient - FF38 (Linux)/8.6.0_GA_1153) Thread-Topic: x86 unaligned __memcpy to/from virtual memory Thread-Index: M+A0KgfyZAOBh8a/w5c0ZWhEsiUQ1SabyzTL Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org ----- On Jun 24, 2015, at 7:54 PM, Mathieu Desnoyers mathieu.desnoyers@efficios.com wrote: > ----- On Jun 24, 2015, at 3:15 PM, Linus Torvalds torvalds@linux-foundation.org > wrote: > >> On Wed, Jun 24, 2015 at 11:49 AM, Mathieu Desnoyers >> wrote: >>> >>> Here is the output. I added the printk just after the initial range >>> check within vmalloc_fault. >> >> Good. Can you add printk's to the error return paths too, so that we >> see which one it is that triggers. > > OK, see below. This time the fault occurred at an unaligned address. > It fails on the !pte_present(*pte_ref) check. I just tried to to a bytewise copy in C rather than call memcpy, and I got the fault to trigger. So I guess I was on the wrong track assuming __memcpy would be the culprit. What is odd is that if I issue vmalloc_sync_all() after each vmalloc call, the OOPS never triggers. It is clearly a test case that ends up stressing vfree/vmalloc. [ 34.751984] DEBUG: vmalloc_fault at address 0xffffc90007290000 [ 34.753188] DEBUG: !pte_present(*pte_ref) error [ 34.753188] BUG: unable to handle kernel paging request at ffffc90007290000 [ 34.753188] IP: [] lttng_event_write+0x90/0xd0 [lttng_ring_buffer_metadata_client] [ 34.753188] PGD 236c92067 PUD 236c93067 PMD b6964067 PTE 0 [ 34.753188] Oops: 0000 [#1] SMP [ 34.753188] Modules linked in: lttng_probe_workqueue(O) lttng_probe_vmscan(O) lttng_probe_udp(O) lttng_probe_timer(O) lttng_probe_sunrpc(O) lttng_probe_statedump(O) lttng_probe_sock(O) lttng_probe_skb(O) lttng_probe_signal(O) lttng_probe_scsi(O) lttng_probe_sched(O) lttng_probe_regmap(O) lttng_probe_rcu(O) lttng_probe_random(O) lttng_probe_power(O) lttng_probe_net(O) lttng_probe_napi(O) lttng_probe_module(O) lttng_probe_kmem(O) lttng_probe_jbd2(O) lttng_probe_irq(O) lttng_probe_ext4(O) lttng_probe_compaction(O) lttng_probe_block(O) lttng_types(O) lttng_ring_buffer_metadata_mmap_client(O) lttng_ring_buffer_client_mmap_overwrite(O) lttng_ring_buffer_client_mmap_discard(O) lttng_ring_buffer_metadata_client(O) lttng_ring_buffer_client_overwrite(O) lttng_ring_buffer_client_discard(O) lttng_tracer(O) lttng_statedump(O) lttng_kprobes(O) lttng_lib_ring_buffer(O) lttng_kretprobes(O) virtio_blk virtio_net virtio_pci virtio_ring virtio [last unloaded: lttng_statedump] [ 34.753188] CPU: 26 PID: 3563 Comm: lttng-consumerd Tainted: G O 4.1.0+ #11 [ 34.753188] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 [ 34.753188] task: ffff880234d94880 ti: ffff88022af6c000 task.ti: ffff88022af6c000 [ 34.753188] RIP: 0010:[] [] lttng_event_write+0x90/0xd0 [lttng_ring_buffer_metadata_client] [ 34.753188] RSP: 0018:ffff88022af6fda8 EFLAGS: 00010212 [ 34.753188] RAX: 000000000000009d RBX: 0000000000000fd8 RCX: 0000000000000025 [ 34.753188] RDX: ffff8800b7681120 RSI: ffffc9000728ff63 RDI: 0000000000000000 [ 34.753188] RBP: ffff88022af6fdb8 R08: 000000000000009d R09: ffff88022ea33025 [ 34.753188] R10: 000000000000003b R11: 0000000000000246 R12: ffff88022af6fdc8 [ 34.753188] R13: ffff880231565c00 R14: 0000000000000fd8 R15: 0000000000000fd8 [ 34.753188] FS: 00007fd64b5f2700(0000) GS:ffff880237540000(0000) knlGS:0000000000000000 [ 34.753188] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 34.753188] CR2: ffffc90007290000 CR3: 0000000233803000 CR4: 00000000000006e0 [ 34.753188] Stack: [ 34.753188] ffff880234cbff00 ffff880234cbff50 ffff88022af6fe48 ffffffffa048e060 [ 34.753188] ffff880231565c00 0000000000000000 0000000000000fd8 ffffffff00000001 [ 34.753188] ffff88023155d000 0000000000000fd8 0000000000004025 0000000000004025 [ 34.753188] Call Trace: [ 34.753188] [] lttng_metadata_output_channel+0xd0/0x120 [lttng_tracer] [ 34.753188] [] lttng_metadata_ring_buffer_ioctl+0x79/0xd0 [lttng_tracer] [ 34.753188] [] do_vfs_ioctl+0x2e0/0x4e0 [ 34.753188] [] ? file_has_perm+0x87/0xa0 [ 34.753188] [] SyS_ioctl+0x81/0xa0 [ 34.753188] [] ? syscall_trace_leave+0xd1/0xe0 [ 34.753188] [] tracesys_phase2+0x84/0x89 [ 34.753188] Code: d9 48 0f 47 cb 48 39 cb 75 46 48 8d 57 02 25 ff 0f 00 00 45 31 c0 48 89 c1 31 c0 48 c1 e2 04 4c 01 ca 66 0f 1f 84 00 00 00 00 00 <44> 0f b6 14 06 49 89 c9 4c 03 0a 41 83 c0 01 45 88 14 01 49 63 [ 34.753188] RIP [] lttng_event_write+0x90/0xd0 [lttng_ring_buffer_metadata_client] [ 34.753188] RSP [ 34.753188] CR2: ffffc90007290000 [ 34.753188] ---[ end trace 28951381246c3a2e ]--- -- Mathieu Desnoyers EfficiOS Inc. http://www.efficios.com