* [PATCH] fs/proc/page: Skip uninitialized page when iterating page structures
@ 2019-08-25 16:38 Waiman Long
2019-08-26 4:08 ` kbuild test robot
0 siblings, 1 reply; 3+ messages in thread
From: Waiman Long @ 2019-08-25 16:38 UTC (permalink / raw)
To: Alexey Dobriyan, Andrew Morton
Cc: linux-kernel, linux-fsdevel, linux-mm, Stephen Rothwell,
Michael S. Tsirkin, Waiman Long
It was found that on a dual-socket x86-64 system with nvdimm, reading
/proc/kpagecount may cause the system to panic:
===================
[ 79.917682] BUG: unable to handle page fault for address: fffffffffffffffe
[ 79.924558] #PF: supervisor read access in kernel mode
[ 79.929696] #PF: error_code(0x0000) - not-present page
[ 79.934834] PGD 87b60d067 P4D 87b60d067 PUD 87b60f067 PMD 0
[ 79.940494] Oops: 0000 [#1] SMP NOPTI
[ 79.944157] CPU: 89 PID: 3455 Comm: cp Not tainted 5.3.0-rc5-test+ #14
[ 79.950682] Hardware name: Dell Inc. PowerEdge R740/07X9K0, BIOS 2.2.11 06/13/2019
[ 79.958246] RIP: 0010:kpagecount_read+0xdb/0x1a0
[ 79.962859] Code: e8 09 83 e0 3f 48 0f a3 02 73 2d 4c 89 f7 48 c1 e7 06 48 03 3d fe da de 00 74 1d 48 8b 57 08 48 8d 42 ff 83 e2 01 48 0f 44 c7 <48> 8b 00 f6 c4 02 75 06 83 7f 30 80 7d 62 31 c0 4c 89 f9 e8 5d c9
[ 79.981603] RSP: 0018:ffffb0d9c950fe70 EFLAGS: 00010202
[ 79.986830] RAX: fffffffffffffffe RBX: ffff8beebe5383c0 RCX: ffffb0d9c950ff00
[ 79.993963] RDX: 0000000000000001 RSI: 00007fd85b29e000 RDI: ffffe77a22000000
[ 80.001095] RBP: 0000000000020000 R08: 0000000000000001 R09: 0000000000000000
[ 80.008226] R10: 0000000000000000 R11: 0000000000000001 R12: 00007fd85b29e000
[ 80.015358] R13: ffffffff893f0480 R14: 0000000000880000 R15: 00007fd85b29e000
[ 80.022491] FS: 00007fd85b312800(0000) GS:ffff8c359fb00000(0000) knlGS:0000000000000000
[ 80.030576] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 80.036321] CR2: fffffffffffffffe CR3: 0000004f54a38001 CR4: 00000000007606e0
[ 80.043455] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 80.050586] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 80.057718] PKRU: 55555554
[ 80.060428] Call Trace:
[ 80.062877] proc_reg_read+0x39/0x60
[ 80.066459] vfs_read+0x91/0x140
[ 80.069686] ksys_read+0x59/0xd0
[ 80.072922] do_syscall_64+0x59/0x1e0
[ 80.076588] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 80.081637] RIP: 0033:0x7fd85a7f5d75
===================
It turns out the panic was caused by the kpagecount_read() function
hitting an uninitialized page structure at PFN 0x880000 where all its
fields were set to -1. The compound_head value of -1 will mislead the
kernel to treat -2 as a pointer to the head page of the compound page
leading to the crash.
The system have 12 GB of nvdimm ranging from PFN 0x880000-0xb7ffff.
However, only PFN 0x88c200-0xb7ffff are released by the nvdimm
driver to the kernel and initialized. IOW, PFN 0x880000-0x88c1ff
remain uninitialized. Perhaps these 196 MB of nvdimm are reserved for
internal use.
To fix the panic, we need to find out if a page structure has been
initialized. This is done now by checking if the PFN is in the range
of a memory zone assuming that pages in a zone is either correctly
marked as not present in the mem_section structure or have their page
structures initialized.
Signed-off-by: Waiman Long <longman@redhat.com>
---
fs/proc/page.c | 68 +++++++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 65 insertions(+), 3 deletions(-)
diff --git a/fs/proc/page.c b/fs/proc/page.c
index 544d1ee15aee..ef697eb42065 100644
--- a/fs/proc/page.c
+++ b/fs/proc/page.c
@@ -21,6 +21,64 @@
#define KPMMASK (KPMSIZE - 1)
#define KPMBITS (KPMSIZE * BITS_PER_BYTE)
+/*
+ * It is possible a page structure is contained in a mem_section that is
+ * regarded as valid but the page structure itself is not properly
+ * initialized. For example, portion of the device memory may be used
+ * internally by device driver or firmware without being managed by the
+ * kernel and hence their page structures may not be initialized.
+ *
+ * An uninitialized page structure may cause the PFN iteration code
+ * in this file to panic the system. To safe-guard against this
+ * possibility, an additional check of the PFN is done to make sure
+ * that it is in a valid range in one of the memory zones:
+ *
+ * [zone_start_pfn, zone_start_pfn + spanned_pages)
+ *
+ * It is possible that some of the PFNs within a zone is not present.
+ * In this case, it will have to rely on the current mem_section check
+ * as well as the affected page structures are still properly initialized.
+ */
+struct zone_range {
+ unsigned long pfn_start;
+ unsigned long pfn_end;
+};
+
+static void find_next_zone_range(struct zone_range *range)
+{
+ unsigned long start, end;
+ pg_data_t *pgdat;
+ struct zone *zone;
+ int i;
+
+ /*
+ * Scan all the zone structures to find the next closest one.
+ */
+ start = end = -1UL
+ for (pgdat = first_online_pgdat(); pgdat;
+ pgdat = next_online_pgdat(pgdat)) {
+ for (zone = pgdat->node_zones, i = 0; i < MAX_NR_ZONES;
+ zone++, i++) {
+ if (!zone->spanned_pages)
+ continue;
+ if ((zone->zone_start_pfn >= range->pfn_end) &&
+ (zone->zone_start_pfn < start)) {
+ start = zone->zone_start_pfn;
+ end = start + zone->spanned_pages;
+ }
+ }
+ }
+ range->pfn_start = start;
+ range->pfn_end = end;
+}
+
+static inline bool pfn_in_zone(unsigned long pfn, struct zone_range *range)
+{
+ if (pfn >= range->pfn_end)
+ find_next_zone_range(range);
+ return pfn >= range->start && pfn < range->end;
+}
+
/* /proc/kpagecount - an array exposing page counts
*
* Each entry is a u64 representing the corresponding
@@ -31,6 +89,7 @@ static ssize_t kpagecount_read(struct file *file, char __user *buf,
{
u64 __user *out = (u64 __user *)buf;
struct page *ppage;
+ struct zone_range range = { 0, 0 };
unsigned long src = *ppos;
unsigned long pfn;
ssize_t ret = 0;
@@ -42,10 +101,11 @@ static ssize_t kpagecount_read(struct file *file, char __user *buf,
return -EINVAL;
while (count > 0) {
- if (pfn_valid(pfn))
+ if (pfn_valid(pfn) && pfn_in_zone(pfn, &range))
ppage = pfn_to_page(pfn);
else
ppage = NULL;
+
if (!ppage || PageSlab(ppage) || page_has_type(ppage))
pcount = 0;
else
@@ -206,6 +266,7 @@ static ssize_t kpageflags_read(struct file *file, char __user *buf,
{
u64 __user *out = (u64 __user *)buf;
struct page *ppage;
+ struct zone_range range = { 0, 0 };
unsigned long src = *ppos;
unsigned long pfn;
ssize_t ret = 0;
@@ -216,7 +277,7 @@ static ssize_t kpageflags_read(struct file *file, char __user *buf,
return -EINVAL;
while (count > 0) {
- if (pfn_valid(pfn))
+ if (pfn_valid(pfn) && pfn_in_zone(pfn, &range))
ppage = pfn_to_page(pfn);
else
ppage = NULL;
@@ -250,6 +311,7 @@ static ssize_t kpagecgroup_read(struct file *file, char __user *buf,
{
u64 __user *out = (u64 __user *)buf;
struct page *ppage;
+ struct zone_range range = { 0, 0 };
unsigned long src = *ppos;
unsigned long pfn;
ssize_t ret = 0;
@@ -261,7 +323,7 @@ static ssize_t kpagecgroup_read(struct file *file, char __user *buf,
return -EINVAL;
while (count > 0) {
- if (pfn_valid(pfn))
+ if (pfn_valid(pfn) && pfn_in_zone(pfn, &range))
ppage = pfn_to_page(pfn);
else
ppage = NULL;
--
2.18.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] fs/proc/page: Skip uninitialized page when iterating page structures
2019-08-25 16:38 [PATCH] fs/proc/page: Skip uninitialized page when iterating page structures Waiman Long
@ 2019-08-26 4:08 ` kbuild test robot
2019-08-26 12:44 ` Waiman Long
0 siblings, 1 reply; 3+ messages in thread
From: kbuild test robot @ 2019-08-26 4:08 UTC (permalink / raw)
To: Waiman Long
Cc: kbuild-all, Alexey Dobriyan, Andrew Morton, linux-kernel,
linux-fsdevel, linux-mm, Stephen Rothwell, Michael S. Tsirkin,
Waiman Long
[-- Attachment #1: Type: text/plain, Size: 3064 bytes --]
Hi Waiman,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on linus/master]
[cannot apply to v5.3-rc6 next-20190823]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
url: https://github.com/0day-ci/linux/commits/Waiman-Long/fs-proc-page-Skip-uninitialized-page-when-iterating-page-structures/20190826-105836
config: x86_64-lkp (attached as .config)
compiler: gcc-7 (Debian 7.4.0-10) 7.4.0
reproduce:
# save the attached .config to linux build tree
make ARCH=x86_64
If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
fs/proc/page.c: In function 'find_next_zone_range':
>> fs/proc/page.c:58:2: error: expected ';' before 'for'
for (pgdat = first_online_pgdat(); pgdat;
^~~
fs/proc/page.c:52:6: warning: unused variable 'i' [-Wunused-variable]
int i;
^
fs/proc/page.c:51:15: warning: unused variable 'zone' [-Wunused-variable]
struct zone *zone;
^~~~
fs/proc/page.c:50:13: warning: unused variable 'pgdat' [-Wunused-variable]
pg_data_t *pgdat;
^~~~~
fs/proc/page.c: In function 'pfn_in_zone':
>> fs/proc/page.c:79:23: error: 'struct zone_range' has no member named 'start'; did you mean 'pfn_start'?
return pfn >= range->start && pfn < range->end;
^~~~~
pfn_start
>> fs/proc/page.c:79:43: error: 'struct zone_range' has no member named 'end'
return pfn >= range->start && pfn < range->end;
^~
fs/proc/page.c:80:1: warning: control reaches end of non-void function [-Wreturn-type]
}
^
vim +58 fs/proc/page.c
46
47 static void find_next_zone_range(struct zone_range *range)
48 {
49 unsigned long start, end;
> 50 pg_data_t *pgdat;
> 51 struct zone *zone;
52 int i;
53
54 /*
55 * Scan all the zone structures to find the next closest one.
56 */
57 start = end = -1UL
> 58 for (pgdat = first_online_pgdat(); pgdat;
59 pgdat = next_online_pgdat(pgdat)) {
60 for (zone = pgdat->node_zones, i = 0; i < MAX_NR_ZONES;
61 zone++, i++) {
62 if (!zone->spanned_pages)
63 continue;
64 if ((zone->zone_start_pfn >= range->pfn_end) &&
65 (zone->zone_start_pfn < start)) {
66 start = zone->zone_start_pfn;
67 end = start + zone->spanned_pages;
68 }
69 }
70 }
71 range->pfn_start = start;
72 range->pfn_end = end;
73 }
74
75 static inline bool pfn_in_zone(unsigned long pfn, struct zone_range *range)
76 {
77 if (pfn >= range->pfn_end)
78 find_next_zone_range(range);
> 79 return pfn >= range->start && pfn < range->end;
80 }
81
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 27705 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] fs/proc/page: Skip uninitialized page when iterating page structures
2019-08-26 4:08 ` kbuild test robot
@ 2019-08-26 12:44 ` Waiman Long
0 siblings, 0 replies; 3+ messages in thread
From: Waiman Long @ 2019-08-26 12:44 UTC (permalink / raw)
To: kbuild test robot
Cc: kbuild-all, Alexey Dobriyan, Andrew Morton, linux-kernel,
linux-fsdevel, linux-mm, Stephen Rothwell, Michael S. Tsirkin
On 8/26/19 12:08 AM, kbuild test robot wrote:
> Hi Waiman,
>
> Thank you for the patch! Yet something to improve:
>
> [auto build test ERROR on linus/master]
> [cannot apply to v5.3-rc6 next-20190823]
> [if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
>
> url: https://github.com/0day-ci/linux/commits/Waiman-Long/fs-proc-page-Skip-uninitialized-page-when-iterating-page-structures/20190826-105836
> config: x86_64-lkp (attached as .config)
> compiler: gcc-7 (Debian 7.4.0-10) 7.4.0
> reproduce:
> # save the attached .config to linux build tree
> make ARCH=x86_64
>
> If you fix the issue, kindly add following tag
> Reported-by: kbuild test robot <lkp@intel.com>
>
> All errors (new ones prefixed by >>):
>
> fs/proc/page.c: In function 'find_next_zone_range':
>>> fs/proc/page.c:58:2: error: expected ';' before 'for'
> for (pgdat = first_online_pgdat(); pgdat;
> ^~~
> fs/proc/page.c:52:6: warning: unused variable 'i' [-Wunused-variable]
> int i;
> ^
> fs/proc/page.c:51:15: warning: unused variable 'zone' [-Wunused-variable]
> struct zone *zone;
> ^~~~
> fs/proc/page.c:50:13: warning: unused variable 'pgdat' [-Wunused-variable]
> pg_data_t *pgdat;
> ^~~~~
> fs/proc/page.c: In function 'pfn_in_zone':
>>> fs/proc/page.c:79:23: error: 'struct zone_range' has no member named 'start'; did you mean 'pfn_start'?
> return pfn >= range->start && pfn < range->end;
> ^~~~~
> pfn_start
>>> fs/proc/page.c:79:43: error: 'struct zone_range' has no member named 'end'
> return pfn >= range->start && pfn < range->end;
> ^~
> fs/proc/page.c:80:1: warning: control reaches end of non-void function [-Wreturn-type]
> }
> ^
>
> vim +58 fs/proc/page.c
>
> 46
> 47 static void find_next_zone_range(struct zone_range *range)
> 48 {
> 49 unsigned long start, end;
> > 50 pg_data_t *pgdat;
> > 51 struct zone *zone;
> 52 int i;
> 53
> 54 /*
> 55 * Scan all the zone structures to find the next closest one.
> 56 */
> 57 start = end = -1UL
> > 58 for (pgdat = first_online_pgdat(); pgdat;
> 59 pgdat = next_online_pgdat(pgdat)) {
> 60 for (zone = pgdat->node_zones, i = 0; i < MAX_NR_ZONES;
> 61 zone++, i++) {
> 62 if (!zone->spanned_pages)
> 63 continue;
> 64 if ((zone->zone_start_pfn >= range->pfn_end) &&
> 65 (zone->zone_start_pfn < start)) {
> 66 start = zone->zone_start_pfn;
> 67 end = start + zone->spanned_pages;
> 68 }
> 69 }
> 70 }
> 71 range->pfn_start = start;
> 72 range->pfn_end = end;
> 73 }
> 74
> 75 static inline bool pfn_in_zone(unsigned long pfn, struct zone_range *range)
> 76 {
> 77 if (pfn >= range->pfn_end)
> 78 find_next_zone_range(range);
> > 79 return pfn >= range->start && pfn < range->end;
> 80 }
> 81
>
> ---
> 0-DAY kernel test infrastructure Open Source Technology Center
> https://lists.01.org/pipermail/kbuild-all Intel Corporation
Sorry, I have accidentally sent the old version with syntax error out.
Has posted the right one in v2.
Cheers,
Longman
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-08-26 12:44 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-25 16:38 [PATCH] fs/proc/page: Skip uninitialized page when iterating page structures Waiman Long
2019-08-26 4:08 ` kbuild test robot
2019-08-26 12:44 ` Waiman Long
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).