From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.5 required=3.0 tests=INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 738F5ECE587 for ; Mon, 14 Oct 2019 08:44:23 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 3F2B120659 for ; Mon, 14 Oct 2019 08:44:23 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3F2B120659 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id E18F38E0005; Mon, 14 Oct 2019 04:44:22 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id DF0488E0001; Mon, 14 Oct 2019 04:44:22 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D05378E0005; Mon, 14 Oct 2019 04:44:22 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0166.hostedemail.com [216.40.44.166]) by kanga.kvack.org (Postfix) with ESMTP id AE37D8E0001 for ; Mon, 14 Oct 2019 04:44:22 -0400 (EDT) Received: from smtpin02.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with SMTP id 1A60C181AEF2A for ; Mon, 14 Oct 2019 08:44:22 +0000 (UTC) X-FDA: 76041753564.02.toe78_6048a130eeb13 X-HE-Tag: toe78_6048a130eeb13 X-Filterd-Recvd-Size: 4741 Received: from mx1.suse.de (mx2.suse.de [195.135.220.15]) by imf50.hostedemail.com (Postfix) with ESMTP for ; Mon, 14 Oct 2019 08:44:21 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id 1B625ACE3; Mon, 14 Oct 2019 08:44:20 +0000 (UTC) Date: Mon, 14 Oct 2019 10:44:19 +0200 From: Michal Hocko To: David Hildenbrand Cc: linux-kernel@vger.kernel.org, "Peter Zijlstra (Intel)" , linux-mm@kvack.org, Qian Cai , Thomas Gleixner , Andrew Morton , Mike Rapoport , Greg Kroah-Hartman , Miles Chen , Vlastimil Babka Subject: Re: [PATCH v2] mm/page_owner: Don't access uninitialized memmaps when reading /proc/pagetypeinfo Message-ID: <20191014084419.GB317@dhcp22.suse.cz> References: <20191011140638.8160-1-david@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20191011140638.8160-1-david@redhat.com> User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri 11-10-19 16:06:38, David Hildenbrand wrote: > From: Qian Cai > > Uninitialized memmaps contain garbage and in the worst case trigger > kernel BUGs, especially with CONFIG_PAGE_POISONING. They should not get > touched. > > For example, when not onlining a memory block that is spanned by a zone > and reading /proc/pagetypeinfo with CONFIG_DEBUG_VM_PGFLAGS and > CONFIG_PAGE_POISONING, we can trigger a kernel BUG: > > :/# echo 1 > /sys/devices/system/memory/memory40/online > :/# echo 1 > /sys/devices/system/memory/memory42/online > :/# cat /proc/pagetypeinfo > test.file > [ 42.489856] page:fffff2c585200000 is uninitialized and poisoned > [ 42.489861] raw: ffffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffff > [ 42.492235] raw: ffffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffff > [ 42.493501] page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) > [ 42.494533] There is not page extension available. > [ 42.495358] ------------[ cut here ]------------ > [ 42.496163] kernel BUG at include/linux/mm.h:1107! > [ 42.497069] invalid opcode: 0000 [#1] SMP NOPTI > > Please not that this change does not affect ZONE_DEVICE, because > pagetypeinfo_showmixedcount_print() is called from > mm/vmstat.c:pagetypeinfo_showmixedcount() only for populated zones, and > ZONE_DEVICE is never populated (zone->present_pages always 0). > > Fixes: f1dd2cd13c4b ("mm, memory_hotplug: do not associate hotadded memory to zones until online") # visible after d0dc12e86b319 > Signed-off-by: Qian Cai > Cc: Andrew Morton > Cc: Vlastimil Babka > Cc: Michal Hocko > Cc: Thomas Gleixner > Cc: "Peter Zijlstra (Intel)" > Cc: Miles Chen > Cc: Mike Rapoport > Cc: Qian Cai > Cc: Greg Kroah-Hartman > [ move check to outer loop, add comment, rephrase description ] > Signed-off-by: David Hildenbrand Acked-by: Michal Hocko Thanks! > --- > > Cai asked me to follow up on: > [PATCH] mm/page_owner: fix a crash after memory offline > > --- > mm/page_owner.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/mm/page_owner.c b/mm/page_owner.c > index dee931184788..7d149211f6be 100644 > --- a/mm/page_owner.c > +++ b/mm/page_owner.c > @@ -284,7 +284,8 @@ void pagetypeinfo_showmixedcount_print(struct seq_file *m, > * not matter as the mixed block count will still be correct > */ > for (; pfn < end_pfn; ) { > - if (!pfn_valid(pfn)) { > + page = pfn_to_online_page(pfn); > + if (!page) { > pfn = ALIGN(pfn + 1, MAX_ORDER_NR_PAGES); > continue; > } > @@ -292,13 +293,13 @@ void pagetypeinfo_showmixedcount_print(struct seq_file *m, > block_end_pfn = ALIGN(pfn + 1, pageblock_nr_pages); > block_end_pfn = min(block_end_pfn, end_pfn); > > - page = pfn_to_page(pfn); > pageblock_mt = get_pageblock_migratetype(page); > > for (; pfn < block_end_pfn; pfn++) { > if (!pfn_valid_within(pfn)) > continue; > > + /* The pageblock is online, no need to recheck. */ > page = pfn_to_page(pfn); > > if (page_zone(page) != zone) > -- > 2.21.0 > -- Michal Hocko SUSE Labs