From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 99C7FC433EF for ; Thu, 7 Apr 2022 09:33:02 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 4FBE16B0073; Thu, 7 Apr 2022 05:32:42 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 4839F6B0074; Thu, 7 Apr 2022 05:32:42 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2FD876B0075; Thu, 7 Apr 2022 05:32:42 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (relay.hostedemail.com [64.99.140.28]) by kanga.kvack.org (Postfix) with ESMTP id 1E4606B0073 for ; Thu, 7 Apr 2022 05:32:42 -0400 (EDT) Received: from smtpin03.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay11.hostedemail.com (Postfix) with ESMTP id E27A0823E3 for ; Thu, 7 Apr 2022 09:32:31 +0000 (UTC) X-FDA: 79329567702.03.3004013 Received: from mail-yb1-f169.google.com (mail-yb1-f169.google.com [209.85.219.169]) by imf16.hostedemail.com (Postfix) with ESMTP id 793FC18000E for ; Thu, 7 Apr 2022 09:32:30 +0000 (UTC) Received: by mail-yb1-f169.google.com with SMTP id z33so8542107ybh.5 for ; Thu, 07 Apr 2022 02:32:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance-com.20210112.gappssmtp.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=62l7lWpaWnFmcE5KSw9n2JkqXdoamhD8Hh1gAz788Uk=; b=7Fjzbh/Sm8gK8nPro6LV1yjqabTxBJm9qCUowc7ncFl93HYSSGb9TiVbsEdolByulW ZLNWYJEfgx8FrYP+nw6wIKw2btBuNy8ozUjteagSt1oB9S0Gwklnc/YahTkGDoCAOVix igRidMJGzQkSVhJ8WyRhWtc5CPkC4PywYzDFRQbvSM9MfSW/NuRIFK+Vpmncji+7guox 3twrJWYdvfKqfZ7HAuNlGEC1BFnSWQmX7d8lI/BeFue1mJqg24pYDaufEm4lQb1csQmD A5JApUHZ4D8oW4Rvs0vPoys0IxVWBR7SGOofo1Ws07IF6BHdGY1SKEdLygAspaXdMr2C 2QGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=62l7lWpaWnFmcE5KSw9n2JkqXdoamhD8Hh1gAz788Uk=; b=WRrZYZ1BZMyO4T6lvAYrxGBiuXUeRN7nCOebaeVzG7MHEKOZRCs6lHi6ihuEJ/72jE Ng6wvhyWSE6E6j1NeeCjOC1af5xcEuUJDYW1BaUnkc7Qo8eauS4ITPkwdd1v0Oa9Wf8Z 7wI72Yn+0xLdxTPb+1DQffvpEi6FBgfrAf1cH4EWOHFHU8UDh5t+PLtkRrQVE62aVL0I kL039FC75xgzaT8kjzKbruCTqaiwwyuf1XkOTV8ooxa6AHkq+/8yrXewl88pXu2u4RMl gWBIceKiCwNwfp+bIEXwyxsTG0gJ5Q7+NtY+nhHe0Jml0EyEJlRwU4T3jVVqP2peX+Rx tBvA== X-Gm-Message-State: AOAM533gnPju0gBM3mjtw1+Jlg5EX/FyBTfnFximEJEqK60GPT3ivef7 S0tOrAvcnIokU1q84fWNFUwbQ2WiBhk2m9Gp59xpjQ== X-Google-Smtp-Source: ABdhPJxI566MWWnks/diHDfuyZ06GeRsNBqBd4+xL9zJswWBt/4Jez9cug6L1kUO3ogC8RY5GmBkb7nkHJVFFDzZ+ew= X-Received: by 2002:a25:ab42:0:b0:633:883b:3e21 with SMTP id u60-20020a25ab42000000b00633883b3e21mr9941442ybi.132.1649323949480; Thu, 07 Apr 2022 02:32:29 -0700 (PDT) MIME-Version: 1.0 References: <20220407064008.71869-1-pizhenwei@bytedance.com> In-Reply-To: <20220407064008.71869-1-pizhenwei@bytedance.com> From: Muchun Song Date: Thu, 7 Apr 2022 17:31:52 +0800 Message-ID: Subject: Re: [PATCH] mm: fix kernel NULL pointer dereference in page_vma_mapped_walk To: zhenwei pi Cc: Andrew Morton , Linux Memory Management List , LKML , Matthew Wilcox Content-Type: text/plain; charset="UTF-8" X-Stat-Signature: 3usdn35obhncr3keziqedejigptfeng1 Authentication-Results: imf16.hostedemail.com; dkim=pass header.d=bytedance-com.20210112.gappssmtp.com header.s=20210112 header.b="7Fjzbh/S"; spf=pass (imf16.hostedemail.com: domain of songmuchun@bytedance.com designates 209.85.219.169 as permitted sender) smtp.mailfrom=songmuchun@bytedance.com; dmarc=pass (policy=none) header.from=bytedance.com X-Rspam-User: X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: 793FC18000E X-HE-Tag: 1649323950-433040 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Apr 7, 2022 at 2:43 PM zhenwei pi wrote: > > size_to_hstate(4K) returns NULL pointer, this leads kernel BUG in > function page_vma_mapped_walk. > > BUG: kernel NULL pointer dereference, address: 0000000000000028 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > PGD 102a8b067 P4D 102a8b067 PUD 102a88067 PMD 0 > Oops: 0000 [#1] PREEMPT SMP NOPTI > CPU: 0 PID: 16 Comm: kworker/0:1 Kdump: loaded Tainted: G M E 5.18.0-rc1.bm.1-amd64 #3 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 > Workqueue: events mce_gen_pool_process > RIP: 0010:page_vma_mapped_walk+0x4aa/0x850 > Code: 8b 77 20 48 89 c2 4c 89 ef e8 b2 c4 02 00 49 89 c4 48 89 43 30 48 85 c0 0f 84 a7 fd ff ff 48 89 ef e8 fa 9c 02 00 49 8d 7d 74 <83> 78 28 09 0f 84 1e 03 00 00 48 89 7b 38 e8 a3 cc 60 00 48 89 df > RSP: 0018:ffffc9000008bc58 EFLAGS: 00010246 > RAX: 0000000000000000 RBX: ffffc9000008bca0 RCX: 0000000000000009 > RDX: 0000000000200000 RSI: ffffffff82b4a460 RDI: ffff88810ac5c3f4 > RBP: 0000000000001000 R08: 0000000000001000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000007 R12: ffff888072cafd10 > R13: ffff88810ac5c380 R14: ffff888101afc440 R15: 0000000000000000 > FS: 0000000000000000(0000) GS:ffff88823fc00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000000028 CR3: 0000000106ca2002 CR4: 0000000000772ef0 > PKRU: 55555554 > Call Trace: > > ? preempt_count_add+0x68/0xa0 > page_mapped_in_vma+0xb4/0x230 > collect_procs.part.35+0x11b/0x440 > hwpoison_user_mappings+0x165/0x5b0 > ? zone_pcp_enable+0x16/0x30 > memory_failure+0xbea/0xd90 > ? _printk+0x58/0x6f > uc_decode_notifier+0x4b/0xd0 > blocking_notifier_call_chain+0x60/0x90 > mce_gen_pool_process+0x3c/0x60 > process_one_work+0x1c2/0x390 > ? process_one_work+0x390/0x390 > worker_thread+0x30/0x360 > ? process_one_work+0x390/0x390 > kthread+0xe6/0x110 > ? kthread_complete_and_exit+0x20/0x20 > ret_from_fork+0x1f/0x30 > > > Fixes: 2aff7a4755bed ("mm: Convert page_vma_mapped_walk to work on PFNs") > Signed-off-by: zhenwei pi Good catch. Reviewed-by: Muchun Song Thanks.