[PATCH] mm: fix kernel NULL pointer dereference in page_vma_mapped_walk

[PATCH] mm: fix kernel NULL pointer dereference in page_vma_mapped_walk

[zhenwei pi]

size_to_hstate(4K) returns NULL pointer, this leads kernel BUG in
function page_vma_mapped_walk.

 BUG: kernel NULL pointer dereference, address: 0000000000000028
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 102a8b067 P4D 102a8b067 PUD 102a88067 PMD 0
 Oops: 0000 [#1] PREEMPT SMP NOPTI
 CPU: 0 PID: 16 Comm: kworker/0:1 Kdump: loaded Tainted: G   M        E     5.18.0-rc1.bm.1-amd64 #3
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
 Workqueue: events mce_gen_pool_process
 RIP: 0010:page_vma_mapped_walk+0x4aa/0x850
 Code: 8b 77 20 48 89 c2 4c 89 ef e8 b2 c4 02 00 49 89 c4 48 89 43 30 48 85 c0 0f 84 a7 fd ff ff 48 89 ef e8 fa 9c 02 00 49 8d 7d 74 <83> 78 28 09 0f 84 1e 03 00 00 48 89 7b 38 e8 a3 cc 60 00 48 89 df
 RSP: 0018:ffffc9000008bc58 EFLAGS: 00010246
 RAX: 0000000000000000 RBX: ffffc9000008bca0 RCX: 0000000000000009
 RDX: 0000000000200000 RSI: ffffffff82b4a460 RDI: ffff88810ac5c3f4
 RBP: 0000000000001000 R08: 0000000000001000 R09: 0000000000000000
 R10: 0000000000000000 R11: 0000000000000007 R12: ffff888072cafd10
 R13: ffff88810ac5c380 R14: ffff888101afc440 R15: 0000000000000000
 FS:  0000000000000000(0000) GS:ffff88823fc00000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000028 CR3: 0000000106ca2002 CR4: 0000000000772ef0
 PKRU: 55555554
 Call Trace:
  <TASK>
  ? preempt_count_add+0x68/0xa0
  page_mapped_in_vma+0xb4/0x230
  collect_procs.part.35+0x11b/0x440
  hwpoison_user_mappings+0x165/0x5b0
  ? zone_pcp_enable+0x16/0x30
  memory_failure+0xbea/0xd90
  ? _printk+0x58/0x6f
  uc_decode_notifier+0x4b/0xd0
  blocking_notifier_call_chain+0x60/0x90
  mce_gen_pool_process+0x3c/0x60
  process_one_work+0x1c2/0x390
  ? process_one_work+0x390/0x390
  worker_thread+0x30/0x360
  ? process_one_work+0x390/0x390
  kthread+0xe6/0x110
  ? kthread_complete_and_exit+0x20/0x20
  ret_from_fork+0x1f/0x30
  </TASK>

Fixes: 2aff7a4755bed ("mm: Convert page_vma_mapped_walk to work on PFNs")
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
---
 mm/page_vma_mapped.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c
index 1187f9c1ec5b..a39ec23581c9 100644
--- a/mm/page_vma_mapped.c
+++ b/mm/page_vma_mapped.c
@@ -163,7 +163,7 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw)
 		return not_found(pvmw);
 
 	if (unlikely(is_vm_hugetlb_page(vma))) {
-		unsigned long size = pvmw->nr_pages * PAGE_SIZE;
+		unsigned long size = huge_page_size(hstate_vma(vma));
 		/* The only possible mapping was handled on last iteration */
 		if (pvmw->pte)
 			return not_found(pvmw);
-- 
2.25.1

Re: [PATCH] mm: fix kernel NULL pointer dereference in page_vma_mapped_walk

[Muchun Song]

On Thu, Apr 7, 2022 at 2:43 PM zhenwei pi <pizhenwei@bytedance.com> wrote:
>
> size_to_hstate(4K) returns NULL pointer, this leads kernel BUG in
> function page_vma_mapped_walk.
>
>  BUG: kernel NULL pointer dereference, address: 0000000000000028
>  #PF: supervisor read access in kernel mode
>  #PF: error_code(0x0000) - not-present page
>  PGD 102a8b067 P4D 102a8b067 PUD 102a88067 PMD 0
>  Oops: 0000 [#1] PREEMPT SMP NOPTI
>  CPU: 0 PID: 16 Comm: kworker/0:1 Kdump: loaded Tainted: G   M        E     5.18.0-rc1.bm.1-amd64 #3
>  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
>  Workqueue: events mce_gen_pool_process
>  RIP: 0010:page_vma_mapped_walk+0x4aa/0x850
>  Code: 8b 77 20 48 89 c2 4c 89 ef e8 b2 c4 02 00 49 89 c4 48 89 43 30 48 85 c0 0f 84 a7 fd ff ff 48 89 ef e8 fa 9c 02 00 49 8d 7d 74 <83> 78 28 09 0f 84 1e 03 00 00 48 89 7b 38 e8 a3 cc 60 00 48 89 df
>  RSP: 0018:ffffc9000008bc58 EFLAGS: 00010246
>  RAX: 0000000000000000 RBX: ffffc9000008bca0 RCX: 0000000000000009
>  RDX: 0000000000200000 RSI: ffffffff82b4a460 RDI: ffff88810ac5c3f4
>  RBP: 0000000000001000 R08: 0000000000001000 R09: 0000000000000000
>  R10: 0000000000000000 R11: 0000000000000007 R12: ffff888072cafd10
>  R13: ffff88810ac5c380 R14: ffff888101afc440 R15: 0000000000000000
>  FS:  0000000000000000(0000) GS:ffff88823fc00000(0000) knlGS:0000000000000000
>  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>  CR2: 0000000000000028 CR3: 0000000106ca2002 CR4: 0000000000772ef0
>  PKRU: 55555554
>  Call Trace:
>   <TASK>
>   ? preempt_count_add+0x68/0xa0
>   page_mapped_in_vma+0xb4/0x230
>   collect_procs.part.35+0x11b/0x440
>   hwpoison_user_mappings+0x165/0x5b0
>   ? zone_pcp_enable+0x16/0x30
>   memory_failure+0xbea/0xd90
>   ? _printk+0x58/0x6f
>   uc_decode_notifier+0x4b/0xd0
>   blocking_notifier_call_chain+0x60/0x90
>   mce_gen_pool_process+0x3c/0x60
>   process_one_work+0x1c2/0x390
>   ? process_one_work+0x390/0x390
>   worker_thread+0x30/0x360
>   ? process_one_work+0x390/0x390
>   kthread+0xe6/0x110
>   ? kthread_complete_and_exit+0x20/0x20
>   ret_from_fork+0x1f/0x30
>   </TASK>
>
> Fixes: 2aff7a4755bed ("mm: Convert page_vma_mapped_walk to work on PFNs")
> Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>

Good catch.

Reviewed-by: Muchun Song <songmuchun@bytedance.com>

Thanks.

Re: [PATCH] mm: fix kernel NULL pointer dereference in page_vma_mapped_walk

[Matthew Wilcox]

On Thu, Apr 07, 2022 at 02:40:08PM +0800, zhenwei pi wrote:
> size_to_hstate(4K) returns NULL pointer, this leads kernel BUG in
> function page_vma_mapped_walk.

Yes, I think this is the right fix.  It's not immediately obvious from
the bug and the patch, but what's going on is:

page_mapped_in_vma() sets nr_pages to 1.  This is correct because we
usually only want to know about the precise page, and not about the
folio containing it.  But hugetlbfs is special (... in so many ways ...)
and actually wants to work on the entire folio.  We could set nr_pages
specially for hugetlb pages, but it's better to ignore it in
page_vma_mapped_walk() for the hugetlb case.

I'll fix up the changelog and add it to my pile of fixes that I'm
sending tomorrow.
https://git.infradead.org/users/willy/pagecache.git/shortlog/refs/heads/for-next

> diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c
> index 1187f9c1ec5b..a39ec23581c9 100644
> --- a/mm/page_vma_mapped.c
> +++ b/mm/page_vma_mapped.c
> @@ -163,7 +163,7 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw)
>  		return not_found(pvmw);
>  
>  	if (unlikely(is_vm_hugetlb_page(vma))) {
> -		unsigned long size = pvmw->nr_pages * PAGE_SIZE;
> +		unsigned long size = huge_page_size(hstate_vma(vma));
>  		/* The only possible mapping was handled on last iteration */
>  		if (pvmw->pte)
>  			return not_found(pvmw);
> -- 
> 2.25.1
> 

Re: [PATCH] mm: fix kernel NULL pointer dereference in page_vma_mapped_walk

[Matthew Wilcox]

On Thu, Apr 07, 2022 at 02:54:42PM +0100, Matthew Wilcox wrote:
> On Thu, Apr 07, 2022 at 02:40:08PM +0800, zhenwei pi wrote:
> > size_to_hstate(4K) returns NULL pointer, this leads kernel BUG in
> > function page_vma_mapped_walk.
> 
> Yes, I think this is the right fix.  It's not immediately obvious from
> the bug and the patch, but what's going on is:
> 
> page_mapped_in_vma() sets nr_pages to 1.  This is correct because we
> usually only want to know about the precise page, and not about the
> folio containing it.  But hugetlbfs is special (... in so many ways ...)
> and actually wants to work on the entire folio.  We could set nr_pages
> specially for hugetlb pages, but it's better to ignore it in
> page_vma_mapped_walk() for the hugetlb case.
> 
> I'll fix up the changelog and add it to my pile of fixes that I'm
> sending tomorrow.
> https://git.infradead.org/users/willy/pagecache.git/shortlog/refs/heads/for-next

I looked over the patch in context, and realised we now don't need to
call size_to_hstate since we're getting the hstate from the VMA.

https://git.infradead.org/users/willy/pagecache.git/commitdiff/98ea02597b9967c0817d29fee2f96d21b9e59ca5

Re: Re: [PATCH] mm: fix kernel NULL pointer dereference in page_vma_mapped_walk

[zhenwei pi]

On 4/7/22 22:17, Matthew Wilcox wrote:
> On Thu, Apr 07, 2022 at 02:54:42PM +0100, Matthew Wilcox wrote:
>> On Thu, Apr 07, 2022 at 02:40:08PM +0800, zhenwei pi wrote:
>>> size_to_hstate(4K) returns NULL pointer, this leads kernel BUG in
>>> function page_vma_mapped_walk.
>>
>> Yes, I think this is the right fix.  It's not immediately obvious from
>> the bug and the patch, but what's going on is:
>>
>> page_mapped_in_vma() sets nr_pages to 1.  This is correct because we
>> usually only want to know about the precise page, and not about the
>> folio containing it.  But hugetlbfs is special (... in so many ways ...)
>> and actually wants to work on the entire folio.  We could set nr_pages
>> specially for hugetlb pages, but it's better to ignore it in
>> page_vma_mapped_walk() for the hugetlb case.
>>
>> I'll fix up the changelog and add it to my pile of fixes that I'm
>> sending tomorrow.
>> https://git.infradead.org/users/willy/pagecache.git/shortlog/refs/heads/for-next
> 
> I looked over the patch in context, and realised we now don't need to
> call size_to_hstate since we're getting the hstate from the VMA.
> 
> https://git.infradead.org/users/willy/pagecache.git/commitdiff/98ea02597b9967c0817d29fee2f96d21b9e59ca5
> 
Thanks!
-- 
zhenwei pi