[PATCH] powerpc/pmem: Fix kernel crash due to wrong range value usage in flush_dcache_range

[PATCH] powerpc/pmem: Fix kernel crash due to wrong range value usage in flush_dcache_range

[Aneesh Kumar K.V]

This patch fix the below kernel crash.

 BUG: Unable to handle kernel data access on read at 0xc000000380000000
 Faulting instruction address: 0xc00000000008b6f0
cpu 0x5: Vector: 300 (Data Access) at [c0000000d8587790]
    pc: c00000000008b6f0: arch_remove_memory+0x150/0x210
    lr: c00000000008b720: arch_remove_memory+0x180/0x210
    sp: c0000000d8587a20
   msr: 800000000280b033
   dar: c000000380000000
 dsisr: 40000000
  current = 0xc0000000d8558600
  paca    = 0xc00000000fff8f00   irqmask: 0x03   irq_happened: 0x01
    pid   = 1220, comm = ndctl
enter ? for help
 memunmap_pages+0x33c/0x410
 devm_action_release+0x30/0x50
 release_nodes+0x30c/0x3a0
 device_release_driver_internal+0x178/0x240
 unbind_store+0x74/0x190
 drv_attr_store+0x44/0x60
 sysfs_kf_write+0x74/0xa0
 kernfs_fop_write+0x1b0/0x260
 __vfs_write+0x3c/0x70
 vfs_write+0xe4/0x200
 ksys_write+0x7c/0x140
 system_call+0x5c/0x68

Fixes: 076265907cf9 ("powerpc: Chunk calls to flush_dcache_range in arch_*_memory")
Reported-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
---
 arch/powerpc/mm/mem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index ad299e72ec30..9488b63dfc87 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -121,7 +121,7 @@ static void flush_dcache_range_chunked(unsigned long start, unsigned long stop,
 	unsigned long i;
 
 	for (i = start; i < stop; i += chunk) {
-		flush_dcache_range(i, min(stop, start + chunk));
+		flush_dcache_range(i, min(stop, i + chunk));
 		cond_resched();
 	}
 }
-- 
2.23.0

Re: [PATCH] powerpc/pmem: Fix kernel crash due to wrong range value usage in flush_dcache_range

[Michael Ellerman]

On Wed, 2019-12-04 at 05:29:09 UTC, "Aneesh Kumar K.V" wrote:
> This patch fix the below kernel crash.
> 
>  BUG: Unable to handle kernel data access on read at 0xc000000380000000
>  Faulting instruction address: 0xc00000000008b6f0
> cpu 0x5: Vector: 300 (Data Access) at [c0000000d8587790]
>     pc: c00000000008b6f0: arch_remove_memory+0x150/0x210
>     lr: c00000000008b720: arch_remove_memory+0x180/0x210
>     sp: c0000000d8587a20
>    msr: 800000000280b033
>    dar: c000000380000000
>  dsisr: 40000000
>   current = 0xc0000000d8558600
>   paca    = 0xc00000000fff8f00   irqmask: 0x03   irq_happened: 0x01
>     pid   = 1220, comm = ndctl
> enter ? for help
>  memunmap_pages+0x33c/0x410
>  devm_action_release+0x30/0x50
>  release_nodes+0x30c/0x3a0
>  device_release_driver_internal+0x178/0x240
>  unbind_store+0x74/0x190
>  drv_attr_store+0x44/0x60
>  sysfs_kf_write+0x74/0xa0
>  kernfs_fop_write+0x1b0/0x260
>  __vfs_write+0x3c/0x70
>  vfs_write+0xe4/0x200
>  ksys_write+0x7c/0x140
>  system_call+0x5c/0x68
> 
> Fixes: 076265907cf9 ("powerpc: Chunk calls to flush_dcache_range in arch_*_memory")
> Reported-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>

Applied to powerpc fixes, thanks.

https://git.kernel.org/powerpc/c/6f4679b956741d2da6ad3ebb738cbe1264ac8781

cheers

Re: [PATCH] powerpc/pmem: Fix kernel crash due to wrong range value usage in flush_dcache_range

[Sachin Sant]

> 
> Fixes: 076265907cf9 ("powerpc: Chunk calls to flush_dcache_range in arch_*_memory")
> Reported-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
> ---
> arch/powerpc/mm/mem.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 

It took a while to setup environment on a replacement machine. 
Was able to test the fix. With this fix applied I no longer see the problem.

Tested-by: Sachin Sant <sachinp@linux.vnet.ibm.com>

Thanks
-Sachin
> diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
> index ad299e72ec30..9488b63dfc87 100644
> --- a/arch/powerpc/mm/mem.c
> +++ b/arch/powerpc/mm/mem.c
> @@ -121,7 +121,7 @@ static void flush_dcache_range_chunked(unsigned long start, unsigned long stop,
> 	unsigned long i;
> 
> 	for (i = start; i < stop; i += chunk) {
> -		flush_dcache_range(i, min(stop, start + chunk));
> +		flush_dcache_range(i, min(stop, i + chunk));
> 		cond_resched();
> 	}
> }
> -- 
> 2.23.0
>