* [PATCH 0/1] mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests() @ 2021-05-25 13:00 Gerald Schaefer 2021-05-25 13:00 ` [PATCH 1/1] " Gerald Schaefer 2021-05-26 4:24 ` [PATCH 0/1] " Anshuman Khandual 0 siblings, 2 replies; 7+ messages in thread From: Gerald Schaefer @ 2021-05-25 13:00 UTC (permalink / raw) To: Andrew Morton, Anshuman Khandual Cc: linux-mm, LKML, linux-arch, linux-sparc, linux-s390, Gerald Schaefer We sometimes see a "BUG task_struct (Not tainted): Padding overwritten" on s390, directly after running debug_vm_pgtable. This is because of wrong vaddr alignment in pmd/pud_advanced_tests(), leading to memory corruption at least on s390, see patch description. At first glance, other architectures do not seem to care about vaddr in their xxx_get_and_clear() implementations, so they should not be affected. One exception is sparc, where the addr is passed over to some tlb_batch code, but I'm not sure what implication the wrongly aligned vaddr would have in this case. Also adding linux-arch, just to make sure. Gerald Schaefer (1): mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests() mm/debug_vm_pgtable.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.25.1 ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH 1/1] mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests() 2021-05-25 13:00 [PATCH 0/1] mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests() Gerald Schaefer @ 2021-05-25 13:00 ` Gerald Schaefer 2021-05-26 4:40 ` Anshuman Khandual 2021-05-26 11:27 ` Anatoly Pugachev 2021-05-26 4:24 ` [PATCH 0/1] " Anshuman Khandual 1 sibling, 2 replies; 7+ messages in thread From: Gerald Schaefer @ 2021-05-25 13:00 UTC (permalink / raw) To: Andrew Morton, Anshuman Khandual Cc: linux-mm, LKML, linux-arch, linux-sparc, linux-s390, Gerald Schaefer, stable In pmd/pud_advanced_tests(), the vaddr is aligned up to the next pmd/pud entry, and so it does not match the given pmdp/pudp and (aligned down) pfn any more. For s390, this results in memory corruption, because the IDTE instruction used e.g. in xxx_get_and_clear() will take the vaddr for some calculations, in combination with the given pmdp. It will then end up with a wrong table origin, ending on ...ff8, and some of those wrongly set low-order bits will also select a wrong pagetable level for the index addition. IDTE could therefore invalidate (or 0x20) something outside of the page tables, depending on the wrongly picked index, which in turn depends on the random vaddr. As result, we sometimes see "BUG task_struct (Not tainted): Padding overwritten" on s390, where one 0x5a padding value got overwritten with 0x7a. Fix this by aligning down, similar to how the pmd/pud_aligned pfns are calculated. Fixes: a5c3b9ffb0f40 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers") Cc: <stable@vger.kernel.org> # v5.9+ Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> --- mm/debug_vm_pgtable.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/debug_vm_pgtable.c b/mm/debug_vm_pgtable.c index 6ff92c8b0a00..f7b23565a04f 100644 --- a/mm/debug_vm_pgtable.c +++ b/mm/debug_vm_pgtable.c @@ -193,7 +193,7 @@ static void __init pmd_advanced_tests(struct mm_struct *mm, pr_debug("Validating PMD advanced\n"); /* Align the address wrt HPAGE_PMD_SIZE */ - vaddr = (vaddr & HPAGE_PMD_MASK) + HPAGE_PMD_SIZE; + vaddr &= HPAGE_PMD_MASK; pgtable_trans_huge_deposit(mm, pmdp, pgtable); @@ -318,7 +318,7 @@ static void __init pud_advanced_tests(struct mm_struct *mm, pr_debug("Validating PUD advanced\n"); /* Align the address wrt HPAGE_PUD_SIZE */ - vaddr = (vaddr & HPAGE_PUD_MASK) + HPAGE_PUD_SIZE; + vaddr &= HPAGE_PUD_MASK; pud = pfn_pud(pfn, prot); set_pud_at(mm, vaddr, pudp, pud); -- 2.25.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH 1/1] mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests() 2021-05-25 13:00 ` [PATCH 1/1] " Gerald Schaefer @ 2021-05-26 4:40 ` Anshuman Khandual 2021-05-26 11:27 ` Anatoly Pugachev 1 sibling, 0 replies; 7+ messages in thread From: Anshuman Khandual @ 2021-05-26 4:40 UTC (permalink / raw) To: Gerald Schaefer, Andrew Morton Cc: linux-mm, LKML, linux-arch, linux-sparc, linux-s390, stable, Vineet Gupta, Palmer Dabbelt, Paul Walmsley On 5/25/21 6:30 PM, Gerald Schaefer wrote: > In pmd/pud_advanced_tests(), the vaddr is aligned up to the next pmd/pud > entry, and so it does not match the given pmdp/pudp and (aligned down) pfn > any more. > > For s390, this results in memory corruption, because the IDTE instruction > used e.g. in xxx_get_and_clear() will take the vaddr for some calculations, > in combination with the given pmdp. It will then end up with a wrong table > origin, ending on ...ff8, and some of those wrongly set low-order bits will > also select a wrong pagetable level for the index addition. IDTE could > therefore invalidate (or 0x20) something outside of the page tables, > depending on the wrongly picked index, which in turn depends on the random > vaddr. > > As result, we sometimes see "BUG task_struct (Not tainted): Padding > overwritten" on s390, where one 0x5a padding value got overwritten with > 0x7a. > > Fix this by aligning down, similar to how the pmd/pud_aligned pfns are > calculated. > > Fixes: a5c3b9ffb0f40 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers") > Cc: <stable@vger.kernel.org> # v5.9+ > Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Did not see any problem on arm64 or x86, builds okay across all supported platforms. It would be great, if folks could test this on remaining platforms i.e arc, riscv etc. + Vineet Gupta <vgupta@synopsys.com> + Palmer Dabbelt <palmer@dabbelt.com> + Paul Walmsley <paul.walmsley@sifive.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> > --- > mm/debug_vm_pgtable.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/mm/debug_vm_pgtable.c b/mm/debug_vm_pgtable.c > index 6ff92c8b0a00..f7b23565a04f 100644 > --- a/mm/debug_vm_pgtable.c > +++ b/mm/debug_vm_pgtable.c > @@ -193,7 +193,7 @@ static void __init pmd_advanced_tests(struct mm_struct *mm, > > pr_debug("Validating PMD advanced\n"); > /* Align the address wrt HPAGE_PMD_SIZE */ > - vaddr = (vaddr & HPAGE_PMD_MASK) + HPAGE_PMD_SIZE; > + vaddr &= HPAGE_PMD_MASK; > > pgtable_trans_huge_deposit(mm, pmdp, pgtable); > > @@ -318,7 +318,7 @@ static void __init pud_advanced_tests(struct mm_struct *mm, > > pr_debug("Validating PUD advanced\n"); > /* Align the address wrt HPAGE_PUD_SIZE */ > - vaddr = (vaddr & HPAGE_PUD_MASK) + HPAGE_PUD_SIZE; > + vaddr &= HPAGE_PUD_MASK; > > pud = pfn_pud(pfn, prot); > set_pud_at(mm, vaddr, pudp, pud); > ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 1/1] mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests() 2021-05-25 13:00 ` [PATCH 1/1] " Gerald Schaefer 2021-05-26 4:40 ` Anshuman Khandual @ 2021-05-26 11:27 ` Anatoly Pugachev 2021-05-26 12:36 ` Anshuman Khandual 1 sibling, 1 reply; 7+ messages in thread From: Anatoly Pugachev @ 2021-05-26 11:27 UTC (permalink / raw) To: Gerald Schaefer Cc: Andrew Morton, Anshuman Khandual, linux-mm, LKML, linux-arch, linux-sparc, linux-s390, stable On Tue, May 25, 2021 at 4:03 PM Gerald Schaefer <gerald.schaefer@linux.ibm.com> wrote: > > In pmd/pud_advanced_tests(), the vaddr is aligned up to the next pmd/pud > entry, and so it does not match the given pmdp/pudp and (aligned down) pfn > any more. > > For s390, this results in memory corruption, because the IDTE instruction > used e.g. in xxx_get_and_clear() will take the vaddr for some calculations, > in combination with the given pmdp. It will then end up with a wrong table > origin, ending on ...ff8, and some of those wrongly set low-order bits will > also select a wrong pagetable level for the index addition. IDTE could > therefore invalidate (or 0x20) something outside of the page tables, > depending on the wrongly picked index, which in turn depends on the random > vaddr. > > As result, we sometimes see "BUG task_struct (Not tainted): Padding > overwritten" on s390, where one 0x5a padding value got overwritten with > 0x7a. > > Fix this by aligning down, similar to how the pmd/pud_aligned pfns are > calculated. > > Fixes: a5c3b9ffb0f40 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers") > Cc: <stable@vger.kernel.org> # v5.9+ > Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> boot tested on sparc64 with quick run of stress-ng ( --class memory --sequential -1 --timeout 10s -v --pathological --oomable --metrics-brief ) stress-ng: debug: [371408] system: Linux ttip 5.13.0-rc3-00043-gad9f25d33860-dirty #218 SMP Wed May 26 11:55:54 MSK 2021 sparc64 Tested-by: Anatoly Pugachev <matorola@gmail.com> ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 1/1] mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests() 2021-05-26 11:27 ` Anatoly Pugachev @ 2021-05-26 12:36 ` Anshuman Khandual 2021-05-26 13:36 ` Anatoly Pugachev 0 siblings, 1 reply; 7+ messages in thread From: Anshuman Khandual @ 2021-05-26 12:36 UTC (permalink / raw) To: Anatoly Pugachev, Gerald Schaefer Cc: Andrew Morton, linux-mm, LKML, linux-arch, linux-sparc, linux-s390, stable On 5/26/21 4:57 PM, Anatoly Pugachev wrote: > On Tue, May 25, 2021 at 4:03 PM Gerald Schaefer > <gerald.schaefer@linux.ibm.com> wrote: >> >> In pmd/pud_advanced_tests(), the vaddr is aligned up to the next pmd/pud >> entry, and so it does not match the given pmdp/pudp and (aligned down) pfn >> any more. >> >> For s390, this results in memory corruption, because the IDTE instruction >> used e.g. in xxx_get_and_clear() will take the vaddr for some calculations, >> in combination with the given pmdp. It will then end up with a wrong table >> origin, ending on ...ff8, and some of those wrongly set low-order bits will >> also select a wrong pagetable level for the index addition. IDTE could >> therefore invalidate (or 0x20) something outside of the page tables, >> depending on the wrongly picked index, which in turn depends on the random >> vaddr. >> >> As result, we sometimes see "BUG task_struct (Not tainted): Padding >> overwritten" on s390, where one 0x5a padding value got overwritten with >> 0x7a. >> >> Fix this by aligning down, similar to how the pmd/pud_aligned pfns are >> calculated. >> >> Fixes: a5c3b9ffb0f40 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers") >> Cc: <stable@vger.kernel.org> # v5.9+ >> Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> > > boot tested on sparc64 with quick run of stress-ng ( --class memory > --sequential -1 --timeout 10s -v --pathological --oomable > --metrics-brief ) > stress-ng: debug: [371408] system: Linux ttip > 5.13.0-rc3-00043-gad9f25d33860-dirty #218 SMP Wed May 26 11:55:54 MSK > 2021 sparc64 > > Tested-by: Anatoly Pugachev <matorola@gmail.com> > spac64 does not enable ARCH_HAS_DEBUG_VM_PGTABLE, did you enable it before running the test ? Did the entire test debug_vm_pgtable() run successfully on sparc64 ? ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 1/1] mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests() 2021-05-26 12:36 ` Anshuman Khandual @ 2021-05-26 13:36 ` Anatoly Pugachev 0 siblings, 0 replies; 7+ messages in thread From: Anatoly Pugachev @ 2021-05-26 13:36 UTC (permalink / raw) To: Anshuman Khandual Cc: Gerald Schaefer, Andrew Morton, linux-mm, LKML, linux-arch, linux-sparc, linux-s390, stable On Wed, May 26, 2021 at 3:35 PM Anshuman Khandual <anshuman.khandual@arm.com> wrote: > spac64 does not enable ARCH_HAS_DEBUG_VM_PGTABLE, did you enable it > before running the test ? Did the entire test debug_vm_pgtable() run > successfully on sparc64 ? Ahh.. Sorry for the noise then... Thought that CONFIG_TRANSPARENT_HUGEPAGE would be enough... ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 0/1] mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests() 2021-05-25 13:00 [PATCH 0/1] mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests() Gerald Schaefer 2021-05-25 13:00 ` [PATCH 1/1] " Gerald Schaefer @ 2021-05-26 4:24 ` Anshuman Khandual 1 sibling, 0 replies; 7+ messages in thread From: Anshuman Khandual @ 2021-05-26 4:24 UTC (permalink / raw) To: Gerald Schaefer, Andrew Morton Cc: linux-mm, LKML, linux-arch, linux-sparc, linux-s390 On 5/25/21 6:30 PM, Gerald Schaefer wrote: > We sometimes see a "BUG task_struct (Not tainted): Padding overwritten" > on s390, directly after running debug_vm_pgtable. This is because of > wrong vaddr alignment in pmd/pud_advanced_tests(), leading to memory > corruption at least on s390, see patch description. > > At first glance, other architectures do not seem to care about vaddr in > their xxx_get_and_clear() implementations, so they should not be affected. IIRC, alignment (regardless up or down) is the only requirement on certain platforms. Probably it should not affect other platforms as this change just aligns the virtual address down. > One exception is sparc, where the addr is passed over to some tlb_batch > code, but I'm not sure what implication the wrongly aligned vaddr would > have in this case. > > Also adding linux-arch, just to make sure. Right. Not sure if this test gets to run on sparc platform for not being currently supported. But we could take a look if there are any reported problems because of vaddr. > > Gerald Schaefer (1): > mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests() > > mm/debug_vm_pgtable.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2021-05-26 13:36 UTC | newest] Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-05-25 13:00 [PATCH 0/1] mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests() Gerald Schaefer 2021-05-25 13:00 ` [PATCH 1/1] " Gerald Schaefer 2021-05-26 4:40 ` Anshuman Khandual 2021-05-26 11:27 ` Anatoly Pugachev 2021-05-26 12:36 ` Anshuman Khandual 2021-05-26 13:36 ` Anatoly Pugachev 2021-05-26 4:24 ` [PATCH 0/1] " Anshuman Khandual
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).