From: Thomas Gleixner <tglx@linutronix.de>
To: Cyrill Gorcunov <gorcunov@gmail.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
Ingo Molnar <mingo@kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
linux-mm@kvack.org, Catalin Marinas <catalin.marinas@arm.com>
Subject: Re: [BUG -tip] kmemleak and stacktrace cause page faul
Date: Wed, 23 Oct 2019 15:47:57 +0200 (CEST) [thread overview]
Message-ID: <alpine.DEB.2.21.1910231533180.2308@nanos.tec.linutronix.de> (raw)
In-Reply-To: <alpine.DEB.2.21.1910231457400.2308@nanos.tec.linutronix.de>
On Wed, 23 Oct 2019, Thomas Gleixner wrote:
> On Tue, 22 Oct 2019, Cyrill Gorcunov wrote:
> Ergo ep must be a valid pointer pointing to the statically allocated and
> statically initialized estack_pages array.
>
> /* Guard page? */
> if (!ep->size)
>
> How on earth can dereferencing ep crash the machine?
>
> return false;
>
> That does not make any sense.
>
> Surely, we should not even try to decode exception stack when
> cea_exception_stacks is not yet initialized, but that does not explain
> anything what you are observing.
So looking at your actual crash:
[ 0.027246] BUG: unable to handle page fault for address: 0000000000001ff0
So this derefences the stack pointer address.
[ 0.082275] stk 0x1010 k 1 begin 0x0 end 0xd000 estack_pages 0xffffffff82014880 ep
0xffffffff82014888
ep is pointing correctly to estack_pages[1] which is bogus because 0x1010
is not a valid stack value, but dereferencing ep does not make it crash.
The crash farther down:
end = begin + (unsigned long)ep->size;
==> end = 0x2000
regs = (struct pt_regs *)end - 1;
==> regs = 0x2000 - sizeof(struct pt_regs *) = 0x1ff0
info->type = ep->type;
info->begin = (unsigned long *)begin;
info->end = (unsigned long *)end;
----> info->next_sp = (unsigned long *)regs->sp;
This is the crashing instruction trying to access 0x1ff0
And you are right this happens because cea_exception_stacks is not yet
initialized which makes begin = 0 and therefore point into nirvana.
So the fix is trivial.
Thanks,
tglx
8<------------
--- a/arch/x86/kernel/dumpstack_64.c
+++ b/arch/x86/kernel/dumpstack_64.c
@@ -94,6 +94,13 @@ static bool in_exception_stack(unsigned
BUILD_BUG_ON(N_EXCEPTION_STACKS != 6);
begin = (unsigned long)__this_cpu_read(cea_exception_stacks);
+ /*
+ * Handle the case where stack trace is collected _before_
+ * cea_exception_stacks had been initialized.
+ */
+ if (!begin)
+ return false;
+
end = begin + sizeof(struct cea_exception_stacks);
/* Bail if @stack is outside the exception stack area. */
if (stk < begin || stk >= end)
next prev parent reply other threads:[~2019-10-23 13:48 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-19 11:44 [BUG -tip] kmemleak and stacktrace cause page faul Cyrill Gorcunov
2019-10-22 14:23 ` Cyrill Gorcunov
2019-10-22 14:56 ` Cyrill Gorcunov
2019-10-23 13:21 ` Thomas Gleixner
2019-10-23 13:32 ` Cyrill Gorcunov
2019-10-23 13:38 ` Thomas Gleixner
2019-10-23 13:44 ` Cyrill Gorcunov
2019-10-23 13:47 ` Thomas Gleixner [this message]
2019-10-23 13:53 ` Cyrill Gorcunov
2019-10-23 13:59 ` Cyrill Gorcunov
2019-10-23 18:05 ` [PATCH] x86/dumpstack/64: Don't evaluate exception stacks before setup Thomas Gleixner
2019-10-23 18:31 ` Matthew Wilcox
2019-10-23 18:43 ` Cyrill Gorcunov
2019-10-23 21:27 ` Thomas Gleixner
2019-10-23 19:17 ` Josh Poimboeuf
2019-11-04 23:56 ` [tip: x86/urgent] " tip-bot2 for Thomas Gleixner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.21.1910231533180.2308@nanos.tec.linutronix.de \
--to=tglx@linutronix.de \
--cc=catalin.marinas@arm.com \
--cc=gorcunov@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).