From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.4 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A9386C432C0 for ; Sun, 1 Dec 2019 15:46:09 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 4758620725 for ; Sun, 1 Dec 2019 15:46:09 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=alien8.de header.i=@alien8.de header.b="Ak2uZKWS" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4758620725 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=alien8.de Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id A3D5D6B0006; Sun, 1 Dec 2019 10:46:08 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 9C6936B0007; Sun, 1 Dec 2019 10:46:08 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 88EB46B0008; Sun, 1 Dec 2019 10:46:08 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0175.hostedemail.com [216.40.44.175]) by kanga.kvack.org (Postfix) with ESMTP id 704906B0006 for ; Sun, 1 Dec 2019 10:46:08 -0500 (EST) Received: from smtpin09.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with SMTP id 11817180AD820 for ; Sun, 1 Dec 2019 15:46:08 +0000 (UTC) X-FDA: 76216998816.09.fang30_1859bf6043014 X-HE-Tag: fang30_1859bf6043014 X-Filterd-Recvd-Size: 8464 Received: from mail.skyhub.de (mail.skyhub.de [5.9.137.197]) by imf19.hostedemail.com (Postfix) with ESMTP for ; Sun, 1 Dec 2019 15:46:07 +0000 (UTC) Received: from zn.tnic (p200300EC2F2CED0040BA74DAC07AD948.dip0.t-ipconnect.de [IPv6:2003:ec:2f2c:ed00:40ba:74da:c07a:d948]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.skyhub.de (SuperMail on ZX Spectrum 128k) with ESMTPSA id 449E71EC08E5; Sun, 1 Dec 2019 16:46:01 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alien8.de; s=dkim; t=1575215161; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:in-reply-to:in-reply-to: references:references; bh=HMwQtbAVmQY6VEN5PUhn4PChJr0uBXYd+Akrao+SPgk=; b=Ak2uZKWSGmiFnKniRa1uFHnAn8LrUkWETT60IYrnCivhP1eKbe0VK9n7KSFd4cXGMN7B8A geibcze4dCIR3TtmLHXgZuKODorZk671DzC0nqsW0qTR/30T2QVp42IteP4TcomUubQuOU QhaaZEnJMgmKMOkRJcxf/EjjUDZE5rI= Date: Sun, 1 Dec 2019 16:45:54 +0100 From: Borislav Petkov To: Linus Torvalds Cc: Andrew Morton , alex@ghiti.fr, aou@eecs.berkeley.edu, Ard Biesheuvel , Arnd Bergmann , Andrey Ryabinin , Benjamin Herrenschmidt , Christian Borntraeger , Qian Cai , Catalin Marinas , Dave Hansen , dave.jiang@intel.com, David Miller , Dmitry Vyukov , Alexander Potapenko , Vasily Gorbik , Heiko Carstens , Peter Anvin , James Morse , James Hogan , Kan Liang , Linux-MM , Russell King - ARM Linux , Andrew Lutomirski , Mark Rutland , mawilcox@microsoft.com, Ingo Molnar , mm-commits@vger.kernel.org, Michael Ellerman , n-horiguchi@ah.jp.nec.com, Palmer Dabbelt , Paul Burton , Paul Walmsley , Paul Mackerras , Peter Zijlstra , ralf@linux-mips.org, shashim@codeaurora.org, Steven Price , Thomas Gleixner , vgupta@synopsys.com, Will Deacon , zong.li@sifive.com Subject: Re: [patch 064/158] mm: add generic ptdump Message-ID: <20191201154553.GE6629@zn.tnic> References: <20191201015304.cRPsmKUTM%akpm@linux-foundation.org> <20191201090724.GA6629@zn.tnic> <20191201151010.GC6629@zn.tnic> <20191201152119.GD6629@zn.tnic> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20191201152119.GD6629@zn.tnic> User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sun, Dec 01, 2019 at 04:21:19PM +0100, Borislav Petkov wrote: > On Sun, Dec 01, 2019 at 04:10:11PM +0100, Borislav Petkov wrote: > > So lemme first confirm it really is caused by those patches. > > Yeah, those patches are causing it. Tried your current master - it is OK > - and then applied Andrew's patches I was CCed on, ontop, and I got in a > VM: > > VFS: Mounted root (ext4 filesystem) readonly on device 8:2. > devtmpfs: mounted > Freeing unused kernel image (initmem) memory: 664K > Write protecting kernel text and read-only data: 18164k > NX-protecting the kernel data: 7416k > BUG: kernel NULL pointer dereference, address: 00000014 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > *pdpt = 0000000000000000 *pde = f000ff53f000ff53 > Oops: 0000 [#1] PREEMPT SMP PTI > CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.4.0+ #3 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014 > EIP: __lock_acquire.isra.0+0x2e8/0x4e0 > Code: e8 bd a1 2f 00 85 c0 74 11 8b 1d 08 8f 26 c5 85 db 0f 84 05 1a 00 00 8d 76 00 31 db 8d 65 f4 89 d8 5b 5e 5f 5d c3 8d 74 26 00 <8b> 44 90 04 85 c0 0f 85 4c fd ff ff e9 33 fd ff ff 8d b4 26 00 00 > EAX: 00000010 EBX: 00000010 ECX: 00000001 EDX: 00000000 > ESI: f1070040 EDI: f1070040 EBP: f1073e04 ESP: f1073de0 > DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00010097 > CR0: 80050033 CR2: 00000014 CR3: 05348000 CR4: 001406b0 > Call Trace: > lock_acquire+0x42/0x60 > ? __walk_page_range+0x4d9/0x590 > _raw_spin_lock+0x22/0x40 > ? __walk_page_range+0x4d9/0x590 > __walk_page_range+0x4d9/0x590 Ok, some more staring. That offset is: # mm/pagewalk.c:31: pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl); sall $5, %eax #, tmp235 addl -64(%ebp), %eax # %sfp, tmp236 call page_address # addl %eax, %esi # tmp306, __pte # ./include/linux/spinlock.h:338: raw_spin_lock(&lock->rlock); movl -76(%ebp), %eax # %sfp, call _raw_spin_lock # movl %edi, %edx # start, start movl %ebx, -64(%ebp) # __boundary, %sfp movl -80(%ebp), %edi # %sfp, ops movl %esi, -40(%ebp) # __pte, %sfp i.e., pte_offset_map_lock() and I *think* that ptl thing is NULL. The Code section decodes to: Code: e8 bd a1 2f 00 85 c0 74 11 8b 1d 08 8f 26 c5 85 db 0f 84 05 1a 00 00 8d 76 00 31 db 8d 65 f4 89 d8 5b 5e 5f 5d c3 8d 74 26 00 <8b> 44 90 04 85 c0 0f 85 4c fd ff ff e9 33 fd ff ff 8d b4 26 00 00 All code ======== 0: e8 bd a1 2f 00 callq 0x2fa1c2 5: 85 c0 test %eax,%eax 7: 74 11 je 0x1a 9: 8b 1d 08 8f 26 c5 mov -0x3ad970f8(%rip),%ebx # 0xffffffffc5268f17 f: 85 db test %ebx,%ebx 11: 0f 84 05 1a 00 00 je 0x1a1c 17: 8d 76 00 lea 0x0(%rsi),%esi 1a: 31 db xor %ebx,%ebx 1c: 8d 65 f4 lea -0xc(%rbp),%esp 1f: 89 d8 mov %ebx,%eax 21: 5b pop %rbx 22: 5e pop %rsi 23: 5f pop %rdi 24: 5d pop %rbp 25: c3 retq 26: 8d 74 26 00 lea 0x0(%rsi,%riz,1),%esi 2a:* 8b 44 90 04 mov 0x4(%rax,%rdx,4),%eax <-- trapping instruction 2e: 85 c0 test %eax,%eax 30: 0f 85 4c fd ff ff jne 0xfffffffffffffd82 36: e9 33 fd ff ff jmpq 0xfffffffffffffd6e 3b: 8d .byte 0x8d 3c: b4 26 which is this corresponding piece in __lock_acquire(): call debug_locks_off # # kernel/locking/lockdep.c:3775: if (!debug_locks_off()) testl %eax, %eax # tmp325 je .L562 #, # kernel/locking/lockdep.c:3777: if (debug_locks_silent) movl debug_locks_silent, %ebx # debug_locks_silent, # kernel/locking/lockdep.c:3777: if (debug_locks_silent) testl %ebx, %ebx # je .L642 #, .p2align 4,,10 .p2align 3 .L562: # kernel/locking/lockdep.c:3826: return 0; xorl %ebx, %ebx # .L557: # kernel/locking/lockdep.c:3982: } leal -12(%ebp), %esp #, movl %ebx, %eax # , popl %ebx # popl %esi # popl %edi # popl %ebp # ret .p2align 4,,10 .p2align 3 .L649: # kernel/locking/lockdep.c:3832: class = lock->class_cache[subclass]; movl 4(%eax,%edx,4), %eax # lock_7(D)->class_cache, class ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ (the LEA above is NOP padding) and %eax and %edx are both NULL. i.e., that thing: if (subclass < NR_LOCKDEP_CACHING_CLASSES) class = lock->class_cache[subclass]; ^^^^^^^^^^^^^^^ AFAICT, of course. -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette