From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 034C2C433DB for ; Thu, 7 Jan 2021 01:12:04 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 4F8B423123 for ; Thu, 7 Jan 2021 01:12:02 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4F8B423123 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux-foundation.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 42FD36B02E8; Wed, 6 Jan 2021 20:12:02 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 3B9356B02E9; Wed, 6 Jan 2021 20:12:02 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 280D16B02EA; Wed, 6 Jan 2021 20:12:02 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0065.hostedemail.com [216.40.44.65]) by kanga.kvack.org (Postfix) with ESMTP id 0EF116B02E8 for ; Wed, 6 Jan 2021 20:12:02 -0500 (EST) Received: from smtpin24.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id AACB42DFD for ; Thu, 7 Jan 2021 01:12:01 +0000 (UTC) X-FDA: 77677202442.24.view11_5109e85274e6 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin24.hostedemail.com (Postfix) with ESMTP id 8E4A41A4A7 for ; Thu, 7 Jan 2021 01:12:01 +0000 (UTC) X-HE-Tag: view11_5109e85274e6 X-Filterd-Recvd-Size: 9646 Received: from mail-ej1-f42.google.com (mail-ej1-f42.google.com [209.85.218.42]) by imf30.hostedemail.com (Postfix) with ESMTP for ; Thu, 7 Jan 2021 01:12:00 +0000 (UTC) Received: by mail-ej1-f42.google.com with SMTP id t16so7463409ejf.13 for ; Wed, 06 Jan 2021 17:12:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4qZRa6vTQ/ibyR+kN56/QIb8lbRVyte/SLIYH3vkfN4=; b=IhnuY2K3J/k451EufL1ohbfykeSkE/N5J0xYpEQvRqy+jmymijQ2naFiC9h9ABKezO HKcSoE3Ei+HCR/qCzXNxEk32HdQzmK2+R9ckv2I2DkiBWh6naal+zzQLQK2dUSsEiY4M JEw6mDHpCOHT6ARq9dyFBSiJd5wxV/tDAbRWc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4qZRa6vTQ/ibyR+kN56/QIb8lbRVyte/SLIYH3vkfN4=; b=LsM+lORwLPgwCxHhpVtnlzThK9XAGShi77oue9+DoaK9AuJCH6gEUCRxUFcsxfWU/l NUaZ3zalVoQm8NFmdcjd/7YeLWQL87n8MxXVkToDmeBjvyeaFyzo+y8TpSBLXqrCKtpr PZU+ABahO27j/vyq/rY62XVGtwItTF7YC1qSg80cd/QQ0s1AFdbfGRCuCrPZ/KBR//Ww RjqTbaUDfOf87mlRWbAhfdEER3j2iQiZnEdHEAk98jPih5bPOFWUHFQrMcCrbokpVOYW hqRhUNEZr7Lx5M7DBr5xJDmcW1XVg+pJGRCX4VgfK5dx52d3TD+MdNuKm32lNzlT0n/N UYTA== X-Gm-Message-State: AOAM531RiOVrRobS6LjgnuikwfZLWd8+N3mwpbZ18UtZ+CtZgCTxHqCa SH7lndGh1x+e3rr2//9fxs7lRF3relRZkw== X-Google-Smtp-Source: ABdhPJx1wWhTBMos67bYfAr235nibXIapYlScwmPerFsroEF0hb1j1H4MDKcfjKY6i2NminSJxpK+w== X-Received: by 2002:a17:906:76d8:: with SMTP id q24mr180280ejn.306.1609981919201; Wed, 06 Jan 2021 17:11:59 -0800 (PST) Received: from mail-wr1-f48.google.com (mail-wr1-f48.google.com. [209.85.221.48]) by smtp.gmail.com with ESMTPSA id p24sm1979717edr.65.2021.01.06.17.11.58 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 06 Jan 2021 17:11:58 -0800 (PST) Received: by mail-wr1-f48.google.com with SMTP id c5so4032831wrp.6 for ; Wed, 06 Jan 2021 17:11:58 -0800 (PST) X-Received: by 2002:a05:6512:789:: with SMTP id x9mr2704633lfr.487.1609981444808; Wed, 06 Jan 2021 17:04:04 -0800 (PST) MIME-Version: 1.0 References: <20201118194838.753436396@linutronix.de> <20201118204007.169209557@linutronix.de> <20210106180132.41dc249d@gandalf.local.home> In-Reply-To: <20210106180132.41dc249d@gandalf.local.home> From: Linus Torvalds Date: Wed, 6 Jan 2021 17:03:48 -0800 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [BUG] from x86: Support kmap_local() forced debugging To: Steven Rostedt , Willem de Bruijn , Jakub Kicinski , David Miller , Jonathan Lemon Cc: Thomas Gleixner , LKML , "the arch/x86 maintainers" , Christoph Hellwig , Matthew Wilcox , Daniel Vetter , Andrew Morton , Linux-MM , Peter Zijlstra , Ingo Molnar , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Ben Segall , Mel Gorman , Daniel Bristot de Oliveira , Netdev Content-Type: multipart/mixed; boundary="0000000000001d1c6605b8450450" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: --0000000000001d1c6605b8450450 Content-Type: text/plain; charset="UTF-8" On Wed, Jan 6, 2021 at 3:01 PM Steven Rostedt wrote: > > I triggered the following crash on x86_32 by simply doing a: > > (ssh'ing into the box) > > # head -100 /tmp/output-file > > Where the /tmp/output-file was the output of a trace-cmd report. > Even after rebooting and not running the tracing code, simply doing the > head command still crashed. The code decodes to 0: 3b 5d e8 cmp -0x18(%ebp),%ebx 3: 0f 47 5d e8 cmova -0x18(%ebp),%ebx 7: c7 45 e0 00 00 00 00 movl $0x0,-0x20(%ebp) e: 8b 7d e0 mov -0x20(%ebp),%edi 11: 39 7d e8 cmp %edi,-0x18(%ebp) 14: 76 3a jbe 0x50 16: 8b 45 d4 mov -0x2c(%ebp),%eax 19: e8 a4 e4 ff ff call 0xffffe4c2 1e: 8b 55 e4 mov -0x1c(%ebp),%edx 21: 03 55 e0 add -0x20(%ebp),%edx 24: 89 d9 mov %ebx,%ecx 26: 01 c6 add %eax,%esi 28: 89 d7 mov %edx,%edi 2a:* f3 a4 rep movsb %ds:(%esi),%es:(%edi) <-- trapping instruction 2c: e8 c9 e4 ff ff call 0xffffe4fa 31: 01 5d e0 add %ebx,-0x20(%ebp) 34: 8b 5d e8 mov -0x18(%ebp),%ebx 37: b8 00 10 00 00 mov $0x1000,%eax 3c: 2b 5d e0 sub -0x20(%ebp),%ebx and while it would be good to see the output of scripts/decode_stacktrace.sh, I strongly suspect that the above is vaddr = kmap_atomic(p); memcpy(to + copied, vaddr + p_off, p_len); kunmap_atomic(vaddr); (although I wonder how/why the heck you've enabled CC_OPTIMIZE_FOR_SIZE=y, which is what causes "memcpy()" to be done as that "rep movsb". I thought we disabled it because it's so bad on most cpus). So that first "call" instruction is the kmap_atomic(), the "rep movs" is the memcpy(), and the "call" instruction immediately after is the kunmap_atomic(). Anyway, you can see vaddr in register state: EAX: fff57000 so we've kmapped that one page at fff57000, but we're accessing past it into the next page: > BUG: unable to handle page fault for address: fff58000 with the current source address being (ESI: fff58000) and we still have 248 bytes to go (ECX: 000000f8) even though we've already overflowed into the next page. You can see the original count still (EBX: 000005a8), so it really looks like that skb_frag_foreach_page() logic skb_frag_foreach_page(f, skb_frag_off(f) + offset - start, copy, p, p_off, p_len, copied) { vaddr = kmap_atomic(p); memcpy(to + copied, vaddr + p_off, p_len); kunmap_atomic(vaddr); } must be wrong, and doesn't handle the "each page" part properly. It must have started in the middle of the page, and p_len (that 0x5a8) was wrong. IOW, it really looks like p_off + p_len had the value 0x10f8, which is larger than one page. And looking at the code, in skb_frag_foreach_page(), I see: p_off = (f_off) & (PAGE_SIZE - 1), \ p_len = skb_frag_must_loop(p) ? \ min_t(u32, f_len, PAGE_SIZE - p_off) : f_len, \ where that "min_t(u32, f_len, PAGE_SIZE - p_off)" looks correct, but then presumably skb_frag_must_loop() must be wrong. Oh, and when I look at that, I see static inline bool skb_frag_must_loop(struct page *p) { #if defined(CONFIG_HIGHMEM) if (PageHighMem(p)) return true; #endif return false; } and that is no longer true. With the kmap debugging, even non-highmem pages need that "do one page at a time" code, because even non-highmem pages get remapped by kmap(). IOW, I think the patch to fix this might be something like the attached. I wonder whether there is other code that "knows" about kmap() only affecting PageHighmem() pages thing that is no longer true. Looking at some other code, skb_gro_reset_offset() looks suspiciously like it also thinks highmem pages are special. Adding the networking people involved in this area to the cc too. Linus --0000000000001d1c6605b8450450 Content-Type: application/octet-stream; name=patch Content-Disposition: attachment; filename=patch Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_kjm5bgcv0 IGluY2x1ZGUvbGludXgvc2tidWZmLmggfCAyICstCiAxIGZpbGUgY2hhbmdlZCwgMSBpbnNlcnRp b24oKyksIDEgZGVsZXRpb24oLSkKCmRpZmYgLS1naXQgYS9pbmNsdWRlL2xpbnV4L3NrYnVmZi5o IGIvaW5jbHVkZS9saW51eC9za2J1ZmYuaAppbmRleCAzMzNiY2RjMzk2MzUuLmM4NThhZGZiNWE4 MiAxMDA2NDQKLS0tIGEvaW5jbHVkZS9saW51eC9za2J1ZmYuaAorKysgYi9pbmNsdWRlL2xpbnV4 L3NrYnVmZi5oCkBAIC0zNjYsNyArMzY2LDcgQEAgc3RhdGljIGlubGluZSB2b2lkIHNrYl9mcmFn X3NpemVfc3ViKHNrYl9mcmFnX3QgKmZyYWcsIGludCBkZWx0YSkKIHN0YXRpYyBpbmxpbmUgYm9v bCBza2JfZnJhZ19tdXN0X2xvb3Aoc3RydWN0IHBhZ2UgKnApCiB7CiAjaWYgZGVmaW5lZChDT05G SUdfSElHSE1FTSkKLQlpZiAoUGFnZUhpZ2hNZW0ocCkpCisJaWYgKElTX0VOQUJMRUQoQ09ORklH X0RFQlVHX0tNQVBfTE9DQUxfRk9SQ0VfTUFQKSB8fCBQYWdlSGlnaE1lbShwKSkKIAkJcmV0dXJu IHRydWU7CiAjZW5kaWYKIAlyZXR1cm4gZmFsc2U7Cg== --0000000000001d1c6605b8450450--