Re: [Bug 112301] New: [bisected] NULL pointer dereference when starting a kvm based VM

[Hugh Dickins <hughd@google.com>]

On Thu, 11 Feb 2016, Andrew Morton wrote:
> 
> (switched to email.  Please respond via emailed reply-to-all, not via the
> bugzilla web interface).
> 
> On Thu, 11 Feb 2016 07:09:04 +0000 bugzilla-daemon@bugzilla.kernel.org wrote:
> 
> > https://bugzilla.kernel.org/show_bug.cgi?id=112301
> > 
> >             Bug ID: 112301
> >            Summary: [bisected] NULL pointer dereference when starting a
> >                     kvm based VM
> >            Product: Memory Management
> >            Version: 2.5
> >     Kernel Version: 4.5-rcX
> >           Hardware: All
> >                 OS: Linux
> >               Tree: Mainline
> >             Status: NEW
> >           Severity: normal
> >           Priority: P1
> >          Component: Other
> >           Assignee: akpm@linux-foundation.org
> >           Reporter: harn-solo@gmx.de
> >         Regression: No
> > 
> > Created attachment 203451
> >   --> https://bugzilla.kernel.org/attachment.cgi?id=203451&action=edit
> > Call Trace of a NULL pointer dereference at gup_pte_range
> > 
> > Starting a qemu-kvm based VM configured to use hughpages I'm getting the
> > following NULL pointer dereference, see attached dmesg section.
> > 
> > The issue was introduced with commit 7d2eba0557c18f7522b98befed98799990dd4fdb
> > Author: Ebru Akagunduz <ebru.akagunduz@gmail.com>
> > Date:   Thu Jan 14 15:22:19 2016 -0800
> >     mm: add tracepoint for scanning pages
> 
> Thanks for the detailed report.  Can you please verify that your tree
> has 629d9d1cafbd49cb374 ("mm: avoid uninitialized variable in
> tracepoint")?
> 
> vfio_pin_pages() doesn't seem to be doing anything crazy.  Hugh, Ebru:
> could you please take a look?

I very much doubt that the uninitialized variable in collapse_huge_page()
had anything to do with the crash in gup_pte_range().  Far more likely
is that the bisection hit a point in between the introduction of that
uninitialized variable and its subsequent fix, the test crashed, and
the bisector didn't notice that it was crashing for a different reason.

Comparing the "Code:" of the gup_pte_range() crash with disassembly of
gup_pte_range() here, it looks as if it's crashing in pte_page().  And,
yes, that pte_page() looks broken in 4.5-rc: please try this patch.

[PATCH] mm, x86: fix pte_page() crash in gup_pte_range()

Commit 3565fce3a659 ("mm, x86: get_user_pages() for dax mappings")
has moved up the pte_page(pte) in x86's fast gup_pte_range(), for no
discernible reason: put it back where it belongs, after the pte_flags
check and the pfn_valid cross-check.

That may be the cause of the NULL pointer dereference in gup_pte_range(),
seen when vfio called vaddr_get_pfn() when starting a qemu-kvm based VM.

Reported-by: Michael Long <Harn-Solo@gmx.de>
Cc: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
---

 arch/x86/mm/gup.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- 4.5-rc3/arch/x86/mm/gup.c	2016-01-24 14:54:51.359500642 -0800
+++ linux/arch/x86/mm/gup.c	2016-02-12 12:15:36.460501324 -0800
@@ -102,7 +102,6 @@ static noinline int gup_pte_range(pmd_t
 			return 0;
 		}
 
-		page = pte_page(pte);
 		if (pte_devmap(pte)) {
 			pgmap = get_dev_pagemap(pte_pfn(pte), pgmap);
 			if (unlikely(!pgmap)) {
@@ -115,6 +114,7 @@ static noinline int gup_pte_range(pmd_t
 			return 0;
 		}
 		VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
+		page = pte_page(pte);
 		get_page(page);
 		put_dev_pagemap(pgmap);
 		SetPageReferenced(page);

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>