From: Kan Liang <[email protected]>
Kernel panic when calling the IRQ-safe __get_user_pages_fast in NMI
handler.
The bug was introduced by commit:
2947ba054a4d ("x86/mm/gup: Switch GUP to the generic
get_user_page_fast() implementation")
The original x86 __get_user_page_fast used plain get_page() or
page_ref_add(). However, the generic __get_user_page_fast uses
page_cache_get_speculative(), which has VM_BUG_ON(in_interrupt()).
There is no reason to prevent page_cache_get_speculative from using in
interrupt context. According to the author, putting a BUG_ON there is
just because the code is not verifying correctness of interrupt races.
I did some tests in interrupt context. There is no issue found.
Removing VM_BUG_ON(in_interrupt()) for page_cache_get_speculative().
Signed-off-by: Kan Liang <[email protected]>
---
include/linux/pagemap.h | 2 --
1 file changed, 2 deletions(-)
diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index baa9344..79b36f5 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -163,8 +163,6 @@ void release_pages(struct page **pages, int nr, bool cold);
*/
static inline int page_cache_get_speculative(struct page *page)
{
- VM_BUG_ON(in_interrupt());
-
#ifdef CONFIG_TINY_RCU
# ifdef CONFIG_PREEMPT_COUNT
VM_BUG_ON(!in_atomic() && !irqs_disabled());
--
2.4.3
On Tue, 1 Aug 2017 13:39:06 -0400 [email protected] wrote:
> Kernel panic when calling the IRQ-safe __get_user_pages_fast in NMI
> handler.
>
> The bug was introduced by commit:
>
> 2947ba054a4d ("x86/mm/gup: Switch GUP to the generic
> get_user_page_fast() implementation")
>
> The original x86 __get_user_page_fast used plain get_page() or
> page_ref_add(). However, the generic __get_user_page_fast uses
> page_cache_get_speculative(), which has VM_BUG_ON(in_interrupt()).
>
> There is no reason to prevent page_cache_get_speculative from using in
> interrupt context. According to the author, putting a BUG_ON there is
> just because the code is not verifying correctness of interrupt races.
> I did some tests in interrupt context. There is no issue found.
> Removing VM_BUG_ON(in_interrupt()) for page_cache_get_speculative().
What code calls page_cache_get_speculative() from NMI context?
I'm trying to work out which kernel versions need this fix, but there
isn't enough info in the changelog for this. Please don't do that.
>
> On Tue, 1 Aug 2017 13:39:06 -0400 [email protected] wrote:
>
> > Kernel panic when calling the IRQ-safe __get_user_pages_fast in NMI
> > handler.
> >
> > The bug was introduced by commit:
> >
> > 2947ba054a4d ("x86/mm/gup: Switch GUP to the generic
> > get_user_page_fast() implementation")
> >
> > The original x86 __get_user_page_fast used plain get_page() or
> > page_ref_add(). However, the generic __get_user_page_fast uses
> > page_cache_get_speculative(), which has VM_BUG_ON(in_interrupt()).
> >
> > There is no reason to prevent page_cache_get_speculative from using in
> > interrupt context. According to the author, putting a BUG_ON there is
> > just because the code is not verifying correctness of interrupt races.
> > I did some tests in interrupt context. There is no issue found.
> > Removing VM_BUG_ON(in_interrupt()) for page_cache_get_speculative().
>
> What code calls page_cache_get_speculative() from NMI context?
>
The code I'm implementing will call __get_user_page_fast from NMI context.
__get_user_page_fast will eventually call page_cache_get_speculative().
> I'm trying to work out which kernel versions need this fix, but there isn't
> enough info in the changelog for this. Please don't do that.
Sorry for the confusion.
According to the comments, __get_user_page_fast should be IRQ-safe. But it's not.
This patch could be used to resolve the inconsistencies between the comments
and implementations for now.
The generic __get_user_page_fast was introduced by the commit
2667f50e8b81457fcb4a3dbe6aff3e81ea009e13
mm: introduce a general RCU get_user_pages_fast()
I think the kernel after the commit should be fixed.
Thanks,
Kan
On Tue, Aug 01, 2017 at 08:31:14PM +0000, Liang, Kan wrote:
> >
> > On Tue, 1 Aug 2017 13:39:06 -0400 [email protected] wrote:
> >
> > > Kernel panic when calling the IRQ-safe __get_user_pages_fast in NMI
> > > handler.
> > >
> > > The bug was introduced by commit:
> > >
> > > 2947ba054a4d ("x86/mm/gup: Switch GUP to the generic
> > > get_user_page_fast() implementation")
> > >
> > > The original x86 __get_user_page_fast used plain get_page() or
> > > page_ref_add(). However, the generic __get_user_page_fast uses
> > > page_cache_get_speculative(), which has VM_BUG_ON(in_interrupt()).
> > >
> > > There is no reason to prevent page_cache_get_speculative from using in
> > > interrupt context. According to the author, putting a BUG_ON there is
> > > just because the code is not verifying correctness of interrupt races.
> > > I did some tests in interrupt context. There is no issue found.
> > > Removing VM_BUG_ON(in_interrupt()) for page_cache_get_speculative().
> >
> > What code calls page_cache_get_speculative() from NMI context?
> >
>
> The code I'm implementing will call __get_user_page_fast from NMI context.
> __get_user_page_fast will eventually call page_cache_get_speculative().
>
> > I'm trying to work out which kernel versions need this fix, but there isn't
> > enough info in the changelog for this. Please don't do that.
>
> Sorry for the confusion.
>
> According to the comments, __get_user_page_fast should be IRQ-safe. But it's not.
> This patch could be used to resolve the inconsistencies between the comments
> and implementations for now.
> The generic __get_user_page_fast was introduced by the commit
> 2667f50e8b81457fcb4a3dbe6aff3e81ea009e13
> mm: introduce a general RCU get_user_pages_fast()
> I think the kernel after the commit should be fixed.
I don't think so.
It's 2+ year in and nobody stepped onto this until you with your patchset.
There is no real reason to get it backported.
--
Kirill A. Shutemov