Changelog:
v2: - Addressed simplification comments from Wei Xu
- Added Review-by/Tested-by's from Zi Yan and Wei Xu
Two fixes:
mm/debug_vm_pgtable: remove pte entry from the page table
- remove a pte entry from the page table at the end of debug_vm_pgtable pte test
mm/page_table_check: check entries at pud and pmd levels
- check pmd and pud levels in page_table_check for regular entries not only for
huge pages when entries are replaced or cleared.
repro.c: https://gist.github.com/soleen/fdcd501d5df103976245fe84e9535087
config: https://gist.github.com/soleen/8a56f923c2fea9ce9c75b4e2517d4162
qemu_script: https://gist.github.com/soleen/f4be4795826b7ab1a51ae659582e179c
base image:
https://storage.googleapis.com/syzkaller/wheezy.img
https://storage.googleapis.com/syzkaller/wheezy.img.key
Small cleanup:
mm/page_table_check: use unsigned long for page counters
Previous versions:
v1: https://lore.kernel.org/all/[email protected]
Pasha Tatashin (3):
mm/debug_vm_pgtable: remove pte entry from the page table
mm/page_table_check: check entries at pud and pmd levels
mm/page_table_check: use unsigned long for page counters
mm/debug_vm_pgtable.c | 2 ++
mm/page_table_check.c | 68 +++++++++++++++++++++++++------------------
2 files changed, 42 insertions(+), 28 deletions(-)
--
2.34.1.703.g22d0c6ccf7-goog
The pte entry that is used in pte_advanced_tests() is never removed from
the page table at the end of the test.
The issue is detected by page_table_check, to repro compile kernel with
the following configs:
CONFIG_DEBUG_VM_PGTABLE=y
CONFIG_PAGE_TABLE_CHECK=y
CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
During the boot the following BUG is printed:
[ 7.483050][ T1] debug_vm_pgtable: [debug_vm_pgtable ]:
Validating architecture page tabs
[ 7.490930][ T1] ------------[ cut here ]------------
[ 7.494926][ T1] kernel BUG at mm/page_table_check.c:194!
[ 7.499172][ T1] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[ 7.503610][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.16.0+
[ 7.508600][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX,
...
The entry should be properly removed from the page table before the page
is released to the free list.
Fixes: a5c3b9ffb0f4 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers")
Signed-off-by: Pasha Tatashin <[email protected]>
Reviewed-by: Zi Yan <[email protected]>
Tested-by: Zi Yan <[email protected]>
---
mm/debug_vm_pgtable.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/mm/debug_vm_pgtable.c b/mm/debug_vm_pgtable.c
index a7ac97c76762..db2abd9e415b 100644
--- a/mm/debug_vm_pgtable.c
+++ b/mm/debug_vm_pgtable.c
@@ -171,6 +171,8 @@ static void __init pte_advanced_tests(struct pgtable_debug_args *args)
ptep_test_and_clear_young(args->vma, args->vaddr, args->ptep);
pte = ptep_get(args->ptep);
WARN_ON(pte_young(pte));
+
+ ptep_get_and_clear_full(args->mm, args->vaddr, args->ptep, 1);
}
static void __init pte_savedwrite_tests(struct pgtable_debug_args *args)
--
2.34.1.703.g22d0c6ccf7-goog
For the consistency, use "unsigned long" for all page counters.
Signed-off-by: Pasha Tatashin <[email protected]>
Reviewed-by: Wei Xu <[email protected]>
---
mm/page_table_check.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/mm/page_table_check.c b/mm/page_table_check.c
index 877d967742bc..f1db4de8bed2 100644
--- a/mm/page_table_check.c
+++ b/mm/page_table_check.c
@@ -86,8 +86,8 @@ static void page_table_check_clear(struct mm_struct *mm, unsigned long addr,
{
struct page_ext *page_ext;
struct page *page;
+ unsigned long i;
bool anon;
- int i;
if (!pfn_valid(pfn))
return;
@@ -121,8 +121,8 @@ static void page_table_check_set(struct mm_struct *mm, unsigned long addr,
{
struct page_ext *page_ext;
struct page *page;
+ unsigned long i;
bool anon;
- int i;
if (!pfn_valid(pfn))
return;
@@ -176,10 +176,10 @@ static void pmd_clear_level(struct mm_struct *mm, unsigned long addr,
void __page_table_check_zero(struct page *page, unsigned int order)
{
struct page_ext *page_ext = lookup_page_ext(page);
- int i;
+ unsigned long i;
BUG_ON(!page_ext);
- for (i = 0; i < (1 << order); i++) {
+ for (i = 0; i < (1ul << order); i++) {
struct page_table_check *ptc = get_page_table_check(page_ext);
BUG_ON(atomic_read(&ptc->anon_map_count));
--
2.34.1.703.g22d0c6ccf7-goog
On 1/21/22 12:42 AM, Pasha Tatashin wrote:
> The pte entry that is used in pte_advanced_tests() is never removed from
> the page table at the end of the test.
>
> The issue is detected by page_table_check, to repro compile kernel with
> the following configs:
>
> CONFIG_DEBUG_VM_PGTABLE=y
> CONFIG_PAGE_TABLE_CHECK=y
> CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
Assuming this is on latest mainline.
I could enable PAGE_TABLE_CHECK on arm64 after some hacks. It did not build
on the platform otherwise. But enabling DEBUG_VM_PGTABLE afterwards did not
create below mentioned problems. Is the problem x86 specific ?
>
> During the boot the following BUG is printed:
>
> [ 7.483050][ T1] debug_vm_pgtable: [debug_vm_pgtable ]:
> Validating architecture page tabs
> [ 7.490930][ T1] ------------[ cut here ]------------
> [ 7.494926][ T1] kernel BUG at mm/page_table_check.c:194!
Which BUG() is this ? mm/page_table_check.c:194 on latest mainline ..
void __page_table_check_pud_clear(struct mm_struct *mm, unsigned long addr,
pud_t pud) <----
> [ 7.499172][ T1] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
> [ 7.503610][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.16.0+
> [ 7.508600][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX,
> ...
>
> The entry should be properly removed from the page table before the page
> is released to the free list.
>
> Fixes: a5c3b9ffb0f4 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers")
I am not sure whether this really fixes an existing problem.
>
> Signed-off-by: Pasha Tatashin <[email protected]>
> Reviewed-by: Zi Yan <[email protected]>
> Tested-by: Zi Yan <[email protected]>
> ---
> mm/debug_vm_pgtable.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/mm/debug_vm_pgtable.c b/mm/debug_vm_pgtable.c
> index a7ac97c76762..db2abd9e415b 100644
> --- a/mm/debug_vm_pgtable.c
> +++ b/mm/debug_vm_pgtable.c
> @@ -171,6 +171,8 @@ static void __init pte_advanced_tests(struct pgtable_debug_args *args)
> ptep_test_and_clear_young(args->vma, args->vaddr, args->ptep);
> pte = ptep_get(args->ptep);
> WARN_ON(pte_young(pte));
> +
> + ptep_get_and_clear_full(args->mm, args->vaddr, args->ptep, 1);
> }
Although I dont see any problem on arm64 after this change.
>
> static void __init pte_savedwrite_tests(struct pgtable_debug_args *args)
>
Hi Anshuman,
Thanks for looking into this. See my replies below.
> > CONFIG_DEBUG_VM_PGTABLE=y
> > CONFIG_PAGE_TABLE_CHECK=y
> > CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
>
> Assuming this is on latest mainline.
>
> I could enable PAGE_TABLE_CHECK on arm64 after some hacks. It did not build
> on the platform otherwise. But enabling DEBUG_VM_PGTABLE afterwards did not
> create below mentioned problems. Is the problem x86 specific ?
This is not x86 specific problem, but page_table_check does not have
support for other arches yet. The arm64 support is on my todo list.
The patch for arm64 would look something like this:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d283d422c6c4f0264fe8ecf5ae80036bf73f4594
>
> >
> > During the boot the following BUG is printed:
> >
> > [ 7.483050][ T1] debug_vm_pgtable: [debug_vm_pgtable ]:
> > Validating architecture page tabs
> > [ 7.490930][ T1] ------------[ cut here ]------------
> > [ 7.494926][ T1] kernel BUG at mm/page_table_check.c:194!
>
> Which BUG() is this ? mm/page_table_check.c:194 on latest mainline ..
>
> void __page_table_check_pud_clear(struct mm_struct *mm, unsigned long addr,
> pud_t pud) <----
It turns out I pasted the backtrace from the modified kernel. Here the
snippet of backtrace from the mainline:
[ 2.276826] ------------[ cut here ]------------
[ 2.280426] kernel BUG at mm/page_table_check.c:162!
[ 2.284118] invalid opcode: 0000 [#1] PREEMPT SMP PTI
...
Which corresponds to:
152 void __page_table_check_zero(struct page *page, unsigned int order)
153 {
154 struct page_ext *page_ext = lookup_page_ext(page);
155 int i;
156
157 BUG_ON(!page_ext);
158 for (i = 0; i < (1 << order); i++) {
159 struct page_table_check *ptc =
get_page_table_check(page_ext);
160
161 BUG_ON(atomic_read(&ptc->anon_map_count));
162 BUG_ON(atomic_read(&ptc->file_map_count));
I will update the bug log with the mainline backtrace.
>
> > [ 7.499172][ T1] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
> > [ 7.503610][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.16.0+
> > [ 7.508600][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX,
> > ...
> >
> > The entry should be properly removed from the page table before the page
> > is released to the free list.
> >
> > Fixes: a5c3b9ffb0f4 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers")
> I am not sure whether this really fixes an existing problem.
What is detected is that a page that potentially has a PTE entry in a
user page table was put on a free list. It is not an issue for this
test, but would be an issue if it happened elsewhere.
>
> >
> > Signed-off-by: Pasha Tatashin <[email protected]>
> > Reviewed-by: Zi Yan <[email protected]>
> > Tested-by: Zi Yan <[email protected]>
> > ---
> > mm/debug_vm_pgtable.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/mm/debug_vm_pgtable.c b/mm/debug_vm_pgtable.c
> > index a7ac97c76762..db2abd9e415b 100644
> > --- a/mm/debug_vm_pgtable.c
> > +++ b/mm/debug_vm_pgtable.c
> > @@ -171,6 +171,8 @@ static void __init pte_advanced_tests(struct pgtable_debug_args *args)
> > ptep_test_and_clear_young(args->vma, args->vaddr, args->ptep);
> > pte = ptep_get(args->ptep);
> > WARN_ON(pte_young(pte));
> > +
> > + ptep_get_and_clear_full(args->mm, args->vaddr, args->ptep, 1);
> > }
>
> Although I dont see any problem on arm64 after this change.
This is because page_table_check does not have support for anything
beside x86 at the moment.
>
> >
> > static void __init pte_savedwrite_tests(struct pgtable_debug_args *args)
> >
Pasha