From: Adrian Huang <[email protected]>
When running the following command (cpu hotplug test case of LTP),
the "execute NX-protected page" exception is triggered.
# /opt/ltp/testcases/bin/cpuhotplug02.sh -c 1 -l 1
Here is the call trace:
process 14301 (cpuhotplug_do_s) no longer affine to cpu1
smpboot: CPU 1 is now offline
smpboot: Booting Node 0 Processor 1 APIC 0x2
LVT offset 0 assigned for vector 0x400
kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
BUG: unable to handle page fault for address: ffffffffbb559170
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0011) - permissions violation
PGD 1ae25067 P4D 1ae25067 PUD 1ae26063 PMD 134abd063 PTE 80000000
Oops: Oops: 0011 [#1] PREEMPT SMP NOPTI
CPU: 1 PID: 24 Comm: cpuhp/1 Kdump: loaded Not tainted 6.10.0-rc3
Hardware name: Lenovo ThinkSystem SR665 MB/7D2WRCZ000, BIOS D8E121K-2.20 08/12/2021
RIP: 0010:amd_iommu_enable_faulting+0x0/0x10
Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <cc> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
RSP: 0018:ffffb4e243fafe48 EFLAGS: 00010202
RAX: 00000000000003c0 RBX: ffff90f4baea0820 RCX: 0000000000000000
RDX: 00000000000000ec RSI: 00000000000000c0 RDI: 0000000000000001
RBP: 0000000000000001 R08: ffff90f4baea0848 R09: ffff90f184a90d00
R10: ffff90f184a90ce0 R11: ffff90f1834ebaf8 R12: 00000000000000c0
R13: ffffffffbb559170 R14: ffffffffbaa4bd00 R15: ffff90f4baea0848
FS: 0000000000000000(0000) GS:ffff90f4bae80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffbb559170 CR3: 000000001ae20000 CR4: 0000000000350ef0
Call Trace:
<TASK>
? __die+0x20/0x70
? __pfx_amd_iommu_enable_faulting+0x10/0x10
? page_fault_oops+0x75/0x170
? __pfx_amd_iommu_enable_faulting+0x10/0x10
? exc_page_fault+0xaa/0x140
? asm_exc_page_fault+0x22/0x30
? __pfx_amd_iommu_enable_faulting+0x10/0x10
? __pfx_amd_iommu_enable_faulting+0x10/0x10
? __pfx_amd_iommu_enable_faulting+0x10/0x10
cpuhp_invoke_callback+0x2cc/0x470
? __pfx_blk_mq_hctx_notify_online+0x10/0x10
? __pfx_smpboot_thread_fn+0x10/0x10
cpuhp_thread_fun+0x8b/0x140
smpboot_thread_fn+0xd9/0x1d0
kthread+0xcf/0x100
? __pfx_kthread+0x10/0x10
ret_from_fork+0x30/0x50
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
The address '0xffffffffbb559170' is the function address of
'amd_iommu_enable_faulting()'. However, this function is declared with
'__init' keyword and will be freed in free_initmem().
Fix the issue by removing '__init' keyword since this function is still
needed for the up-and-running kernel.
Fixes: d74169ceb0d2 ("iommu/vt-d: Allocate DMAR fault interrupts locally")
Signed-off-by: Adrian Huang <[email protected]>
---
drivers/iommu/amd/init.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index 27e293727095..161248067776 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -3362,7 +3362,7 @@ int amd_iommu_reenable(int mode)
return 0;
}
-int __init amd_iommu_enable_faulting(unsigned int cpu)
+int amd_iommu_enable_faulting(unsigned int cpu)
{
/* We enable MSI later when PCI is initialized */
return 0;
--
2.25.1
Hi Adrian,
On 6/11/2024 9:24 PM, Adrian Huang wrote:
> From: Adrian Huang <[email protected]>
>
> When running the following command (cpu hotplug test case of LTP),
> the "execute NX-protected page" exception is triggered.
Thanks for the detailed report and fix. This issue has been discussed and we
already have similar patch [1] from Dimitri.
[1] https://lore.kernel.org/linux-iommu/ZljHE%[email protected]/
-Vasant
>
> # /opt/ltp/testcases/bin/cpuhotplug02.sh -c 1 -l 1
>
> Here is the call trace:
>
> process 14301 (cpuhotplug_do_s) no longer affine to cpu1
> smpboot: CPU 1 is now offline
> smpboot: Booting Node 0 Processor 1 APIC 0x2
> LVT offset 0 assigned for vector 0x400
> kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
> BUG: unable to handle page fault for address: ffffffffbb559170
> #PF: supervisor instruction fetch in kernel mode
> #PF: error_code(0x0011) - permissions violation
> PGD 1ae25067 P4D 1ae25067 PUD 1ae26063 PMD 134abd063 PTE 80000000
> Oops: Oops: 0011 [#1] PREEMPT SMP NOPTI
> CPU: 1 PID: 24 Comm: cpuhp/1 Kdump: loaded Not tainted 6.10.0-rc3
> Hardware name: Lenovo ThinkSystem SR665 MB/7D2WRCZ000, BIOS D8E121K-2.20 08/12/2021
> RIP: 0010:amd_iommu_enable_faulting+0x0/0x10
> Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <cc> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
> RSP: 0018:ffffb4e243fafe48 EFLAGS: 00010202
> RAX: 00000000000003c0 RBX: ffff90f4baea0820 RCX: 0000000000000000
> RDX: 00000000000000ec RSI: 00000000000000c0 RDI: 0000000000000001
> RBP: 0000000000000001 R08: ffff90f4baea0848 R09: ffff90f184a90d00
> R10: ffff90f184a90ce0 R11: ffff90f1834ebaf8 R12: 00000000000000c0
> R13: ffffffffbb559170 R14: ffffffffbaa4bd00 R15: ffff90f4baea0848
> FS: 0000000000000000(0000) GS:ffff90f4bae80000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffffffffbb559170 CR3: 000000001ae20000 CR4: 0000000000350ef0
> Call Trace:
> <TASK>
> ? __die+0x20/0x70
> ? __pfx_amd_iommu_enable_faulting+0x10/0x10
> ? page_fault_oops+0x75/0x170
> ? __pfx_amd_iommu_enable_faulting+0x10/0x10
> ? exc_page_fault+0xaa/0x140
> ? asm_exc_page_fault+0x22/0x30
> ? __pfx_amd_iommu_enable_faulting+0x10/0x10
> ? __pfx_amd_iommu_enable_faulting+0x10/0x10
> ? __pfx_amd_iommu_enable_faulting+0x10/0x10
> cpuhp_invoke_callback+0x2cc/0x470
> ? __pfx_blk_mq_hctx_notify_online+0x10/0x10
> ? __pfx_smpboot_thread_fn+0x10/0x10
> cpuhp_thread_fun+0x8b/0x140
> smpboot_thread_fn+0xd9/0x1d0
> kthread+0xcf/0x100
> ? __pfx_kthread+0x10/0x10
> ret_from_fork+0x30/0x50
> ? __pfx_kthread+0x10/0x10
> ret_from_fork_asm+0x1a/0x30
> </TASK>
>
> The address '0xffffffffbb559170' is the function address of
> 'amd_iommu_enable_faulting()'. However, this function is declared with
> '__init' keyword and will be freed in free_initmem().
>
> Fix the issue by removing '__init' keyword since this function is still
> needed for the up-and-running kernel.
>
> Fixes: d74169ceb0d2 ("iommu/vt-d: Allocate DMAR fault interrupts locally")
> Signed-off-by: Adrian Huang <[email protected]>
> ---
> drivers/iommu/amd/init.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
> index 27e293727095..161248067776 100644
> --- a/drivers/iommu/amd/init.c
> +++ b/drivers/iommu/amd/init.c
> @@ -3362,7 +3362,7 @@ int amd_iommu_reenable(int mode)
> return 0;
> }
>
> -int __init amd_iommu_enable_faulting(unsigned int cpu)
> +int amd_iommu_enable_faulting(unsigned int cpu)
> {
> /* We enable MSI later when PCI is initialized */
> return 0;