Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755099AbcJPArJ (ORCPT ); Sat, 15 Oct 2016 20:47:09 -0400 Received: from hydra.tuxags.com ([64.13.172.54]:48126 "EHLO mail.tuxags.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752729AbcJPArH (ORCPT ); Sat, 15 Oct 2016 20:47:07 -0400 X-Greylist: delayed 900 seconds by postgrey-1.27 at vger.kernel.org; Sat, 15 Oct 2016 20:47:07 EDT Date: Sat, 15 Oct 2016 17:21:51 -0700 From: Matt Mullins To: linux-kernel@vger.kernel.org Cc: Andy Lutomirski , linux-crypto@vger.kernel.org, Matt Mackall , Herbert Xu , Rusty Russell , Jens Axboe , Dave Gordon Subject: virtio-rng scatterlist null pointer dereference with VMAP_STACK=y Message-ID: <20161016002151.GA18235@hydra.tuxags.com> Mail-Followup-To: linux-kernel@vger.kernel.org, Andy Lutomirski , linux-crypto@vger.kernel.org, Matt Mackall , Herbert Xu , Rusty Russell , Jens Axboe , Dave Gordon MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3055 Lines: 60 With VMAP_STACK=y and HW_RANDOM_VIRTIO=y, I get the following crash: [ 1.470437] BUG: unable to handle kernel NULL pointer dereference at (null) [ 1.473350] IP: [] sg_init_one+0x65/0x90 [ 1.474658] PGD 0 [ 1.475169] Oops: 0000 [#1] SMP Entering kdb (current=0xffff880069b0c980, pid 1) on processor 1 Oops: (null) due to oops @ 0xffffffff812f7c35 CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.8.0-08682-g41844e3 #246 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880069b0c980 task.stack: ffffc90000c54000 RIP: 0010:[] [] sg_init_one+0x65/0x90 RSP: 0000:ffffc90000c57d00 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffc90000c57d20 RCX: 0000000000082000 RDX: 0000000000000d68 RSI: 0000000410000c57 RDI: ffffc90000c57d40 RBP: 0000000000000820 R08: 0000000000000000 R09: ffffc90000c57d20 R10: 0000000000019228 R11: ffff88017fff8500 R12: 0000000000000010 R13: 0000000000000010 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88017fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000001806000 CR4: 00000000001406a0 Stack: ffff8800694bf500 0000000000000001 ffffc90000c57d68 ffffffff8138286f 0000000000000002 0000000000000000 0000000000000000 0000000000000000 ffff8800694bf500 ffffc90000c57d68 ffff8800694bf500 0000000000000000 Call Trace: [] ? virtio_read+0x9f/0xe0 [] ? add_early_randomness+0x3e/0xa0 [] ? set_current_rng+0x3f/0x160 [] ? hwrng_register+0x186/0x1d0 [] ? virtrng_scan+0x10/0x20 [] ? virtio_dev_probe+0x21e/0x2b0 [] ? really_probe+0x14e/0x250 [] ? __driver_attach+0x82/0xa0 [] ? really_probe+0x250/0x250 [] ? bus_for_each_dev+0x52/0x80 [] ? bus_add_driver+0x1a3/0x220 [] ? hwrng_modinit+0xc/0xc [] ? driver_register+0x56/0xd0 [] ? hwrng_modinit+0xc/0xc [] ? do_one_initcall+0x32/0x150 [] ? parse_args+0x170/0x390 [] ? kernel_init_freeable+0x11e/0x1a3 [] ? set_debug_rodata+0xc/0xc [] ? rest_init+0x70/0x70 [] ? kernel_init+0x5/0x100 [] ? ret_from_fork+0x25/0x30 Code: 01 c5 48 89 ee 48 89 e9 48 c1 ed 23 48 8b 04 ed c0 49 9c 81 48 c1 ee 0c 48 c1 e9 1b 48 85 c0 74 0a 0f b6 c9 48 c1 e1 04 48 01 c8 <48> 8b 08 48 89 f0 89 53 08 48 c1 e0 06 44 89 63 0c 48 83 e1 fc It looks like add_early_randomness() uses a buffer on the stack, which (with VMAP_STACK) fails to be added to a scatterlist due to use of virt_to_page in sg_set_buf(). None of this looks obviously wrong to me, but in combination it is not functional. Hence, I don't have a particular fix in mind, and I've CC'ed folks from both the hw_random and scatterlist history.