Received: by 10.192.165.148 with SMTP id m20csp4036031imm; Mon, 30 Apr 2018 10:32:07 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqtyBMEFyKJajy0pt5Nno+1fOwgQxId6Kk8C9yfDw9LgZLtK7QfUTuvxHvOOlfKtn0GIWVN X-Received: by 2002:a17:902:2927:: with SMTP id g36-v6mr13127141plb.303.1525109527169; Mon, 30 Apr 2018 10:32:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1525109527; cv=none; d=google.com; s=arc-20160816; b=p+4wLcm816hfMPny0dtkhK2wZCK5viSSBQ1U5c+Wm7hwwZMNVG6zXsmGYUhz5BYjsj GXHsSHOpPcjuxXRG6jRfyR54NS0uNmPG09KGJ48BIWzf5YFIgqw2bp05REAYuMaXVBuh ZYeClJ9KJHDBxWwPCIQbS/HtAo++yzduyEQslG31usDlgNNFKEupFGtU6xOeMET+LWul tlBcbU5+TR3yLifxSfZ5/bmmVdFyZmRv1cZKxXm0kCiRBuUSb+I2e8C1yPINiN5Q8/Sj 1LSU62zIarwMFm9O7yKPS7UujeNAy5haaAVfptS03SzT/DSjlnR8O/eyWXU780f1eTC9 QLNA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:content-transfer-encoding :content-id:spamdiagnosticmetadata:spamdiagnosticoutput :content-language:accept-language:in-reply-to:references:message-id :date:thread-index:thread-topic:subject:cc:to:from:dkim-signature :arc-authentication-results; bh=tF/qqbW0epQzBrzkOtNASBJJSMh5zaoHtaL5kHy+Kx8=; b=q6M5lEMrRMHbmtzzXxey5FO8zY5nG4+bWE1ZMQjMR4qCv6i71M7uKPOUpdwogvVQgj 0+vnTU+ccXuVMVTxGdYFoQn9Wsta3gDMHXDNB4gyZFdXhZ7DIL8e9VxzcBWttYFrX51R jUbUNQv62tuPy+7ej4oCBk1saZ1+1nD+o+uyyRxIdL+QnFC3ziZsa8aDqJmDgCaTtpWR op8emgPt//0f3kJab9rM0CH1ZdzWD2VQ6wmX9D84G0VavWrgstJePc54TTG6aW87lE6B jv5ie4KaR/W/FJb/JO14Ul7tpHEL5BUG5FwD6zJ5jze4/3PRw6oa81DDACYXIOGcvyiJ 2N/g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@onevmw.onmicrosoft.com header.s=selector1-vmware-com header.b=bcByF1JV; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id h14-v6si7960579plk.535.2018.04.30.10.31.52; Mon, 30 Apr 2018 10:32:07 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@onevmw.onmicrosoft.com header.s=selector1-vmware-com header.b=bcByF1JV; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754032AbeD3Raq (ORCPT + 99 others); Mon, 30 Apr 2018 13:30:46 -0400 Received: from mail-by2nam03on0059.outbound.protection.outlook.com ([104.47.42.59]:19248 "EHLO NAM03-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753731AbeD3Ran (ORCPT ); Mon, 30 Apr 2018 13:30:43 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=onevmw.onmicrosoft.com; s=selector1-vmware-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=tF/qqbW0epQzBrzkOtNASBJJSMh5zaoHtaL5kHy+Kx8=; b=bcByF1JVvyjCOPCYA02Evs8NHqmv3+uYKxQJXihHkmnBY4RUxkTG/+UGE4T898gRhi5TG6eFMuQUWLUbjcdVUB6B/feZDpp1gAj01n0yQXauV2EwTRwmCGbtiv0Q+HSWV01OlcIqaRWpGQenEzYaL68ab5VlyTtQTt6oYXmjsBY= Received: from SN2PR05MB2654.namprd05.prod.outlook.com (10.166.212.137) by SN2PR05MB2734.namprd05.prod.outlook.com (10.167.19.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.735.5; Mon, 30 Apr 2018 17:30:41 +0000 Received: from SN2PR05MB2654.namprd05.prod.outlook.com ([fe80::4924:30ca:59af:89db]) by SN2PR05MB2654.namprd05.prod.outlook.com ([fe80::4924:30ca:59af:89db%4]) with mapi id 15.20.0735.006; Mon, 30 Apr 2018 17:30:41 +0000 From: Nadav Amit To: Arnd Bergmann , Greg Kroah-Hartman CC: Xavier Deguillard , pv-drivers , LKML , Gil Kupfer , Oleksandr Natalenko , "ldu@redhat.com" , "stable@vger.kernel.org" Subject: Re: [PATCH v3] vmw_balloon: fixing double free when batching mode is off Thread-Topic: [PATCH v3] vmw_balloon: fixing double free when batching mode is off Thread-Index: AQHT2Argu2pZ34klIkGamyuxGjdz+KQZodaA Date: Mon, 30 Apr 2018 17:30:41 +0000 Message-ID: <162DEB66-373B-4E01-8D64-3CE7BEF47920@vmware.com> References: <20180419063856.GA7643@kroah.com> <20180419181722.12273-1-namit@vmware.com> In-Reply-To: <20180419181722.12273-1-namit@vmware.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [208.91.2.2] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1;SN2PR05MB2734;7:nMqxcnTXjf10n3Ru++gC6HmNLjyhyUBCEKTtWge07kgJau7xowuJn0t3SaVEYl2rsFehACyrAJ/iTfgJVTX2qnfsJK0NDnpz2mZLoot584avrBUFVfTrvufJiqHFJFg6c3XaMALhN5HWm3TMsoetmqP/aVGeRH9lh9+qgmkHYkOz/gcjxsfTNJ8/8Iooin9I1WSVeJ1//4iqejBftVqTpKTouVB3YJvgJQS9+p0jthBn+eZcJCdaFEChkjbe0bje;20:LqtNrRfuXSqSHDBFftKnHEm+9w7Mv+gtFcXD3bKSGOnDp2oNqadAf/YxqzbZ7dCHXc5/LNvafuNOBPHevWCu9D7N3HyBrFpz+fEEoxKrYXILWAlujUPyqeX5fLx9eAxaYBUY8gUk/PWv29m00GwqeuHtPgD2ebyv1iBqCNq4BO8= x-ms-exchange-antispam-srfa-diagnostics: SOS; x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(4652020)(4534165)(4627221)(201703031133081)(201702281549075)(5600026)(2017052603328)(7153060)(7193020);SRVR:SN2PR05MB2734; x-ms-traffictypediagnostic: SN2PR05MB2734: x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(61668805478150)(9452136761055)(85827821059158); x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(3231254)(944501410)(52105095)(10201501046)(3002001)(93006095)(93001095)(6041310)(20161123558120)(20161123564045)(20161123562045)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011);SRVR:SN2PR05MB2734;BCL:0;PCL:0;RULEID:;SRVR:SN2PR05MB2734; x-forefront-prvs: 0658BAF71F x-forefront-antispam-report: SFV:NSPM;SFS:(10009020)(346002)(366004)(39860400002)(376002)(396003)(39380400002)(199004)(189003)(4326008)(86362001)(575784001)(68736007)(39060400002)(3280700002)(2906002)(97736004)(486006)(6512007)(478600001)(25786009)(305945005)(3660700001)(6436002)(2616005)(476003)(11346002)(446003)(83716003)(45080400002)(5250100002)(3846002)(36756003)(14454004)(6486002)(6116002)(229853002)(54906003)(110136005)(106356001)(26005)(105586002)(59450400001)(99286004)(66066001)(316002)(2900100001)(6346003)(82746002)(81166006)(81156014)(8676002)(8936002)(102836004)(5660300001)(53936002)(7736002)(6246003)(76176011)(186003)(33656002)(6506007);DIR:OUT;SFP:1101;SCL:1;SRVR:SN2PR05MB2734;H:SN2PR05MB2654.namprd05.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1; received-spf: None (protection.outlook.com: vmware.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=namit@vmware.com; x-microsoft-antispam-message-info: r8kZ5VfVQjNRArjTQpahRRJUqR97HRjfS8aPupZgDIgQVG1UOCT/2ITILzg9hs4HegBG100UUT8WGfHl1gRdPXVMrc212sLM9KR8CB/Tr34HJo+870qh5GqG5fes0obMwBAkBjoJzQsAFSFGCmCIZW1DWUnwErgLybwmt7xIlXzIkgeWvjSE1BuiDsE3akvM spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: e776ffa2-693a-4467-0720-08d5aec018bf X-OriginatorOrg: vmware.com X-MS-Exchange-CrossTenant-Network-Message-Id: e776ffa2-693a-4467-0720-08d5aec018bf X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Apr 2018 17:30:41.3528 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: b39138ca-3cee-4b4a-a4d6-cd83d9dd62f0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN2PR05MB2734 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Ping. Please consider it for inclusion for rc4. Nadav Amit wrote: > From: Gil Kupfer >=20 > The balloon.page field is used for two different purposes if batching is > on or off. If batching is on, the field point to the page which is used > to communicate with with the hypervisor. If it is off, balloon.page > points to the page that is about to be (un)locked. >=20 > Unfortunately, this dual-purpose of the field introduced a bug: when the > balloon is popped (e.g., when the machine is reset or the balloon driver > is explicitly removed), the balloon driver frees, unconditionally, the > page that is held in balloon.page. As a result, if batching is > disabled, this leads to double freeing the last page that is sent to the > hypervisor. >=20 > The following error occurs during rmmod when kernel checkers are on, and > the balloon is not empty: >=20 > [ 42.307653] ------------[ cut here ]------------ > [ 42.307657] Kernel BUG at ffffffffba1e4b28 [verbose debug info unavail= able] > [ 42.307720] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC > [ 42.312512] Modules linked in: vmw_vsock_vmci_transport vsock ppdev jo= ydev vmw_balloon(-) input_leds serio_raw vmw_vmci parport_pc shpchp parport= i2c_piix4 nfit mac_hid autofs4 vmwgfx drm_kms_helper hid_generic syscopyar= ea sysfillrect usbhid sysimgblt fb_sys_fops hid ttm mptspi scsi_transport_s= pi ahci mptscsih drm psmouse vmxnet3 libahci mptbase pata_acpi > [ 42.312766] CPU: 10 PID: 1527 Comm: rmmod Not tainted 4.12.0+ #5 > [ 42.312803] Hardware name: VMware, Inc. VMware Virtual Platform/440BX = Desktop Reference Platform, BIOS 6.00 09/30/2016 > [ 42.313042] task: ffff9bf9680f8000 task.stack: ffffbfefc1638000 > [ 42.313290] RIP: 0010:__free_pages+0x38/0x40 > [ 42.313510] RSP: 0018:ffffbfefc163be98 EFLAGS: 00010246 > [ 42.313731] RAX: 000000000000003e RBX: ffffffffc02b9720 RCX: 000000000= 0000006 > [ 42.313972] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9bf97= e08e0a0 > [ 42.314201] RBP: ffffbfefc163be98 R08: 0000000000000000 R09: 000000000= 0000000 > [ 42.314435] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffc= 02b97e4 > [ 42.314505] R13: ffffffffc02b9748 R14: ffffffffc02b9728 R15: 000000000= 0000200 > [ 42.314550] FS: 00007f3af5fec700(0000) GS:ffff9bf97e080000(0000) knlG= S:0000000000000000 > [ 42.314599] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 42.314635] CR2: 00007f44f6f4ab24 CR3: 00000003a7d12000 CR4: 000000000= 00006e0 > [ 42.314864] Call Trace: > [ 42.315774] vmballoon_pop+0x102/0x130 [vmw_balloon] > [ 42.315816] vmballoon_exit+0x42/0xd64 [vmw_balloon] > [ 42.315853] SyS_delete_module+0x1e2/0x250 > [ 42.315891] entry_SYSCALL_64_fastpath+0x23/0xc2 > [ 42.315924] RIP: 0033:0x7f3af5b0e8e7 > [ 42.315949] RSP: 002b:00007fffe6ce0148 EFLAGS: 00000206 ORIG_RAX: 0000= 0000000000b0 > [ 42.315996] RAX: ffffffffffffffda RBX: 000055be676401e0 RCX: 00007f3af= 5b0e8e7 > [ 42.316951] RDX: 000000000000000a RSI: 0000000000000800 RDI: 000055be6= 7640248 > [ 42.317887] RBP: 0000000000000003 R08: 0000000000000000 R09: 199999999= 9999999 > [ 42.318845] R10: 0000000000000883 R11: 0000000000000206 R12: 00007fffe= 6cdf130 > [ 42.319755] R13: 0000000000000000 R14: 0000000000000000 R15: 000055be6= 76401e0 > [ 42.320606] Code: c0 74 1c f0 ff 4f 1c 74 02 5d c3 85 f6 74 07 e8 0f d= 8 ff ff 5d c3 31 f6 e8 c6 fb ff ff 5d c3 48 c7 c6 c8 0f c5 ba e8 58 be 02 0= 0 <0f> 0b 66 0f 1f 44 00 00 66 66 66 66 90 48 85 ff 75 01 c3 55 48 > [ 42.323462] RIP: __free_pages+0x38/0x40 RSP: ffffbfefc163be98 > [ 42.325735] ---[ end trace 872e008e33f81508 ]--- >=20 > To solve the bug, we eliminate the dual purpose of balloon.page. >=20 > Fixes: f220a80f0c2e ("VMware balloon: add batching to the vmw_balloon.") > Cc: stable@vger.kernel.org > Reported-by: Oleksandr Natalenko > Signed-off-by: Gil Kupfer > Signed-off-by: Nadav Amit > Reviewed-by: Xavier Deguillard > --- > drivers/misc/vmw_balloon.c | 23 +++++++---------------- > 1 file changed, 7 insertions(+), 16 deletions(-) >=20 > diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c > index 9047c0a529b2..efd733472a35 100644 > --- a/drivers/misc/vmw_balloon.c > +++ b/drivers/misc/vmw_balloon.c > @@ -576,15 +576,9 @@ static void vmballoon_pop(struct vmballoon *b) > } > } >=20 > - if (b->batch_page) { > - vunmap(b->batch_page); > - b->batch_page =3D NULL; > - } > - > - if (b->page) { > - __free_page(b->page); > - b->page =3D NULL; > - } > + /* Clearing the batch_page unconditionally has no adverse effect */ > + free_page((unsigned long)b->batch_page); > + b->batch_page =3D NULL; > } >=20 > /* > @@ -991,16 +985,13 @@ static const struct vmballoon_ops vmballoon_batched= _ops =3D { >=20 > static bool vmballoon_init_batching(struct vmballoon *b) > { > - b->page =3D alloc_page(VMW_PAGE_ALLOC_NOSLEEP); > - if (!b->page) > - return false; > + struct page *page; >=20 > - b->batch_page =3D vmap(&b->page, 1, VM_MAP, PAGE_KERNEL); > - if (!b->batch_page) { > - __free_page(b->page); > + page =3D alloc_page(GFP_KERNEL | __GFP_ZERO); > + if (!page) > return false; > - } >=20 > + b->batch_page =3D page_address(page); > return true; > } >=20 > --=20 > 2.14.1