Received: by 2002:a25:d7c1:0:0:0:0:0 with SMTP id o184csp2254477ybg; Sun, 27 Oct 2019 14:29:19 -0700 (PDT) X-Google-Smtp-Source: APXvYqyptik7yRmtZTXq5gfZsUk9oxihVcMvzAAPP+j7zPYXNJOKQ3Rgc/HoqNhlaySOnBrOglrL X-Received: by 2002:a17:906:4f14:: with SMTP id t20mr5957272eju.239.1572211759832; Sun, 27 Oct 2019 14:29:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1572211759; cv=none; d=google.com; s=arc-20160816; b=TeyM8vhneQUjjES9CfuP+Bfd3io8l8e7mUyI2SGT4CuEB3zHgTPZ/PQi7JorgmpCYM ++1KWeBP+dCSRccsundDpKD1P3CzKBh1sRLaSZjPNlWnVQIAJUqZtyddh6366vR9X4XG Avtcp5Ud2KqLLWmWn43v/QlnGY8AZmiVWRN7Vx9/PCGmMqAY0j5iEWVWcni6sNbew9rG toE1gETGrC5t+AazDy/mOPZxa45+08p807yU0xQmwcNvzf3aOcb3raQIHUGkXh6Mogk2 gytcMLQMFuVqGV7Dn6+9VJGyg+E2cfeHeC/z1r5Esz3cRQUwbs2DMZrCaxeS/79xO5aX fGFA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=2DvJrcIzxw+VqOZMt2IzDhb7r0Hx7ueU4l37FpFfff8=; b=AqELb2TYZHAE1+yti7YvTRDlN6ZG8PXIvFXFCW+agQNuXWIW34u0t+UZT2Y42dAb3i H+M1Xvo+6QQBXd2jHu/7m4AtUhktIqAd6R6Z0WFi2cp+3FIFfRlxYxu+RMAS1ZAWRT8W RbAmRaMbAZotgC0txcE9iU8dGynQH2qu5eZuBCMPI5103w9J7UINGyfrxH8XJPOPQ+Pq nJFWJFTW8oFp12SW4HQZpCDhuvNdwxSAm/+kZtpfDdkwA3xGxWbzZyQs0h3X8zRjg3VA 7/+xSr92ottlwlkKO435ukvOFvncGVC1nTS6WCXkdQo/bU0yjHQxfSYcaCdwcg5OEeUk u3Mw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=YVU1Dx67; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id p8si5310242ejf.305.2019.10.27.14.28.55; Sun, 27 Oct 2019 14:29:19 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=YVU1Dx67; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732735AbfJ0VZ1 (ORCPT + 99 others); Sun, 27 Oct 2019 17:25:27 -0400 Received: from mail.kernel.org ([198.145.29.99]:47266 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732722AbfJ0VZY (ORCPT ); Sun, 27 Oct 2019 17:25:24 -0400 Received: from localhost (100.50.158.77.rev.sfr.net [77.158.50.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9E91721726; Sun, 27 Oct 2019 21:25:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1572211523; bh=mXV+aCQIaF/2EIhmrQagNBsz8p/DkxAnpB4MZwnJxkw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YVU1Dx67P+Es0Nbxw1xDaAiNTBW/eO4gPJn6DWdLhZQKxa1BZj05DeKkWiVp3bXVZ yymAs9X6Tw5RUpmHJ24/T92oiaPo5vzeb8wpoNS16vZK9qQUJyrPXT63/X8JrKK1rh 6QuxwVBKWJ7LMmlbHG2eFow4ow27CzXBUiKIsYNo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Hildenbrand , Qian Cai , Michal Hocko , Dan Williams , Alexey Dobriyan , Stephen Rothwell , Toshiki Fukasawa , Pankaj gupta , Mike Rapoport , Anthony Yznaga , "Aneesh Kumar K.V" , Andrew Morton , Linus Torvalds Subject: [PATCH 5.3 137/197] fs/proc/page.c: dont access uninitialized memmaps in fs/proc/page.c Date: Sun, 27 Oct 2019 22:00:55 +0100 Message-Id: <20191027203359.107241702@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191027203351.684916567@linuxfoundation.org> References: <20191027203351.684916567@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: David Hildenbrand commit aad5f69bc161af489dbb5934868bd347282f0764 upstream. There are three places where we access uninitialized memmaps, namely: - /proc/kpagecount - /proc/kpageflags - /proc/kpagecgroup We have initialized memmaps either when the section is online or when the page was initialized to the ZONE_DEVICE. Uninitialized memmaps contain garbage and in the worst case trigger kernel BUGs, especially with CONFIG_PAGE_POISONING. For example, not onlining a DIMM during boot and calling /proc/kpagecount with CONFIG_PAGE_POISONING: :/# cat /proc/kpagecount > tmp.test BUG: unable to handle page fault for address: fffffffffffffffe #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 114616067 P4D 114616067 PUD 114618067 PMD 0 Oops: 0000 [#1] SMP NOPTI CPU: 0 PID: 469 Comm: cat Not tainted 5.4.0-rc1-next-20191004+ #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.4 RIP: 0010:kpagecount_read+0xce/0x1e0 Code: e8 09 83 e0 3f 48 0f a3 02 73 2d 4c 89 e7 48 c1 e7 06 48 03 3d ab 51 01 01 74 1d 48 8b 57 08 480 RSP: 0018:ffffa14e409b7e78 EFLAGS: 00010202 RAX: fffffffffffffffe RBX: 0000000000020000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 00007f76b5595000 RDI: fffff35645000000 RBP: 00007f76b5595000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000140000 R13: 0000000000020000 R14: 00007f76b5595000 R15: ffffa14e409b7f08 FS: 00007f76b577d580(0000) GS:ffff8f41bd400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffffffffffe CR3: 0000000078960000 CR4: 00000000000006f0 Call Trace: proc_reg_read+0x3c/0x60 vfs_read+0xc5/0x180 ksys_read+0x68/0xe0 do_syscall_64+0x5c/0xa0 entry_SYSCALL_64_after_hwframe+0x49/0xbe For now, let's drop support for ZONE_DEVICE from the three pseudo files in order to fix this. To distinguish offline memory (with garbage memmap) from ZONE_DEVICE memory with properly initialized memmaps, we would have to check get_dev_pagemap() and pfn_zone_device_reserved() right now. The usage of both (especially, special casing devmem) is frowned upon and needs to be reworked. The fundamental issue we have is: if (pfn_to_online_page(pfn)) { /* memmap initialized */ } else if (pfn_valid(pfn)) { /* * ??? * a) offline memory. memmap garbage. * b) devmem: memmap initialized to ZONE_DEVICE. * c) devmem: reserved for driver. memmap garbage. * (d) devmem: memmap currently initializing - garbage) */ } We'll leave the pfn_zone_device_reserved() check in stable_page_flags() in place as that function is also used from memory failure. We now no longer dump information about pages that are not in use anymore - offline. Link: http://lkml.kernel.org/r/20191009142435.3975-2-david@redhat.com Fixes: f1dd2cd13c4b ("mm, memory_hotplug: do not associate hotadded memory to zones until online") [visible after d0dc12e86b319] Signed-off-by: David Hildenbrand Reported-by: Qian Cai Acked-by: Michal Hocko Cc: Dan Williams Cc: Alexey Dobriyan Cc: Stephen Rothwell Cc: Toshiki Fukasawa Cc: Pankaj gupta Cc: Mike Rapoport Cc: Anthony Yznaga Cc: "Aneesh Kumar K.V" Cc: [4.13+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- fs/proc/page.c | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) --- a/fs/proc/page.c +++ b/fs/proc/page.c @@ -42,10 +42,12 @@ static ssize_t kpagecount_read(struct fi return -EINVAL; while (count > 0) { - if (pfn_valid(pfn)) - ppage = pfn_to_page(pfn); - else - ppage = NULL; + /* + * TODO: ZONE_DEVICE support requires to identify + * memmaps that were actually initialized. + */ + ppage = pfn_to_online_page(pfn); + if (!ppage || PageSlab(ppage) || page_has_type(ppage)) pcount = 0; else @@ -216,10 +218,11 @@ static ssize_t kpageflags_read(struct fi return -EINVAL; while (count > 0) { - if (pfn_valid(pfn)) - ppage = pfn_to_page(pfn); - else - ppage = NULL; + /* + * TODO: ZONE_DEVICE support requires to identify + * memmaps that were actually initialized. + */ + ppage = pfn_to_online_page(pfn); if (put_user(stable_page_flags(ppage), out)) { ret = -EFAULT; @@ -261,10 +264,11 @@ static ssize_t kpagecgroup_read(struct f return -EINVAL; while (count > 0) { - if (pfn_valid(pfn)) - ppage = pfn_to_page(pfn); - else - ppage = NULL; + /* + * TODO: ZONE_DEVICE support requires to identify + * memmaps that were actually initialized. + */ + ppage = pfn_to_online_page(pfn); if (ppage) ino = page_cgroup_ino(ppage);