Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Nick Terrell <terrelln@fb.com>
To:     Feng Tang <feng.tang@intel.com>
CC:     "Gustavo A. R. Silva" <gustavoars@kernel.org>,
        X86 ML <x86@kernel.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        kernel test robot <oliver.sang@intel.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: Possible bug for ZSTD kernel decompressing
Thread-Topic: Possible bug for ZSTD kernel decompressing
Thread-Index: AQHYFAMJn5it7R8zZ0OSLoTcXCVE9Kx9mvAA
Date:   Mon, 31 Jan 2022 20:31:10 +0000
Message-ID: <682F137E-25D6-43F7-88FC-D8C7ECE4517B@fb.com>
References: <20220128045330.GB87412@shbuild999.sh.intel.com>
In-Reply-To: <20220128045330.GB87412@shbuild999.sh.intel.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?g0goTzPKWDwC3QQ+owFztEyDFHfY4jqdPTmnTXWliW+HXFNIgABQsUJfVQ53?=
 =?us-ascii?Q?qC66ZoGkA0CI3glNCO3vUEdIdNzEreL0crOKE0m8Vz+0pK3wOmXqNJyxByYr?=
 =?us-ascii?Q?3slQ3oRiatYkbLkPWguLLqk7PFbDBan4+LMm8daIvIwYvRi81otVR1DtpE5F?=
 =?us-ascii?Q?QLT1VM5Z6fbM5Jbw3E+lHOVsVfYonV6NMnLQTE4g72Q++whUGEQFvpwxU48L?=
 =?us-ascii?Q?zQFq36VY6QODzifp5jma8+bIaCNZjY+KQNqeL7iGTyjicdjyC3g6dWDTgX7N?=
 =?us-ascii?Q?4sI7fWJR2VX+Mwg2lXv/pXVB25hUdKxtE5yB7Q7DRDRT7cIGalWpDB5Phc9V?=
 =?us-ascii?Q?cJSfeTj3C6jeLAfAX6B9xXxLeqraePoRcjCBfvXMmWtHHtvDiRqobyFHZQ7D?=
 =?us-ascii?Q?AYdTcLPuwggVgJ4+V1KuiQapHEUwbEAm++mj6HjkkgvZ1feanyDFAgVyJIYJ?=
 =?us-ascii?Q?/tRycHDwZ9xEQtWbYXX9lh17585ySfGbr41644WN6PFPGkt36JmdVns2LqgH?=
 =?us-ascii?Q?S8d5GDyc3+HO9h9YBeRmmHxo76F7ByoVVFVRKK3fH/ec9OFYsUwOP7Vb9hzx?=
 =?us-ascii?Q?JDSk30yYDIrTMwxeq8xO2SJyGesR2TTgIt1xt+fSkemotlY3+kZYiLMG7QNC?=
 =?us-ascii?Q?qPwzV+cTbXMpohNbeyAIMlII4uvQDkAdPFRNJkS2WWv82Ry7/yXYJFDBuRBB?=
 =?us-ascii?Q?VC1+UBMhuPI6WCF2eEt+ocfhIIVoiyGIdoyje0Q9dmsh98lr2ujxPAix8fNh?=
 =?us-ascii?Q?ZQaJR078kK4vZ3LQTR0CjLpqfT5hXd/o/Sk7ZrQsy25ou4c3O3xSJVYM6eEE?=
 =?us-ascii?Q?PP1U0Q0sewaUggACxepo0XfnGjronUACgrZxgvedZinwQ0h12dQO+yzzDB2u?=
 =?us-ascii?Q?NESKTirKXW/s+rAaFPN3xKBD/7xS1vQO7fNDTIUcOBdG6VYw5D/hDG9Rb0uz?=
 =?us-ascii?Q?NDrfHOIyIEcw+pIrCvYDU+EhQd5Brav47Iqk3bUy9IFVEozdItUqZ6oP+zmy?=
 =?us-ascii?Q?fMJwNmJCjlgxYMb5Ur2tKhppmhVctSfjH0Y/v2fpVWxClHJOqXwtnmKMDlxG?=
 =?us-ascii?Q?thSDkkE3qVgS/WkAjIQ3AEb+tmypkJpxC4rA6rsau7vCMiqdrufrmUk8ZWPC?=
 =?us-ascii?Q?gnF6gfij58DEEe/aV7IA9+jGiBMbYS1LJ0YAhVDyh7jkw8RwyQiHYi7o/lak?=
 =?us-ascii?Q?tOVrs6/1HOaIQcp/Ez3sW0JMIiM8E92/KJ9ka8Agw4U3SVQ/WSgoRtXhWaK8?=
 =?us-ascii?Q?qgQYFsoRQQJC+z21u2JJu5wMXSthZm47lsLh4l7YWeCH5epCbH790VomOVFo?=
 =?us-ascii?Q?rjbLWN/mNqH1T8u1u8H/gcZwm846HCvWFIioR9TcpRoQNFAU388bAWuzW3EK?=
 =?us-ascii?Q?B63DOOw4DT7gtq5c7lvQL0xTSnb4+61kzqQGEVt+5YeZB2ZyOUyrKlqjnU+q?=
 =?us-ascii?Q?IsGcBoKn0DZLril+JisWhs4mtD2SRKkFoK2c9OxlSLnDdSV39vZ5a0ns8PQE?=
 =?us-ascii?Q?Ml2EqcIAuL3Ea7AKGq8eIriFrR3cRuwJJt5kQNIWDc5I9xjSFCpsLXuggyjm?=
 =?us-ascii?Q?NkfPrBNqxqby1q2l4hQ=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <AE563F1F664D7640951FBA8EA114D897@namprd15.prod.outlook.com>
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BY5PR15MB3667.namprd15.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: aa29e302-15ce-4b7d-cc5d-08d9e4f89e66
X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Jan 2022 20:31:10.9414
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: GuJFeAf+HSv9ki3pzzbKLgA+iGSY9OL61jhHe+2i0NEwaeZVxxs5klk5M7CqEVNW
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR15MB1268
X-OriginatorOrg: fb.com
X-Proofpoint-GUID: TIC6gb6LJdwQXAr6faPPbXniz7stnEvP
X-Proofpoint-ORIG-GUID: TIC6gb6LJdwQXAr6faPPbXniz7stnEvP
X-Proofpoint-UnRewURL: 0 URL was un-rewritten
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.816,Hydra:6.0.425,FMLib:17.11.62.513
 definitions=2022-01-31_07,2022-01-31_01,2021-12-02_01
X-Proofpoint-Spam-Details: rule=fb_outbound_notspam policy=fb_outbound score=0 clxscore=1015
 impostorscore=0 suspectscore=0 bulkscore=0 mlxlogscore=999
 priorityscore=1501 malwarescore=0 lowpriorityscore=0 mlxscore=0
 spamscore=0 phishscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx
 scancount=1 engine=8.12.0-2201110000 definitions=main-2201310130
X-FB-Internal: deliver
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


> On Jan 27, 2022, at 8:53 PM, Feng Tang <feng.tang@intel.com> wrote:
> 
> Hi All,
> 
> Recently 0Day reported a 32bit i386 kernel decompression failure for my
> patch [1], which essentially increase the kernel data section's size
> from 19MB to 53MB, with error message:
> 
> 	early console in setup code
> 	early console in extract_kernel
> 	input_data: 0x05077079
> 	input_len: 0x00f8a633
> 	output: 0x01000000
> 	output_len: 0x045c4328
> 	kernel_total_size: 0x05040000
> 	needed_size: 0x05040000
> 
> 	Decompressing Linux... 
> 
> 	ZSTD-compressed data is corrupt
> 
> 	 -- System haltedBUG: kernel hang in boot stage
> 
> From debug, it is likely a problem of ZSTD decompression code, as when I
> reverted my patch and  hacked to increase the size of kernel data
> section by 32MB, the same error will happen.
> 
> Some other hints are:
> * same i386 config with lz4 and xz algo can boot
> * X86_64 + zstd also boots fine
> 
> This could be reproduced by qemu cmd:
> 
> qemu-system-i386 -machine pc -cpu host -enable-kvm -kernel bzImage -m 2048m -smp 4 -serial stdio  --append "earlyprintk=ttyS0,115200 console=ttyS0,115200"
> 
> i386 kernel config is attached, and the debug patch as below:
> ---
> diff --git a/init/main.c b/init/main.c
> index 767ee2672176..873f40ddf96e 100644
> --- a/init/main.c
> +++ b/init/main.c
> @@ -162,6 +162,10 @@ static size_t initargs_offs;
> static char *execute_command;
> static char *ramdisk_execute_command = "/init";
> 
> +#define DT_SIZE		8192000
> +static unsigned long tbuf[DT_SIZE] = { 1, 2, 3, 4, };
> +
> /*
>  * Used to generate warnings if static_key manipulation functions are used
>  * before jump_label_init is called.
> @@ -690,6 +694,11 @@ noinline void __ref rest_init(void)
> 	struct task_struct *tsk;
> 	int pid;
> 
> +	unsigned long i, j;
> +	for (i = 0; i < DT_SIZE; i++)
> +		j += tbuf[i];
> +	printk("j = 0x%x\n", j);
> +
> 	rcu_scheduler_starting();
> 	/*
> 	 * We need to spawn init first so that it obtains pid 1, however
> 
> Please let me know if you need more info.
> 
> [1.] https://lore.kernel.org/lkml/1627456900-42743-1-git-send-email-feng.tang@intel.com/ 

I've been unable to reproduce this issue using the provided patch + config based on
Linux v5.17-rc2.

What version of Linux are you testing on? Zstd was updated in v5.16, so if you're not
testing on v5.16 or later, can you please re-test on v5.17-rc2?

Best,
Nick Terrell

> Thanks,
> Feng
> <i386_decompress_fail.config>