Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 21 Sep 2022 16:41:03 -0700
From:   Mike Kravetz <mike.kravetz@oracle.com>
To:     Sachin Sant <sachinp@linux.ibm.com>
Cc:     linuxppc-dev <linuxppc-dev@lists.ozlabs.org>, linux-mm@kvack.org,
        open list <linux-kernel@vger.kernel.org>
Subject: Re: [powerpc] Kernel crash with THP tests (next-20220920)
Message-ID: <YyuhD+7N022PgRA+@monkey>
References: <C2C8DA4F-F00F-43E9-ACD8-2A8BACA55893@linux.ibm.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <C2C8DA4F-F00F-43E9-ACD8-2A8BACA55893@linux.ibm.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?8NE2jApXoHKsk+YkADa5MEUYQIWWjYBTCm1oDs+Jbei5R729miBKlb4l8+NH?=
 =?us-ascii?Q?lOAkXaj1bSE51sakMsleMBf1ICBVrhBL/nQcLLXDH35sjuILCAThaAuJ5uEo?=
 =?us-ascii?Q?kP7phsau+Q/jxU5ZgbAqW6JIzoClckDNNT374CxMj53y6iHb9Pdrct1GR/TT?=
 =?us-ascii?Q?PageTn2xVZq4w1ezIAgTSi1P2N3C6k5Yk59ijePWhBz33d5LMus5VjDatAQb?=
 =?us-ascii?Q?PMIULmYXe17P9IRsddF0yAuwr6h6avP2nvNiHtNQjo6UsHxE00Z75a8S8ndR?=
 =?us-ascii?Q?3+05k+v7TDnP1EvDHGslvrP7tAi8fG0Aa9E8Sjr2cWS2guTNuqijGN8JEjpH?=
 =?us-ascii?Q?oHrqiTTtf3hjS7QnYx09CSB9ZNbNrwNmq8kyhiEeU5rBUx06QKU1VxZJhzsZ?=
 =?us-ascii?Q?sZJ3yzeZyt7ra49JyIu94Yj2AA7zdIlWwDtY0ZfFdpr7N3ZRFyONtZCns5Zm?=
 =?us-ascii?Q?eyychEJFZkKoBje2SMR6YP99JifY73t1vlF4L7hWcWrLdAUeLUYmO1TXW12d?=
 =?us-ascii?Q?/PgTsCSxVgybEfTTm8e8aZf/wZJe3n8yB5Zc7HAlmLcSFvrlwZ6AWsh0crya?=
 =?us-ascii?Q?31Efj4k1J6o76W+OwNyJvsNTmEbVFv24F9udobFv8FMe/CYCd84JKOJDT4rT?=
 =?us-ascii?Q?1bcoja9Mz1m0H/zDwVI2F7t+8gGmbjnaKTUrFIgtz+u56te+xdRnmztffMcY?=
 =?us-ascii?Q?KtNXhXTrCF0c5Q3BTVZqZCuhtcrI1HHADGXCy+wA4t3zVPJneDnzA+eVXlYR?=
 =?us-ascii?Q?trayk35Uzw+RFs1xsxw5oC8ntN0eZpEx2n5hPUwXCQZsYwIZ5xeXFN7aSpFn?=
 =?us-ascii?Q?cx5JOgS9l6vXbmKrC6vIPaQml+ve7R+zDXJYp2XFLMuMhCy++IeR31O5e9gf?=
 =?us-ascii?Q?gnWKHz87MueSOs1BfDVOLSJxn29j6qsBC59FCjHssrl4Av+cyAP522mrGiUL?=
 =?us-ascii?Q?8z8e0uOfkIY9OJZSuhRjW7xVAb4UQyWQNNGW4a1bgS+GRwyiuDT6qiDIquj+?=
 =?us-ascii?Q?j967pQ3SFFEyQR72yh/IkAsphKD+qOukCMZme298g5uiChsLnSxATIgvUY25?=
 =?us-ascii?Q?5nBXrMHto/RoK+aADqfQh+IJSkHT3Ep8HNCmWPLstZWovZeMqSu82w/ubI08?=
 =?us-ascii?Q?p5JCNxaiYKyUuv9kZFih7wP4PC3KuJjeOZ1PBYO6kakrj+Vk9eHevkBl1/rn?=
 =?us-ascii?Q?pZh7vPWdm1n66hxIIshdo88CTXNDWk06ymGlRn7GA+KlCja8TquLBYd+I05n?=
 =?us-ascii?Q?MtqGTvbwHxXpeq6aJzBjG6vnMU8+BPMHXuorA4c6NLK8UvMpSwgYxEGHcfA3?=
 =?us-ascii?Q?0dAcqnIf+prOen8m4gjfeo0MTPvd7XVpjiWifwlYgzJ1dQ/1o9SF+6J/uGmK?=
 =?us-ascii?Q?7Pj0LYwEqBGAHQ8fClJ7hCp9jjwWoaIV+KZb6Ezgq9D6ctNRSAQ5gvrWtAkR?=
 =?us-ascii?Q?HqpMGzLXKJsxtk5ooz6RKjRqbgvZ7pKenr2K8F1XKcH3VJ1Kzw9BwwuVER8l?=
 =?us-ascii?Q?E9PdoI3ueR/qIdaopD78aOBnL4uoEo6kIiJG/ULh1kRyAPg5PZWknHLFQ97D?=
 =?us-ascii?Q?PPQ9aO9NVxxrH+W4ZRwBHXWzJ5b5mSBfbVMkz3jtcInZ45d+p1KKmKWKXAgC?=
 =?us-ascii?Q?sw=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e06be7bf-c99a-47a4-9246-08da9c2ac088
X-MS-Exchange-CrossTenant-AuthSource: BY5PR10MB4196.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Sep 2022 23:41:06.1278
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: xCf+ARfLQqp7WRMscZoKZNsG/XkuFQyIvCrGWpU5H4yZT5AmrV7e1D0W8lB5FdDipZSFTW1Gek99Iv5D8ZE+dQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB5402
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1
 definitions=2022-09-21_12,2022-09-20_02,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxlogscore=999
 spamscore=0 adultscore=0 mlxscore=0 malwarescore=0 bulkscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2209130000 definitions=main-2209210159
X-Proofpoint-GUID: lXi_34LWTEGEJd3P-rjA2rgbZMHWNP6x
X-Proofpoint-ORIG-GUID: lXi_34LWTEGEJd3P-rjA2rgbZMHWNP6x
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 09/21/22 12:00, Sachin Sant wrote:
> While running transparent huge page tests [1] against 6.0.0-rc6-next-20220920
> following crash is seen on IBM Power server.

Thanks Sachin,

Naoya reported this, with my analysis here:
https://lore.kernel.org/linux-mm/YyqCS6+OXAgoqI8T@monkey/

An updated version of the patch was posted here,
https://lore.kernel.org/linux-mm/20220921202702.106069-1-mike.kravetz@oracle.com/

Sorry about that,
-- 
Mike Kravetz

> 
> Kernel attempted to read user page (34) - exploit attempt? (uid: 0)
> BUG: Kernel NULL pointer dereference on read at 0x00000034
> Faulting instruction address: 0xc0000000004d2744
> Oops: Kernel access of bad area, sig: 11 [#1]
> LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
> Modules linked in: dm_mod(E) bonding(E) rfkill(E) tls(E) sunrpc(E) nd_pmem(E) nd_btt(E) dax_pmem(E) papr_scm(E) libnvdimm(E) pseries_rng(E) vmx_crypto(E) ext4(E) mbcache(E) jbd2(E) sd_mod(E) t10_pi(E) crc64_rocksoft(E) crc64(E) sg(E) ibmvscsi(E) scsi_transport_srp(E) ibmveth(E) fuse(E)
> CPU: 37 PID: 2219255 Comm: sysctl Tainted: G            E      6.0.0-rc6-next-20220920 #1
> NIP:  c0000000004d2744 LR: c0000000004d2734 CTR: 0000000000000000
> REGS: c0000012801bf660 TRAP: 0300   Tainted: G            E       (6.0.0-rc6-next-20220920)
> MSR:  8000000000009033 <SF,EE,ME,IR,DR,RI,LE>  CR: 24048222  XER: 20040000
> CFAR: c0000000004b0eac DAR: 0000000000000034 DSISR: 40000000 IRQMASK: 0 
> GPR00: c0000000004d2734 c0000012801bf900 c000000002a92300 0000000000000000 
> GPR04: c000000002ac8ac0 c000000001209340 0000000000000005 c000001286714b80 
> GPR08: 0000000000000034 0000000000000000 0000000000000000 0000000000000000 
> GPR12: 0000000028048242 c00000167fff6b00 0000000000000000 0000000000000000 
> GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 
> GPR20: c0000012801bfae8 0000000000000001 0000000000000100 0000000000000001 
> GPR24: c0000012801bfae8 c000000002ac8ac0 0000000000000002 0000000000000005 
> GPR28: 0000000000000000 0000000000000001 0000000000000000 0000000000346cca 
> NIP [c0000000004d2744] alloc_buddy_huge_page+0xd4/0x240
> LR [c0000000004d2734] alloc_buddy_huge_page+0xc4/0x240
> Call Trace:
> [c0000012801bf900] [c0000000004d2734] alloc_buddy_huge_page+0xc4/0x240 (unreliable)
> [c0000012801bf9b0] [c0000000004d46a4] alloc_fresh_huge_page.part.72+0x214/0x2a0
> [c0000012801bfa40] [c0000000004d7f88] alloc_pool_huge_page+0x118/0x190
> [c0000012801bfa90] [c0000000004d84dc] __nr_hugepages_store_common+0x4dc/0x610
> [c0000012801bfb70] [c0000000004d88bc] hugetlb_sysctl_handler_common+0x13c/0x180
> [c0000012801bfc10] [c0000000006380e0] proc_sys_call_handler+0x210/0x350
> [c0000012801bfc90] [c000000000551c00] vfs_write+0x2e0/0x460
> [c0000012801bfd50] [c000000000551f5c] ksys_write+0x7c/0x140
> [c0000012801bfda0] [c000000000033f58] system_call_exception+0x188/0x3f0
> [c0000012801bfe10] [c00000000000c53c] system_call_common+0xec/0x270
> --- interrupt: c00 at 0x7fffa9520c34
> NIP:  00007fffa9520c34 LR: 00000001024754bc CTR: 0000000000000000
> REGS: c0000012801bfe80 TRAP: 0c00   Tainted: G            E       (6.0.0-rc6-next-20220920)
> MSR:  800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE>  CR: 28002202  XER: 00000000
> IRQMASK: 0 
> GPR00: 0000000000000004 00007fffccd76cd0 00007fffa9607300 0000000000000003 
> GPR04: 0000000138da6970 0000000000000006 fffffffffffffff6 0000000000000000 
> GPR08: 0000000138da6970 0000000000000000 0000000000000000 0000000000000000 
> GPR12: 0000000000000000 00007fffa9a40940 0000000000000000 0000000000000000 
> GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 
> GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 
> GPR24: 0000000000000001 0000000000000010 0000000000000006 0000000138da8aa0 
> GPR28: 00007fffa95fc2c8 0000000138da8aa0 0000000000000006 0000000138da6930 
> NIP [00007fffa9520c34] 0x7fffa9520c34
> LR [00000001024754bc] 0x1024754bc
> --- interrupt: c00
> Instruction dump:
> 3b400002 3ba00001 3b800000 7f26cb78 7fc5f378 7f64db78 7fe3fb78 4bfde5b9 
> 60000000 7c691b78 39030034 7c0004ac <7d404028> 7c0ae800 40c20010 7f80412d 
> ---[ end trace 0000000000000000 ]---
> 
> Kernel panic - not syncing: Fatal exception
> 
> Bisect points to following patch:
> commit f2f3c25dea3acfb17aecb7273541e7266dfc8842
>     hugetlb: freeze allocated pages before creating hugetlb pages
> 
> Reverting the patch allows the test to run successfully.
> 
> Thanks
> - Sachin
> 
> [1] https://github.com/avocado-framework-tests/avocado-misc-tests/blob/master/memory/transparent_hugepages_defrag.py