Skip to contentSkip to conversation

powerpc/mm: Fix kernel crash on page table free

PATCH Applied Aneesh Kumar K.V 3 participants 4 messages May 30, 2018 – Jun 15, 2018 PowerPC

lore
Share & tools
lore

Aneesh Kumar K.V

author
#0 lore raw

PATCH 1/1 powerpc/mm: Fix kernel crash on page table free

Fix the below crash on BookE 64. pgtable_page_dtor expects struct page *arg.

Also call the destructor on non book3s platforms correctly. This free up the split ptl locks correctly if we had allocated them before.

Call Trace:
[c0000000f30c7520] [c00000000021eeec] .kmem_cache_free+0x9c/0x44c (unreliable)
[c0000000f30c75c0] [c0000000001ee07c] .ptlock_free+0x1c/0x30
[c0000000f30c7630] [c0000000001ee260] .tlb_remove_table+0xdc/0x224
[c0000000f30c76c0] [c0000000001ee640] .free_pgd_range+0x298/0x500
[c0000000f30c77d0] [c000000000232afc] .shift_arg_pages+0x10c/0x1e0
[c0000000f30c7910] [c000000000232dd0] .setup_arg_pages+0x200/0x25c
[c0000000f30c79c0] [c0000000002ad4fc] .load_elf_binary+0x450/0x16c8
[c0000000f30c7b10] [c000000000234914] .search_binary_handler.part.11+0x9c/0x248
[c0000000f30c7bb0] [c00000000023595c] .do_execveat_common.isra.13+0x868/0xc18
[c0000000f30c7cb0] [c00000000000184c] .run_init_process+0x34/0x4c
[c0000000f30c7d30] [c000000000001880] .try_to_run_init_process+0x1c/0x68
[c0000000f30c7db0] [c000000000002bd8] .kernel_init+0xdc/0x130
[c0000000f30c7e30] [c0000000000009dc] .ret_from_kernel_thread+0x58/0x7c
Fixes 702346768 ("powerpc/mm/nohash: Remove pte fragment dependency from nohash")
Signed-off-by Aneesh Kumar K.V <[email protected]>
---
 arch/powerpc/include/asm/book3s/32/pgalloc.h | 1 +
 arch/powerpc/include/asm/nohash/32/pgalloc.h | 1 +
 arch/powerpc/include/asm/nohash/64/pgalloc.h | 2 +-
 3 files changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/include/asm/book3s/32/pgalloc.h +1 -0
index 5073cc75f1c8..6a6673907e45 100644
@@ -99,6 +99,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage)
 static inline void pgtable_free(void *table, unsigned index_size)
 {
 	if (!index_size) {
+		pgtable_page_dtor(virt_to_page(table));
 		free_page((unsigned long)table);
 	} else {
 		BUG_ON(index_size > MAX_PGTABLE_INDEX_SIZE);
arch/powerpc/include/asm/nohash/32/pgalloc.h +1 -0
index 29d37bd1f3b3..1707781d2f20 100644
@@ -100,6 +100,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage)
 static inline void pgtable_free(void *table, unsigned index_size)
 {
 	if (!index_size) {
+		pgtable_page_dtor(virt_to_page(table));
 		free_page((unsigned long)table);
 	} else {
 		BUG_ON(index_size > MAX_PGTABLE_INDEX_SIZE);
arch/powerpc/include/asm/nohash/64/pgalloc.h +1 -1
index 21624ff1f065..0e693f322cb2 100644
@@ -133,7 +133,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage)
 static inline void pgtable_free(void *table, int shift)
 {
 	if (!shift) {
-		pgtable_page_dtor(table);
+		pgtable_page_dtor(virt_to_page(table));
 		free_page((unsigned long)table);
 	} else {
 		BUG_ON(shift > MAX_PGTABLE_INDEX_SIZE);
Signature · 1 line
2.17.0
Applied
#1 lore raw
Quoted 20 lines · Aneesh Kumar K.V

Fix the below crash on BookE 64. pgtable_page_dtor expects struct page *arg.

Also call the destructor on non book3s platforms correctly. This free up the split ptl locks correctly if we had allocated them before.

Call Trace:
[c0000000f30c7520] [c00000000021eeec] .kmem_cache_free+0x9c/0x44c (unreliable)
[c0000000f30c75c0] [c0000000001ee07c] .ptlock_free+0x1c/0x30
[c0000000f30c7630] [c0000000001ee260] .tlb_remove_table+0xdc/0x224
[c0000000f30c76c0] [c0000000001ee640] .free_pgd_range+0x298/0x500
[c0000000f30c77d0] [c000000000232afc] .shift_arg_pages+0x10c/0x1e0
[c0000000f30c7910] [c000000000232dd0] .setup_arg_pages+0x200/0x25c
[c0000000f30c79c0] [c0000000002ad4fc] .load_elf_binary+0x450/0x16c8
[c0000000f30c7b10] [c000000000234914] .search_binary_handler.part.11+0x9c/0x248
[c0000000f30c7bb0] [c00000000023595c] .do_execveat_common.isra.13+0x868/0xc18
[c0000000f30c7cb0] [c00000000000184c] .run_init_process+0x34/0x4c
[c0000000f30c7d30] [c000000000001880] .try_to_run_init_process+0x1c/0x68
[c0000000f30c7db0] [c000000000002bd8] .kernel_init+0xdc/0x130
[c0000000f30c7e30] [c0000000000009dc] .ret_from_kernel_thread+0x58/0x7c
Quoted 2 lines
Fixes 702346768 ("powerpc/mm/nohash: Remove pte fragment dependency from nohash")
Signed-off-by Aneesh Kumar K.V <[email protected]>

Applied to powerpc next, thanks.

https://git.kernel.org/powerpc/c/667416f38554eef94485496f3a27b9

cheers

#2 lore raw
In reply to Aneesh Kumar K.V
Quoted 33 lines · Aneesh Kumar K.V

Fix the below crash on BookE 64. pgtable_page_dtor expects struct page *arg.

Also call the destructor on non book3s platforms correctly. This free up the split ptl locks correctly if we had allocated them before.

Call Trace:
[c0000000f30c7520] [c00000000021eeec] .kmem_cache_free+0x9c/0x44c (unreliable)
[c0000000f30c75c0] [c0000000001ee07c] .ptlock_free+0x1c/0x30
[c0000000f30c7630] [c0000000001ee260] .tlb_remove_table+0xdc/0x224
[c0000000f30c76c0] [c0000000001ee640] .free_pgd_range+0x298/0x500
[c0000000f30c77d0] [c000000000232afc] .shift_arg_pages+0x10c/0x1e0
[c0000000f30c7910] [c000000000232dd0] .setup_arg_pages+0x200/0x25c
[c0000000f30c79c0] [c0000000002ad4fc] .load_elf_binary+0x450/0x16c8
[c0000000f30c7b10] [c000000000234914] .search_binary_handler.part.11+0x9c/0x248
[c0000000f30c7bb0] [c00000000023595c] .do_execveat_common.isra.13+0x868/0xc18
[c0000000f30c7cb0] [c00000000000184c] .run_init_process+0x34/0x4c
[c0000000f30c7d30] [c000000000001880] .try_to_run_init_process+0x1c/0x68
[c0000000f30c7db0] [c000000000002bd8] .kernel_init+0xdc/0x130
[c0000000f30c7e30] [c0000000000009dc] .ret_from_kernel_thread+0x58/0x7c
Fixes 702346768 ("powerpc/mm/nohash: Remove pte fragment dependency from nohash")
Signed-off-by Aneesh Kumar K.V <[email protected]>
---
  arch/powerpc/include/asm/book3s/32/pgalloc.h | 1 +
  arch/powerpc/include/asm/nohash/32/pgalloc.h | 1 +
  arch/powerpc/include/asm/nohash/64/pgalloc.h | 2 +-
  3 files changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/include/asm/book3s/32/pgalloc.h +0 -0
index 5073cc75f1c8..6a6673907e45 100644

arch/powerpc/include/asm/book3s/32/pgalloc.h static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage) · line 102

Quoted 4 lines
arch/powerpc/include/asm/book3s/32/pgalloc.h +1 -0
@@ -99,6 +99,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage)
  static inline void pgtable_free(void *table, unsigned index_size)
  {
  	if (!index_size) {
+		pgtable_page_dtor(virt_to_page(table));

__pte_free_tlb() already calls pgtable_page_dtor(table) before calling pgtable_free() via pgtable_free_tlb().

Is it normal to call it twice ?

arch/powerpc/include/asm/nohash/32/pgalloc.h static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage) · line 103

Quoted 12 lines
arch/powerpc/include/asm/book3s/32/pgalloc.h +0 -0
  		free_page((unsigned long)table);
  	} else {
  		BUG_ON(index_size > MAX_PGTABLE_INDEX_SIZE);
arch/powerpc/include/asm/nohash/32/pgalloc.h +1 -0
index 29d37bd1f3b3..1707781d2f20 100644
@@ -100,6 +100,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage)
  static inline void pgtable_free(void *table, unsigned index_size)
  {
  	if (!index_size) {
+		pgtable_page_dtor(virt_to_page(table));

Same here

Christophe

Quoted 17 lines
arch/powerpc/include/asm/nohash/32/pgalloc.h +0 -0
  		free_page((unsigned long)table);
  	} else {
  		BUG_ON(index_size > MAX_PGTABLE_INDEX_SIZE);
arch/powerpc/include/asm/nohash/64/pgalloc.h +1 -1
index 21624ff1f065..0e693f322cb2 100644
@@ -133,7 +133,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage)
  static inline void pgtable_free(void *table, int shift)
  {
  	if (!shift) {
-		pgtable_page_dtor(table);
+		pgtable_page_dtor(virt_to_page(table));
  		free_page((unsigned long)table);
  	} else {
  		BUG_ON(shift > MAX_PGTABLE_INDEX_SIZE);
author
#3 lore raw
Quoted 45 lines · Christophe Leroy
Quoted 33 lines · Aneesh Kumar K.V

Fix the below crash on BookE 64. pgtable_page_dtor expects struct page *arg.

Also call the destructor on non book3s platforms correctly. This free up the split ptl locks correctly if we had allocated them before.

Call Trace:
[c0000000f30c7520] [c00000000021eeec] .kmem_cache_free+0x9c/0x44c (unreliable)
[c0000000f30c75c0] [c0000000001ee07c] .ptlock_free+0x1c/0x30
[c0000000f30c7630] [c0000000001ee260] .tlb_remove_table+0xdc/0x224
[c0000000f30c76c0] [c0000000001ee640] .free_pgd_range+0x298/0x500
[c0000000f30c77d0] [c000000000232afc] .shift_arg_pages+0x10c/0x1e0
[c0000000f30c7910] [c000000000232dd0] .setup_arg_pages+0x200/0x25c
[c0000000f30c79c0] [c0000000002ad4fc] .load_elf_binary+0x450/0x16c8
[c0000000f30c7b10] [c000000000234914] .search_binary_handler.part.11+0x9c/0x248
[c0000000f30c7bb0] [c00000000023595c] .do_execveat_common.isra.13+0x868/0xc18
[c0000000f30c7cb0] [c00000000000184c] .run_init_process+0x34/0x4c
[c0000000f30c7d30] [c000000000001880] .try_to_run_init_process+0x1c/0x68
[c0000000f30c7db0] [c000000000002bd8] .kernel_init+0xdc/0x130
[c0000000f30c7e30] [c0000000000009dc] .ret_from_kernel_thread+0x58/0x7c
Fixes 702346768 ("powerpc/mm/nohash: Remove pte fragment dependency from nohash")
Signed-off-by Aneesh Kumar K.V <[email protected]>

---

  arch/powerpc/include/asm/book3s/32/pgalloc.h | 1 +
  arch/powerpc/include/asm/nohash/32/pgalloc.h | 1 +
  arch/powerpc/include/asm/nohash/64/pgalloc.h | 2 +-
  3 files changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/include/asm/book3s/32/pgalloc.h +0 -0
index 5073cc75f1c8..6a6673907e45 100644

arch/powerpc/include/asm/book3s/32/pgalloc.h static inline void pte_free(struct mm_struct *mm, · line 103

Quoted 5 lines
arch/powerpc/include/asm/book3s/32/pgalloc.h +1 -0
@@ -99,6 +99,7 @@ static inline void pte_free(struct mm_struct *mm, 
 pgtable_t ptepage)
   static inline void pgtable_free(void *table, unsigned index_size)
   {
       if (!index_size) {
+        pgtable_page_dtor(virt_to_page(table));

__pte_free_tlb() already calls pgtable_page_dtor(table) before calling pgtable_free() via pgtable_free_tlb().

Quoted 1 line

Is it normal to call it twice ?

No. We should call pgtable_page_dtor only in the rcu callback. So we should remove it from __pte_free_tlb().

Quoted 16 lines
Quoted 9 lines
arch/powerpc/include/asm/book3s/32/pgalloc.h +0 -0
           free_page((unsigned long)table);
       } else {

          BUG_ON(index_size > MAX_PGTABLE_INDEX_SIZE);

arch/powerpc/include/asm/nohash/32/pgalloc.h +0 -0
index 29d37bd1f3b3..1707781d2f20 100644

arch/powerpc/include/asm/nohash/32/pgalloc.h static inline void pte_free(struct mm_struct *mm, · line 104

Quoted 5 lines
arch/powerpc/include/asm/nohash/32/pgalloc.h +1 -0
@@ -100,6 +100,7 @@ static inline void pte_free(struct mm_struct *mm, 
 pgtable_t ptepage)
   static inline void pgtable_free(void *table, unsigned index_size)
   {
       if (!index_size) {
+        pgtable_page_dtor(virt_to_page(table));

Same here

I don't have the facility to test anything other than book3s64. Can you do a patch for this?

-aneesh