From patchwork Fri Sep 30 09:38:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "zhaoyang.huang" X-Patchwork-Id: 12995083 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id F30D9C433FE for ; Fri, 30 Sep 2022 09:39:53 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 5DFBC8D0002; Fri, 30 Sep 2022 05:39:53 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 568538D0001; Fri, 30 Sep 2022 05:39:53 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3E2198D0002; Fri, 30 Sep 2022 05:39:53 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 2BA868D0001 for ; Fri, 30 Sep 2022 05:39:53 -0400 (EDT) Received: from smtpin09.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id EBAC31414DD for ; Fri, 30 Sep 2022 09:39:52 +0000 (UTC) X-FDA: 79968255024.09.2F49E36 Received: from SHSQR01.spreadtrum.com (mx1.unisoc.com [222.66.158.135]) by imf23.hostedemail.com (Postfix) with ESMTP id 0105F14000D for ; Fri, 30 Sep 2022 09:39:51 +0000 (UTC) Received: from SHSend.spreadtrum.com (bjmbx01.spreadtrum.com [10.0.64.7]) by SHSQR01.spreadtrum.com with ESMTPS id 28U9d77F028702 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NO); Fri, 30 Sep 2022 17:39:07 +0800 (CST) (envelope-from zhaoyang.huang@unisoc.com) Received: from bj03382pcu.spreadtrum.com (10.0.74.65) by BJMBX01.spreadtrum.com (10.0.64.7) with Microsoft SMTP Server (TLS) id 15.0.1497.23; Fri, 30 Sep 2022 17:39:08 +0800 From: "zhaoyang.huang" To: Andrew Morton , Catalin Marinas , Matthew Wilcox , Vlastimil Babka , Marco Elver , Imran Khan , Dmitry Vyukov , Zhaoyang Huang , , , , Subject: [PATCH] lib: check stack_table in __stack_depot_save Date: Fri, 30 Sep 2022 17:38:47 +0800 Message-ID: <1664530727-4581-1-git-send-email-zhaoyang.huang@unisoc.com> X-Mailer: git-send-email 1.9.1 MIME-Version: 1.0 X-Originating-IP: [10.0.74.65] X-ClientProxiedBy: SHCAS01.spreadtrum.com (10.0.1.201) To BJMBX01.spreadtrum.com (10.0.64.7) X-MAIL: SHSQR01.spreadtrum.com 28U9d77F028702 ARC-Authentication-Results: i=1; imf23.hostedemail.com; dkim=none; spf=pass (imf23.hostedemail.com: domain of zhaoyang.huang@unisoc.com designates 222.66.158.135 as permitted sender) smtp.mailfrom=zhaoyang.huang@unisoc.com; dmarc=none ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1664530792; a=rsa-sha256; cv=none; b=kbhQ7cFPA1DtO+wYsc1OPZ8aOJNZ42lEQwGIjTTSc3StcD6rKStVjnVsdVh2NqsHujFD3M tw2u6p8M+8/VAbaC7nnpYBE6C2SWK7dO7a0WsZx+mQ/Rc6jjfDD1Td7A5+JYL6F0iEg9oL 5AvL+6Q/U9No2CelOuNqN/8bFzzqTpU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1664530792; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding:in-reply-to: references; bh=vXu9msRnFRffebHEKQX+vqtRYaqpTSYuUsW7BW/cAq8=; b=6T3DHDs3t3eW5mo7llnH9G+41K1NSUGyhZD4PF+v0C/JIf8RRR5XzQtT946uSgv9AJBzVG hFPL2SvlvosK1Rqu63qc8dEgMkCLmvQLwoM07uD2l2Kvpiz/mov6gYbXql0oKABhRdZwEw cakEFUHS2jFpPQJBLTv2g2Kt9oOokwQ= X-Stat-Signature: 9kehrc788wbyq8g4trcocmsgryofr7tz X-Rspamd-Queue-Id: 0105F14000D Authentication-Results: imf23.hostedemail.com; dkim=none; spf=pass (imf23.hostedemail.com: domain of zhaoyang.huang@unisoc.com designates 222.66.158.135 as permitted sender) smtp.mailfrom=zhaoyang.huang@unisoc.com; dmarc=none X-Rspam-User: X-Rspamd-Server: rspam07 X-HE-Tag: 1664530791-425467 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Zhaoyang Huang NULL pointer reported in below lkp test report which should caused by invalid stack_table in very early stage before stack_depot_early_init called. I would like have kmemleak use stackdepot to track backtrace in this commit which lead to stack hash access before stackdepot is initialized. Add stack_table as extra criteria in __stack_depot_save's entry check. commit: a65edf711f97a0a3764fc04b0301ab2e073992db ("[PATCH] mm: use stack_depot for recording kmemleak's backtrace") url: https://github.com/intel-lab-lkp/linux/commits/zhaoyang-huang/mm-use-stack_depot-for-recording-kmemleak-s-backtrace/20220929-183243 base: https://git.kernel.org/cgit/linux/kernel/git/akpm/mm.git mm-everything patch link: https://lore.kernel.org/linux-mm/1664447407-8821-1-git-send-email-zhaoyang.huang@unisoc.com in testcase: boot on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace): [ 0.191645][ T0] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 0.192360][ T0] #PF: supervisor read access in kernel mode [ 0.192862][ T0] #PF: error_code(0x0000) - not-present page [ 0.193371][ T0] PGD 0 P4D 0 [ 0.193672][ T0] Oops: 0000 [#1] SMP PTI [ 0.194051][ T0] CPU: 0 PID: 0 Comm: swapper Not tainted 6.0.0-rc3-00706-ga65edf711f97 #26 [ 0.194755][ T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014 [ 0.195583][ T0] RIP: 0010:__stack_depot_save (kbuild/src/x86_64-2/lib/stackdepot.c:452) [ 0.196081][ T0] Code: 03 48 c7 c7 ec 17 b3 84 e8 f1 ea 85 ff 44 89 e0 23 05 d4 aa 01 03 48 8d 04 c3 48 89 c3 48 89 c7 48 89 44 24 28 e8 34 fc 85 ff <4c> 8b 33 4d 85 f6 0f 84 b6 00 00 00 8b 04 24 83 e8 01 48 8d 04 c5 All code ======== 0: 03 48 c7 add -0x39(%rax),%ecx 3: c7 (bad) 4: ec in (%dx),%al 5: 17 (bad) 6: b3 84 mov $0x84,%bl 8: e8 f1 ea 85 ff callq 0xffffffffff85eafe d: 44 89 e0 mov %r12d,%eax 10: 23 05 d4 aa 01 03 and 0x301aad4(%rip),%eax # 0x301aaea 16: 48 8d 04 c3 lea (%rbx,%rax,8),%rax 1a: 48 89 c3 mov %rax,%rbx 1d: 48 89 c7 mov %rax,%rdi 20: 48 89 44 24 28 mov %rax,0x28(%rsp) 25: e8 34 fc 85 ff callq 0xffffffffff85fc5e 2a:* 4c 8b 33 mov (%rbx),%r14 <-- trapping instruction 2d: 4d 85 f6 test %r14,%r14 30: 0f 84 b6 00 00 00 je 0xec 36: 8b 04 24 mov (%rsp),%eax 39: 83 e8 01 sub $0x1,%eax 3c: 48 rex.W 3d: 8d .byte 0x8d 3e: 04 c5 add $0xc5,%al Code starting with the faulting instruction =========================================== 0: 4c 8b 33 mov (%rbx),%r14 3: 4d 85 f6 test %r14,%r14 6: 0f 84 b6 00 00 00 je 0xc2 c: 8b 04 24 mov (%rsp),%eax f: 83 e8 01 sub $0x1,%eax 12: 48 rex.W 13: 8d .byte 0x8d 14: 04 c5 add $0xc5,%al [ 0.197693][ T0] RSP: 0000:ffffffff83603ca8 EFLAGS: 00010046 [ 0.198214][ T0] RAX: ffffffff83613cd8 RBX: 0000000000000000 RCX: ffffffff81b16d2c [ 0.198858][ T0] RDX: 0000000000000b1e RSI: 0000000000000000 RDI: 0000000000000000 [ 0.199499][ T0] RBP: 00000000c5a6b597 R08: ffffffff8479d118 R09: 0000000000000000 [ 0.200142][ T0] R10: 0000000000000004 R11: 0001ffffffffffff R12: 0000000027b2cd0a [ 0.200787][ T0] R13: 0000000000000003 R14: 000000004954f68c R15: ffffffff83603d54 [ 0.201488][ T0] FS: 0000000000000000(0000) GS:ffffffff842c9000(0000) knlGS:0000000000000000 [ 0.202247][ T0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.202807][ T0] CR2: 0000000000000000 CR3: 000000000360a000 CR4: 00000000000406b0 [ 0.203470][ T0] Call Trace: [ 0.203748][ T0] [ 0.203996][ T0] stack_depot_save (kbuild/src/x86_64-2/lib/stackdepot.c:534) [ 0.204406][ T0] set_track_prepare (kbuild/src/x86_64-2/mm/slub.c:752) [ 0.204816][ T0] ? memblock_alloc_range_nid (kbuild/src/x86_64-2/mm/memblock.c:1424) [ 0.205311][ T0] ? memblock_alloc_internal (kbuild/src/x86_64-2/mm/memblock.c:1514) [ 0.205781][ T0] ? memblock_alloc_try_nid (kbuild/src/x86_64-2/mm/memblock.c:1614 (discriminator 3)) [ 0.206238][ T0] ? setup_command_line (kbuild/src/x86_64-2/init/main.c:631) [ 0.206670][ T0] ? start_kernel (kbuild/src/x86_64-2/init/main.c:965) [ 0.207068][ T0] ? secondary_startup_64_no_verify (kbuild/src/x86_64-2/arch/x86/kernel/head_64.S:358) [ 0.207612][ T0] ? __raw_callee_save___native_queued_spin_unlock (??:?) [ 0.208251][ T0] ? write_comp_data (kbuild/src/x86_64-2/kernel/kcov.c:236) [ 0.208678][ T0] ? strncpy (kbuild/src/x86_64-2/lib/string.c:115) [ 0.209040][ T0] __create_object (kbuild/src/x86_64-2/mm/kmemleak.c:681) [ 0.209447][ T0] kmemleak_alloc_phys (kbuild/src/x86_64-2/mm/kmemleak.c:1212) [ 0.209867][ T0] memblock_alloc_range_nid (kbuild/src/x86_64-2/mm/memblock.c:1424) [ 0.210344][ T0] memblock_alloc_internal (kbuild/src/x86_64-2/mm/memblock.c:1514) [ 0.210806][ T0] memblock_alloc_try_nid (kbuild/src/x86_64-2/mm/memblock.c:1614 (discriminator 3)) [ 0.211255][ T0] setup_command_line (kbuild/src/x86_64-2/init/main.c:631) [ 0.211678][ T0] start_kernel (kbuild/src/x86_64-2/init/main.c:965) [ 0.212063][ T0] ? load_ucode_bsp (kbuild/src/x86_64-2/arch/x86/kernel/cpu/microcode/core.c:176) [ 0.212483][ T0] secondary_startup_64_no_verify (kbuild/src/x86_64-2/arch/x86/kernel/head_64.S:358) [ 0.212996][ T0] [ 0.213247][ T0] Modules linked in: [ 0.213591][ T0] CR2: 0000000000000000 [ 0.213955][ T0] ---[ end trace 0000000000000000 ]--- [ 0.214415][ T0] RIP: 0010:__stack_depot_save (kbuild/src/x86_64-2/lib/stackdepot.c:452) [ 0.214933][ T0] Code: 03 48 c7 c7 ec 17 b3 84 e8 f1 ea 85 ff 44 89 e0 23 05 d4 aa 01 03 48 8d 04 c3 48 89 c3 48 89 c7 48 89 44 24 28 e8 34 fc 85 ff <4c> 8b 33 4d 85 f6 0f 84 b6 00 00 00 8b 04 24 83 e8 01 48 8d 04 c5 All code ======== 0: 03 48 c7 add -0x39(%rax),%ecx 3: c7 (bad) 4: ec in (%dx),%al 5: 17 (bad) 6: b3 84 mov $0x84,%bl 8: e8 f1 ea 85 ff callq 0xffffffffff85eafe d: 44 89 e0 mov %r12d,%eax 10: 23 05 d4 aa 01 03 and 0x301aad4(%rip),%eax # 0x301aaea 16: 48 8d 04 c3 lea (%rbx,%rax,8),%rax 1a: 48 89 c3 mov %rax,%rbx 1d: 48 89 c7 mov %rax,%rdi 20: 48 89 44 24 28 mov %rax,0x28(%rsp) 25: e8 34 fc 85 ff callq 0xffffffffff85fc5e 2a:* 4c 8b 33 mov (%rbx),%r14 <-- trapping instruction 2d: 4d 85 f6 test %r14,%r14 30: 0f 84 b6 00 00 00 je 0xec 36: 8b 04 24 mov (%rsp),%eax 39: 83 e8 01 sub $0x1,%eax 3c: 48 rex.W 3d: 8d .byte 0x8d 3e: 04 c5 add $0xc5,%al Code starting with the faulting instruction =========================================== 0: 4c 8b 33 mov (%rbx),%r14 3: 4d 85 f6 test %r14,%r14 6: 0f 84 b6 00 00 00 je 0xc2 c: 8b 04 24 mov (%rsp),%eax f: 83 e8 01 sub $0x1,%eax 12: 48 rex.W 13: 8d .byte 0x8d 14: 04 c5 add $0xc5,%al Signed-off-by: Zhaoyang Huang --- lib/stackdepot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/stackdepot.c b/lib/stackdepot.c index e73fda2..97b6a2a 100644 --- a/lib/stackdepot.c +++ b/lib/stackdepot.c @@ -421,7 +421,7 @@ depot_stack_handle_t __stack_depot_save(unsigned long *entries, */ nr_entries = filter_irq_stacks(entries, nr_entries); - if (unlikely(nr_entries == 0) || stack_depot_disable) + if (unlikely(nr_entries == 0) || stack_depot_disable || !stack_table) goto fast_exit; hash = hash_stack(entries, nr_entries);