From patchwork Mon Dec 5 23:31:36 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Boyd X-Patchwork-Id: 13065199 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A827DC4708C for ; Mon, 5 Dec 2022 23:31:41 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E480E8E0002; Mon, 5 Dec 2022 18:31:40 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id DF8038E0001; Mon, 5 Dec 2022 18:31:40 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CBFD78E0002; Mon, 5 Dec 2022 18:31:40 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id BC9188E0001 for ; Mon, 5 Dec 2022 18:31:40 -0500 (EST) Received: from smtpin15.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 8B6F7C0CAB for ; Mon, 5 Dec 2022 23:31:40 +0000 (UTC) X-FDA: 80209851960.15.57B3006 Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) by imf03.hostedemail.com (Postfix) with ESMTP id 118E720010 for ; Mon, 5 Dec 2022 23:31:39 +0000 (UTC) Authentication-Results: imf03.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=VM9pcVhY; spf=pass (imf03.hostedemail.com: domain of swboyd@chromium.org designates 209.85.210.173 as permitted sender) smtp.mailfrom=swboyd@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1670283100; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=8PGxZk7EEUvOnO5sx9rLILLBhk3hndjY3IkHigHnSNk=; b=mfhH6xDKLTRre38RVNPwthrvhiXhP0Mjuzv0SllAFHbBD5uyywfbU5fNeoHhWlUxv4mR0n 7t+S2LVqmG4rjspNy+cPYvkQqrYxqk/R3vSY58yp9f8XLHpM4614Z/ojegU0fpNsH1VSS5 T5OMSX7VXQjZu72xaDboAvMgHsgU/6s= ARC-Authentication-Results: i=1; imf03.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=VM9pcVhY; spf=pass (imf03.hostedemail.com: domain of swboyd@chromium.org designates 209.85.210.173 as permitted sender) smtp.mailfrom=swboyd@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1670283100; a=rsa-sha256; cv=none; b=JNDPT6fyqzY1flfYl/0vBtxRUKOcTG7mhNsO6gcpyb9NxHQ2gPR/3s+4HFK2EGTL4Q/M8k yihNpD/qOHRUEf7xweH18+E41n08ZdwmOHSiFXG9mG5P/LTqYmq+F3Hn8Uva98ZybSsnlO Z1hDgP3S3DhXDLVlElUvBBBCYTVQrbA= Received: by mail-pf1-f173.google.com with SMTP id g1so4888529pfk.2 for ; Mon, 05 Dec 2022 15:31:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=8PGxZk7EEUvOnO5sx9rLILLBhk3hndjY3IkHigHnSNk=; b=VM9pcVhYNAPJGZ3AgbVI68+hqY5fuov7xv6MTKm+IbaqxEGKCAMYynql8YsNxhN5ll AKh8+YHGuNtYR6TquFYAn/Nq3PCKhNizj+V0PKc1kDQ6cr9QUExm1x/MLBu3ZDNeHww6 97oahN/0ax9u8B79bZbZM0oroWFY1LlTi5IiM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=8PGxZk7EEUvOnO5sx9rLILLBhk3hndjY3IkHigHnSNk=; b=e3Mweb74ZrIya4QqnkVJfdTYnksiceJgtax+jU+WV9WX3OdiQTjA64T+cK954whcD0 jq+kixzfHWHzJPnFkiR/uBNuWHXWaMv6qpR2J4su+o/GXEWIoC0OeRgka7QTEcFu6gbj 5T/VrgvyollLSfcv1Zxl8+GgA6OtOLYFuyiRCE6xgkg0fJKIhVwbwY5ClorRUqncpBf9 AsYvIQAilwtGVDlN035C7isEGL2aUlmDzoRY0vJ71eRaU2SjKSWfv6kt7tvB4P9HJ92b QQMeNTIMBVTAM/DpQ9Jf4JZV4/gc7U2e1LhmgqxvOcTsOz9DQYneEa9WkDl+Mt5nX/Yl cs4g== X-Gm-Message-State: ANoB5pmS2YH/9pww8VddsqakOuFecNm+QqmU+wnRxF+rdr6Fo6+QL4o2 Sy55rTV+MyyxXKhq/ZHb/8FKWA== X-Google-Smtp-Source: AA0mqf6+ELziPed8juoC6rlcujfAK7ChfnChJFMKw4zNC96g+vRUSY17tgqUG4y2gleflRL8tX+xgg== X-Received: by 2002:a63:5d63:0:b0:462:85d6:6276 with SMTP id o35-20020a635d63000000b0046285d66276mr59370450pgm.293.1670283098959; Mon, 05 Dec 2022 15:31:38 -0800 (PST) Received: from smtp.gmail.com ([2620:15c:11a:201:306e:2b04:2f47:46cc]) by smtp.gmail.com with ESMTPSA id q15-20020a170902a3cf00b00188ea79fae0sm11232250plb.48.2022.12.05.15.31.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 05 Dec 2022 15:31:38 -0800 (PST) From: Stephen Boyd To: Kees Cook , Anton Vorontsov , Colin Cross , Tony Luck Cc: linux-kernel@vger.kernel.org, patches@lists.linux.dev, linux-mm@kvack.org, Brian Geffon , Mike Rapoport , Andrew Morton Subject: [PATCH] pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP Date: Mon, 5 Dec 2022 15:31:36 -0800 Message-Id: <20221205233136.3420802-1-swboyd@chromium.org> X-Mailer: git-send-email 2.39.0.rc0.267.gcb52ba06e7-goog MIME-Version: 1.0 X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 118E720010 X-Rspam-User: X-Stat-Signature: ztdf81nif4rqb7fpdj9ewwazstozwdp7 X-Spamd-Result: default: False [5.02 / 9.00]; SORBS_IRL_BL(3.00)[209.85.210.173:from]; BAYES_HAM(-2.58)[89.98%]; R_MISSING_CHARSET(2.50)[]; MID_CONTAINS_FROM(1.00)[]; SUBJECT_HAS_UNDERSCORES(1.00)[]; RCVD_NO_TLS_LAST(0.10)[]; MIME_GOOD(-0.10)[text/plain]; BAD_REP_POLICIES(0.10)[]; TO_DN_SOME(0.00)[]; ARC_NA(0.00)[]; RCPT_COUNT_SEVEN(0.00)[10]; R_DKIM_ALLOW(0.00)[chromium.org:s=google]; MIME_TRACE(0.00)[0:+]; FROM_EQ_ENVFROM(0.00)[]; R_SPF_ALLOW(0.00)[+ip4:209.85.128.0/17]; DMARC_POLICY_ALLOW(0.00)[chromium.org,none]; TO_MATCH_ENVRCPT_SOME(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[linux-mm@kvack.org]; DKIM_TRACE(0.00)[chromium.org:+]; ARC_SIGNED(0.00)[hostedemail.com:s=arc-20220608:i=1]; RCVD_COUNT_THREE(0.00)[3]; FROM_HAS_DN(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[] X-HE-Tag: 1670283099-269703 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: An oops can be induced by running 'cat /proc/kcore > /dev/null' on devices using pstore with the ram backend because kmap_atomic() assumes lowmem pages are accessible with __va(). Unable to handle kernel paging request at virtual address ffffff807ff2b000 Mem abort info: ESR = 0x96000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000081d87000 [ffffff807ff2b000] pgd=180000017fe18003, p4d=180000017fe18003, pud=180000017fe18003, pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Modules linked in: dm_integrity CPU: 7 PID: 21179 Comm: perf Not tainted 5.15.67-10882-ge4eb2eb988cd #1 baa443fb8e8477896a370b31a821eb2009f9bfba Hardware name: Google Lazor (rev3 - 8) (DT) pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __memcpy+0x110/0x260 lr : vread+0x194/0x294 sp : ffffffc013ee39d0 x29: ffffffc013ee39f0 x28: 0000000000001000 x27: ffffff807ff2b000 x26: 0000000000001000 x25: ffffffc0085a2000 x24: ffffff802d4b3000 x23: ffffff80f8a60000 x22: ffffff802d4b3000 x21: ffffffc0085a2000 x20: ffffff8080b7bc68 x19: 0000000000001000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: ffffffd3073f2e60 x14: ffffffffad588000 x13: 0000000000000000 x12: 0000000000000001 x11: 00000000000001a2 x10: 00680000fff2bf0b x9 : 03fffffff807ff2b x8 : 0000000000000001 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffffff802d4b4000 x4 : ffffff807ff2c000 x3 : ffffffc013ee3a78 x2 : 0000000000001000 x1 : ffffff807ff2b000 x0 : ffffff802d4b3000 Call trace: __memcpy+0x110/0x260 read_kcore+0x584/0x778 proc_reg_read+0xb4/0xe4 During early boot, memblock reserves the pages for the ramoops reserved memory node in DT that would otherwise be part of the direct lowmem mapping. Pstore's ram backend reuses those reserved pages to change the memory type (writeback or non-cached) by passing the pages to vmap() (see pfn_to_page() usage in persistent_ram_vmap() for more details) with specific flags. When read_kcore() starts iterating over the vmalloc region, it runs over the virtual address that vmap() returned for ramoops. In aligned_vread() the virtual address is passed to vmalloc_to_page() which returns the page struct for the reserved lowmem area. That lowmem page is passed to kmap_atomic(), which effectively calls page_to_virt() that assumes a lowmem page struct must be directly accessible with __va() and friends. These pages are mapped via vmap() though, and the lowmem mapping was never made, so accessing them via the lowmem virtual address oopses like above. Let's side-step this problem by passing VM_IOREMAP to vmap(). This will tell vread() to not include the ramoops region in the kcore. Instead the area will look like a bunch of zeros. The alternative is to teach kmap() about vmalloc areas that intersect with lowmem. Presumably such a change isn't a one-liner, and there isn't much interest in inspecting the ramoops region in kcore files anyway, so the most expedient route is taken for now. Cc: Brian Geffon Cc: Mike Rapoport Cc: Andrew Morton Fixes: 404a6043385d ("staging: android: persistent_ram: handle reserving and mapping memory") Signed-off-by: Stephen Boyd --- fs/pstore/ram_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) base-commit: 9abf2313adc1ca1b6180c508c25f22f9395cc780 diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c index a89e33719fcf..3a2a041b023d 100644 --- a/fs/pstore/ram_core.c +++ b/fs/pstore/ram_core.c @@ -439,7 +439,7 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, phys_addr_t addr = page_start + i * PAGE_SIZE; pages[i] = pfn_to_page(addr >> PAGE_SHIFT); } - vaddr = vmap(pages, page_count, VM_MAP, prot); + vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot); kfree(pages); /*