From patchwork Fri Jul 2 10:32:25 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gavin Shan X-Patchwork-Id: 12355915 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 80285C11F6A for ; Fri, 2 Jul 2021 10:32:38 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 1C8B061422 for ; Fri, 2 Jul 2021 10:32:37 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 1C8B061422 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 5069D6B0011; Fri, 2 Jul 2021 06:32:37 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 48FBB6B0036; Fri, 2 Jul 2021 06:32:37 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2E2836B005D; Fri, 2 Jul 2021 06:32:37 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0044.hostedemail.com [216.40.44.44]) by kanga.kvack.org (Postfix) with ESMTP id 020B16B0011 for ; Fri, 2 Jul 2021 06:32:36 -0400 (EDT) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id ADA23183E39A9 for ; Fri, 2 Jul 2021 10:32:36 +0000 (UTC) X-FDA: 78317283912.05.C6AF32B Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) by imf11.hostedemail.com (Postfix) with ESMTP id 51F70F0000B9 for ; Fri, 2 Jul 2021 10:32:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1625221955; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=T2CGRUW3oJPamYIsDdIUVn0g2vFuEx2hOo9bbcWDWv0=; b=I1tmvdM/ZZ4tn0Wa6m3ojSne/wheR8PRAtqb5Rl08mUFXXYRk7U0EniCJ+veQbaWYu7/61 9siXJk1TG4IR9lRZpV0nkxJ5zy+EV/mDMoNgMc/I8Y2ZRqhX4IP4D5WmnsF2VT5hcnY0Db +BNgLKG7Rg+FN8w++bTzBBeU6raa3T0= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-543-QWIE9XfjOMekfFrzfYZ24w-1; Fri, 02 Jul 2021 06:32:34 -0400 X-MC-Unique: QWIE9XfjOMekfFrzfYZ24w-1 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 7C62218414A1; Fri, 2 Jul 2021 10:32:32 +0000 (UTC) Received: from gshan.redhat.com (vpn2-54-119.bne.redhat.com [10.64.54.119]) by smtp.corp.redhat.com (Postfix) with ESMTP id 7687D4EF70; Fri, 2 Jul 2021 10:32:30 +0000 (UTC) From: Gavin Shan To: linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org, anshuman.khandual@arm.com, catalin.marinas@arm.com, will@kernel.org, akpm@linux-foundation.org, shan.gavin@gmail.com Subject: [PATCH] mm/debug_vm_pgtable: Fix corrupted PG_arch_1 by set_pmd_at() Date: Fri, 2 Jul 2021 18:32:25 +0800 Message-Id: <20210702103225.51448-1-gshan@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b="I1tmvdM/"; dmarc=pass (policy=none) header.from=redhat.com; spf=none (imf11.hostedemail.com: domain of gshan@redhat.com has no SPF policy when checking 216.205.24.124) smtp.mailfrom=gshan@redhat.com X-Rspamd-Server: rspam02 X-Stat-Signature: 98rcixq6nczysnw75bjyzd1knnhwrj13 X-Rspamd-Queue-Id: 51F70F0000B9 X-HE-Tag: 1625221956-257791 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: There are two addresses selected: random virtual address and physical address corresponding to kernel symbol @start_kernel. During the PMD tests in pmd_advanced_tests(), the physical address is aligned down to the starting address of the huge page, whose size is 512MB on ARM64 when we have 64KB base page size. After that, set_pmd_at() is called to populate the PMD entry. PG_arch_1, PG_dcache_clean on ARM64, is set to the page flags. Unforunately, the page, corresponding to the starting address of the huge page could be owned by buddy. It means PG_arch_1 can be unconditionally set to page owned by buddy. Afterwards, the page with PG_arch_1 set is fetched from buddy's free area list, but fails the checking. It leads to the following warning on ARM64: BUG: Bad page state in process memhog pfn:08000 page:0000000015c0a628 refcount:0 mapcount:0 \ mapping:0000000000000000 index:0x1 pfn:0x8000 flags: 0x7ffff8000000800(arch_1|node=0|zone=0|lastcpupid=0xfffff) raw: 07ffff8000000800 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag(s) set This fixes the issue by calling flush_dcache_page() after each call to set_{pud, pmd, pte}_at() because PG_arch_1 isn't needed in any case. Fixes: a5c3b9ffb0f4 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers") Cc: stable@vger.kernel.org # v5.9+ Signed-off-by: Gavin Shan Reported-by: kernel test robot Reported-by: kernel test robot --- mm/debug_vm_pgtable.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/mm/debug_vm_pgtable.c b/mm/debug_vm_pgtable.c index 92bfc37300df..7dedf6c6dd25 100644 --- a/mm/debug_vm_pgtable.c +++ b/mm/debug_vm_pgtable.c @@ -29,6 +29,8 @@ #include #include #include + +#include #include #include @@ -91,6 +93,7 @@ static void __init pte_advanced_tests(struct mm_struct *mm, unsigned long pfn, unsigned long vaddr, pgprot_t prot) { + struct page *page = pfn_to_page(pfn); pte_t pte = pfn_pte(pfn, prot); /* @@ -102,6 +105,7 @@ static void __init pte_advanced_tests(struct mm_struct *mm, pr_debug("Validating PTE advanced\n"); pte = pfn_pte(pfn, prot); set_pte_at(mm, vaddr, ptep, pte); + flush_dcache_page(page); ptep_set_wrprotect(mm, vaddr, ptep); pte = ptep_get(ptep); WARN_ON(pte_write(pte)); @@ -113,6 +117,7 @@ static void __init pte_advanced_tests(struct mm_struct *mm, pte = pte_wrprotect(pte); pte = pte_mkclean(pte); set_pte_at(mm, vaddr, ptep, pte); + flush_dcache_page(page); pte = pte_mkwrite(pte); pte = pte_mkdirty(pte); ptep_set_access_flags(vma, vaddr, ptep, pte, 1); @@ -125,6 +130,7 @@ static void __init pte_advanced_tests(struct mm_struct *mm, pte = pfn_pte(pfn, prot); pte = pte_mkyoung(pte); set_pte_at(mm, vaddr, ptep, pte); + flush_dcache_page(page); ptep_test_and_clear_young(vma, vaddr, ptep); pte = ptep_get(ptep); WARN_ON(pte_young(pte)); @@ -186,6 +192,7 @@ static void __init pmd_advanced_tests(struct mm_struct *mm, unsigned long pfn, unsigned long vaddr, pgprot_t prot, pgtable_t pgtable) { + struct page *page = pfn_to_page(pfn); pmd_t pmd; if (!has_transparent_hugepage()) @@ -199,6 +206,7 @@ static void __init pmd_advanced_tests(struct mm_struct *mm, pmd = pfn_pmd(pfn, prot); set_pmd_at(mm, vaddr, pmdp, pmd); + flush_dcache_page(page); pmdp_set_wrprotect(mm, vaddr, pmdp); pmd = READ_ONCE(*pmdp); WARN_ON(pmd_write(pmd)); @@ -210,6 +218,7 @@ static void __init pmd_advanced_tests(struct mm_struct *mm, pmd = pmd_wrprotect(pmd); pmd = pmd_mkclean(pmd); set_pmd_at(mm, vaddr, pmdp, pmd); + flush_dcache_page(page); pmd = pmd_mkwrite(pmd); pmd = pmd_mkdirty(pmd); pmdp_set_access_flags(vma, vaddr, pmdp, pmd, 1); @@ -222,6 +231,7 @@ static void __init pmd_advanced_tests(struct mm_struct *mm, pmd = pmd_mkhuge(pfn_pmd(pfn, prot)); pmd = pmd_mkyoung(pmd); set_pmd_at(mm, vaddr, pmdp, pmd); + flush_dcache_page(page); pmdp_test_and_clear_young(vma, vaddr, pmdp); pmd = READ_ONCE(*pmdp); WARN_ON(pmd_young(pmd)); @@ -334,6 +344,7 @@ static void __init pud_advanced_tests(struct mm_struct *mm, unsigned long pfn, unsigned long vaddr, pgprot_t prot) { + struct page *page = pfn_to_page(page); pud_t pud; if (!has_transparent_hugepage()) @@ -345,6 +356,7 @@ static void __init pud_advanced_tests(struct mm_struct *mm, pud = pfn_pud(pfn, prot); set_pud_at(mm, vaddr, pudp, pud); + flush_dcache_page(page); pudp_set_wrprotect(mm, vaddr, pudp); pud = READ_ONCE(*pudp); WARN_ON(pud_write(pud)); @@ -358,6 +370,7 @@ static void __init pud_advanced_tests(struct mm_struct *mm, pud = pud_wrprotect(pud); pud = pud_mkclean(pud); set_pud_at(mm, vaddr, pudp, pud); + flush_dcache_page(page); pud = pud_mkwrite(pud); pud = pud_mkdirty(pud); pudp_set_access_flags(vma, vaddr, pudp, pud, 1); @@ -373,6 +386,7 @@ static void __init pud_advanced_tests(struct mm_struct *mm, pud = pfn_pud(pfn, prot); pud = pud_mkyoung(pud); set_pud_at(mm, vaddr, pudp, pud); + flush_dcache_page(page); pudp_test_and_clear_young(vma, vaddr, pudp); pud = READ_ONCE(*pudp); WARN_ON(pud_young(pud)); @@ -604,6 +618,7 @@ static void __init pte_clear_tests(struct mm_struct *mm, pte_t *ptep, unsigned long pfn, unsigned long vaddr, pgprot_t prot) { + struct page *page = pfn_to_page(pfn); pte_t pte = pfn_pte(pfn, prot); pr_debug("Validating PTE clear\n"); @@ -611,6 +626,7 @@ static void __init pte_clear_tests(struct mm_struct *mm, pte_t *ptep, pte = __pte(pte_val(pte) | RANDOM_ORVALUE); #endif set_pte_at(mm, vaddr, ptep, pte); + flush_dcache_page(page); barrier(); pte_clear(mm, vaddr, ptep); pte = ptep_get(ptep);