From patchwork Thu Oct 6 01:56:31 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "zhaoyang.huang" X-Patchwork-Id: 12999786 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA6A3C433FE for ; Thu, 6 Oct 2022 01:57:46 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 22B876B0071; Wed, 5 Oct 2022 21:57:46 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 1B5236B0073; Wed, 5 Oct 2022 21:57:46 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 054DC6B0074; Wed, 5 Oct 2022 21:57:45 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id D1BFE6B0071 for ; Wed, 5 Oct 2022 21:57:45 -0400 (EDT) Received: from smtpin20.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 92C3712030A for ; Thu, 6 Oct 2022 01:57:45 +0000 (UTC) X-FDA: 79988863290.20.808CBCB Received: from SHSQR01.spreadtrum.com (mx1.unisoc.com [222.66.158.135]) by imf07.hostedemail.com (Postfix) with ESMTP id 1F0BB40003 for ; Thu, 6 Oct 2022 01:57:43 +0000 (UTC) Received: from SHSend.spreadtrum.com (bjmbx01.spreadtrum.com [10.0.64.7]) by SHSQR01.spreadtrum.com with ESMTPS id 2961uqJF099174 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NO); Thu, 6 Oct 2022 09:56:52 +0800 (CST) (envelope-from zhaoyang.huang@unisoc.com) Received: from bj03382pcu.spreadtrum.com (10.0.74.65) by BJMBX01.spreadtrum.com (10.0.64.7) with Microsoft SMTP Server (TLS) id 15.0.1497.23; Thu, 6 Oct 2022 09:56:51 +0800 From: "zhaoyang.huang" To: Andrew Morton , Catalin Marinas , Matthew Wilcox , Vlastimil Babka , Marco Elver , Imran Khan , Dmitry Vyukov , Zhaoyang Huang , , , , Subject: [PATCH] lib: check if stack_table valid in __stack_depot_save Date: Thu, 6 Oct 2022 09:56:31 +0800 Message-ID: <1665021391-1035-1-git-send-email-zhaoyang.huang@unisoc.com> X-Mailer: git-send-email 1.9.1 MIME-Version: 1.0 X-Originating-IP: [10.0.74.65] X-ClientProxiedBy: SHCAS01.spreadtrum.com (10.0.1.201) To BJMBX01.spreadtrum.com (10.0.64.7) X-MAIL: SHSQR01.spreadtrum.com 2961uqJF099174 ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1665021465; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding:in-reply-to: references; bh=X5a2SDhipC/Akuq0cheibreYcsM3TH/BEdf4fQcdSmE=; b=oNax9qRp+GytoP/q2vJncMVG1Pw5Wz2tMfE4yodO4JTjZjFNdG+8wf5Lg2cZS60bMcYGGS ZrSoxuE11w96t3W70/4TkEJbZi0pK+JihLGIuPH4DIw/WVKi1at2Fv4/ydBP0EWA4sjCIn S1KiokJgXPuqwBNnVR+TbwOENN0Vl0g= ARC-Authentication-Results: i=1; imf07.hostedemail.com; dkim=none; spf=pass (imf07.hostedemail.com: domain of zhaoyang.huang@unisoc.com designates 222.66.158.135 as permitted sender) smtp.mailfrom=zhaoyang.huang@unisoc.com; dmarc=none ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1665021465; a=rsa-sha256; cv=none; b=g+vip9sfEv9B7oV1eJ0s8OBWF7DaLyLla73MM1K/utNa4m116MWrAjwYEWaoMXqywzCaZw IOnOoWkpJA0QD0XTejpSoD/IVJRJjFnhTg4VJE2uyYZ9DvUdAU4o6jmYbAuxzQrjm/yd8p h2WAqW+DlA/7UMwDmqCWZRNmqJn5VrI= X-Rspamd-Queue-Id: 1F0BB40003 Authentication-Results: imf07.hostedemail.com; dkim=none; spf=pass (imf07.hostedemail.com: domain of zhaoyang.huang@unisoc.com designates 222.66.158.135 as permitted sender) smtp.mailfrom=zhaoyang.huang@unisoc.com; dmarc=none X-Rspamd-Server: rspam06 X-Rspam-User: X-Stat-Signature: osuc3srhfbfhckyi88xggj338yijnkss X-HE-Tag: 1665021463-493794 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Zhaoyang Huang NULL pointer reported in below lkp test report which should caused by invalid stack_table in very early stage before stack_depot_early_init called. I would like have kmemleak use stackdepot to track backtrace in this commit which lead to stack hash access before stackdepot is initialized. Add stack_table as extra criteria in __stack_depot_save's entry check. commit: a65edf711f97a0a3764fc04b0301ab2e073992db ("[PATCH] mm: use stack_depot for recording kmemleak's backtrace") url: https://github.com/intel-lab-lkp/linux/commits/zhaoyang-huang/mm-use-stack_depot-for-recording-kmemleak-s-backtrace/20220929-183243 base: https://git.kernel.org/cgit/linux/kernel/git/akpm/mm.git mm-everything patch link: https://lore.kernel.org/linux-mm/1664447407-8821-1-git-send-email-zhaoyang.huang@unisoc.com in testcase: boot on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace): [ 0.191645][ T0] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 0.192360][ T0] #PF: supervisor read access in kernel mode [ 0.192862][ T0] #PF: error_code(0x0000) - not-present page [ 0.193371][ T0] PGD 0 P4D 0 [ 0.193672][ T0] Oops: 0000 [#1] SMP PTI [ 0.194051][ T0] CPU: 0 PID: 0 Comm: swapper Not tainted 6.0.0-rc3-00706-ga65edf711f97 #26 [ 0.194755][ T0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014 [ 0.195583][ T0] RIP: 0010:__stack_depot_save (kbuild/src/x86_64-2/lib/stackdepot.c:452) [ 0.196081][ T0] Code: 03 48 c7 c7 ec 17 b3 84 e8 f1 ea 85 ff 44 89 e0 23 05 d4 aa 01 03 48 8d 04 c3 48 89 c3 48 89 c7 48 89 44 24 28 e8 34 fc 85 ff <4c> 8b 33 4d 85 f6 0f 84 b6 00 00 00 8b 04 24 83 e8 01 48 8d 04 c5 All code ======== 0: 03 48 c7 add -0x39(%rax),%ecx 3: c7 (bad) 4: ec in (%dx),%al 5: 17 (bad) 6: b3 84 mov $0x84,%bl 8: e8 f1 ea 85 ff callq 0xffffffffff85eafe d: 44 89 e0 mov %r12d,%eax 10: 23 05 d4 aa 01 03 and 0x301aad4(%rip),%eax # 0x301aaea 16: 48 8d 04 c3 lea (%rbx,%rax,8),%rax 1a: 48 89 c3 mov %rax,%rbx 1d: 48 89 c7 mov %rax,%rdi 20: 48 89 44 24 28 mov %rax,0x28(%rsp) 25: e8 34 fc 85 ff callq 0xffffffffff85fc5e 2a:* 4c 8b 33 mov (%rbx),%r14 <-- trapping instruction 2d: 4d 85 f6 test %r14,%r14 30: 0f 84 b6 00 00 00 je 0xec 36: 8b 04 24 mov (%rsp),%eax 39: 83 e8 01 sub $0x1,%eax 3c: 48 rex.W 3d: 8d .byte 0x8d 3e: 04 c5 add $0xc5,%al Code starting with the faulting instruction =========================================== 0: 4c 8b 33 mov (%rbx),%r14 3: 4d 85 f6 test %r14,%r14 6: 0f 84 b6 00 00 00 je 0xc2 c: 8b 04 24 mov (%rsp),%eax f: 83 e8 01 sub $0x1,%eax 12: 48 rex.W 13: 8d .byte 0x8d 14: 04 c5 add $0xc5,%al [ 0.197693][ T0] RSP: 0000:ffffffff83603ca8 EFLAGS: 00010046 [ 0.198214][ T0] RAX: ffffffff83613cd8 RBX: 0000000000000000 RCX: ffffffff81b16d2c [ 0.198858][ T0] RDX: 0000000000000b1e RSI: 0000000000000000 RDI: 0000000000000000 [ 0.199499][ T0] RBP: 00000000c5a6b597 R08: ffffffff8479d118 R09: 0000000000000000 [ 0.200142][ T0] R10: 0000000000000004 R11: 0001ffffffffffff R12: 0000000027b2cd0a [ 0.200787][ T0] R13: 0000000000000003 R14: 000000004954f68c R15: ffffffff83603d54 [ 0.201488][ T0] FS: 0000000000000000(0000) GS:ffffffff842c9000(0000) knlGS:0000000000000000 [ 0.202247][ T0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.202807][ T0] CR2: 0000000000000000 CR3: 000000000360a000 CR4: 00000000000406b0 [ 0.203470][ T0] Call Trace: [ 0.203748][ T0] [ 0.203996][ T0] stack_depot_save (kbuild/src/x86_64-2/lib/stackdepot.c:534) [ 0.204406][ T0] set_track_prepare (kbuild/src/x86_64-2/mm/slub.c:752) [ 0.204816][ T0] ? memblock_alloc_range_nid (kbuild/src/x86_64-2/mm/memblock.c:1424) [ 0.205311][ T0] ? memblock_alloc_internal (kbuild/src/x86_64-2/mm/memblock.c:1514) [ 0.205781][ T0] ? memblock_alloc_try_nid (kbuild/src/x86_64-2/mm/memblock.c:1614 (discriminator 3)) [ 0.206238][ T0] ? setup_command_line (kbuild/src/x86_64-2/init/main.c:631) [ 0.206670][ T0] ? start_kernel (kbuild/src/x86_64-2/init/main.c:965) [ 0.207068][ T0] ? secondary_startup_64_no_verify (kbuild/src/x86_64-2/arch/x86/kernel/head_64.S:358) [ 0.207612][ T0] ? __raw_callee_save___native_queued_spin_unlock (??:?) [ 0.208251][ T0] ? write_comp_data (kbuild/src/x86_64-2/kernel/kcov.c:236) [ 0.208678][ T0] ? strncpy (kbuild/src/x86_64-2/lib/string.c:115) [ 0.209040][ T0] __create_object (kbuild/src/x86_64-2/mm/kmemleak.c:681) [ 0.209447][ T0] kmemleak_alloc_phys (kbuild/src/x86_64-2/mm/kmemleak.c:1212) [ 0.209867][ T0] memblock_alloc_range_nid (kbuild/src/x86_64-2/mm/memblock.c:1424) [ 0.210344][ T0] memblock_alloc_internal (kbuild/src/x86_64-2/mm/memblock.c:1514) [ 0.210806][ T0] memblock_alloc_try_nid (kbuild/src/x86_64-2/mm/memblock.c:1614 (discriminator 3)) [ 0.211255][ T0] setup_command_line (kbuild/src/x86_64-2/init/main.c:631) [ 0.211678][ T0] start_kernel (kbuild/src/x86_64-2/init/main.c:965) [ 0.212063][ T0] ? load_ucode_bsp (kbuild/src/x86_64-2/arch/x86/kernel/cpu/microcode/core.c:176) [ 0.212483][ T0] secondary_startup_64_no_verify (kbuild/src/x86_64-2/arch/x86/kernel/head_64.S:358) [ 0.212996][ T0] [ 0.213247][ T0] Modules linked in: [ 0.213591][ T0] CR2: 0000000000000000 [ 0.213955][ T0] ---[ end trace 0000000000000000 ]--- [ 0.214415][ T0] RIP: 0010:__stack_depot_save (kbuild/src/x86_64-2/lib/stackdepot.c:452) [ 0.214933][ T0] Code: 03 48 c7 c7 ec 17 b3 84 e8 f1 ea 85 ff 44 89 e0 23 05 d4 aa 01 03 48 8d 04 c3 48 89 c3 48 89 c7 48 89 44 24 28 e8 34 fc 85 ff <4c> 8b 33 4d 85 f6 0f 84 b6 00 00 00 8b 04 24 83 e8 01 48 8d 04 c5 Signed-off-by: Zhaoyang Huang --- lib/stackdepot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/stackdepot.c b/lib/stackdepot.c index e73fda2..97b6a2a 100644 --- a/lib/stackdepot.c +++ b/lib/stackdepot.c @@ -421,7 +421,7 @@ depot_stack_handle_t __stack_depot_save(unsigned long *entries, */ nr_entries = filter_irq_stacks(entries, nr_entries); - if (unlikely(nr_entries == 0) || stack_depot_disable) + if (unlikely(nr_entries == 0) || stack_depot_disable || !stack_table) goto fast_exit; hash = hash_stack(entries, nr_entries);