In pmd/pud_advanced_tests(), the vaddr is aligned up to the next pmd/pud entry, and so it does not match the given pmdp/pudp and (aligned down) pfn any more.
For s390, this results in memory corruption, because the IDTE instruction used e.g. in xxx_get_and_clear() will take the vaddr for some calculations, in combination with the given pmdp. It will then end up with a wrong table origin, ending on ...ff8, and some of those wrongly set low-order bits will also select a wrong pagetable level for the index addition. IDTE could therefore invalidate (or 0x20) something outside of the page tables, depending on the wrongly picked index, which in turn depends on the random vaddr.
As result, we sometimes see "BUG task_struct (Not tainted): Padding overwritten" on s390, where one 0x5a padding value got overwritten with 0x7a.
Fix this by aligning down, similar to how the pmd/pud_aligned pfns are calculated.
Fixes: a5c3b9ffb0f40 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers") Cc: stable@vger.kernel.org # v5.9+ Signed-off-by: Gerald Schaefer gerald.schaefer@linux.ibm.com --- mm/debug_vm_pgtable.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mm/debug_vm_pgtable.c b/mm/debug_vm_pgtable.c index 6ff92c8b0a00..f7b23565a04f 100644 --- a/mm/debug_vm_pgtable.c +++ b/mm/debug_vm_pgtable.c @@ -193,7 +193,7 @@ static void __init pmd_advanced_tests(struct mm_struct *mm,
pr_debug("Validating PMD advanced\n"); /* Align the address wrt HPAGE_PMD_SIZE */ - vaddr = (vaddr & HPAGE_PMD_MASK) + HPAGE_PMD_SIZE; + vaddr &= HPAGE_PMD_MASK;
pgtable_trans_huge_deposit(mm, pmdp, pgtable);
@@ -318,7 +318,7 @@ static void __init pud_advanced_tests(struct mm_struct *mm,
pr_debug("Validating PUD advanced\n"); /* Align the address wrt HPAGE_PUD_SIZE */ - vaddr = (vaddr & HPAGE_PUD_MASK) + HPAGE_PUD_SIZE; + vaddr &= HPAGE_PUD_MASK;
pud = pfn_pud(pfn, prot); set_pud_at(mm, vaddr, pudp, pud);
On 5/25/21 6:30 PM, Gerald Schaefer wrote:
In pmd/pud_advanced_tests(), the vaddr is aligned up to the next pmd/pud entry, and so it does not match the given pmdp/pudp and (aligned down) pfn any more.
For s390, this results in memory corruption, because the IDTE instruction used e.g. in xxx_get_and_clear() will take the vaddr for some calculations, in combination with the given pmdp. It will then end up with a wrong table origin, ending on ...ff8, and some of those wrongly set low-order bits will also select a wrong pagetable level for the index addition. IDTE could therefore invalidate (or 0x20) something outside of the page tables, depending on the wrongly picked index, which in turn depends on the random vaddr.
As result, we sometimes see "BUG task_struct (Not tainted): Padding overwritten" on s390, where one 0x5a padding value got overwritten with 0x7a.
Fix this by aligning down, similar to how the pmd/pud_aligned pfns are calculated.
Fixes: a5c3b9ffb0f40 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers") Cc: stable@vger.kernel.org # v5.9+ Signed-off-by: Gerald Schaefer gerald.schaefer@linux.ibm.com
Did not see any problem on arm64 or x86, builds okay across all supported platforms. It would be great, if folks could test this on remaining platforms i.e arc, riscv etc.
+ Vineet Gupta vgupta@synopsys.com + Palmer Dabbelt palmer@dabbelt.com + Paul Walmsley paul.walmsley@sifive.com
Reviewed-by: Anshuman Khandual anshuman.khandual@arm.com
mm/debug_vm_pgtable.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mm/debug_vm_pgtable.c b/mm/debug_vm_pgtable.c index 6ff92c8b0a00..f7b23565a04f 100644 --- a/mm/debug_vm_pgtable.c +++ b/mm/debug_vm_pgtable.c @@ -193,7 +193,7 @@ static void __init pmd_advanced_tests(struct mm_struct *mm, pr_debug("Validating PMD advanced\n"); /* Align the address wrt HPAGE_PMD_SIZE */
- vaddr = (vaddr & HPAGE_PMD_MASK) + HPAGE_PMD_SIZE;
- vaddr &= HPAGE_PMD_MASK;
pgtable_trans_huge_deposit(mm, pmdp, pgtable); @@ -318,7 +318,7 @@ static void __init pud_advanced_tests(struct mm_struct *mm, pr_debug("Validating PUD advanced\n"); /* Align the address wrt HPAGE_PUD_SIZE */
- vaddr = (vaddr & HPAGE_PUD_MASK) + HPAGE_PUD_SIZE;
- vaddr &= HPAGE_PUD_MASK;
pud = pfn_pud(pfn, prot); set_pud_at(mm, vaddr, pudp, pud);
On Tue, May 25, 2021 at 4:03 PM Gerald Schaefer gerald.schaefer@linux.ibm.com wrote:
In pmd/pud_advanced_tests(), the vaddr is aligned up to the next pmd/pud entry, and so it does not match the given pmdp/pudp and (aligned down) pfn any more.
For s390, this results in memory corruption, because the IDTE instruction used e.g. in xxx_get_and_clear() will take the vaddr for some calculations, in combination with the given pmdp. It will then end up with a wrong table origin, ending on ...ff8, and some of those wrongly set low-order bits will also select a wrong pagetable level for the index addition. IDTE could therefore invalidate (or 0x20) something outside of the page tables, depending on the wrongly picked index, which in turn depends on the random vaddr.
As result, we sometimes see "BUG task_struct (Not tainted): Padding overwritten" on s390, where one 0x5a padding value got overwritten with 0x7a.
Fix this by aligning down, similar to how the pmd/pud_aligned pfns are calculated.
Fixes: a5c3b9ffb0f40 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers") Cc: stable@vger.kernel.org # v5.9+ Signed-off-by: Gerald Schaefer gerald.schaefer@linux.ibm.com
boot tested on sparc64 with quick run of stress-ng ( --class memory --sequential -1 --timeout 10s -v --pathological --oomable --metrics-brief ) stress-ng: debug: [371408] system: Linux ttip 5.13.0-rc3-00043-gad9f25d33860-dirty #218 SMP Wed May 26 11:55:54 MSK 2021 sparc64
Tested-by: Anatoly Pugachev matorola@gmail.com
On 5/26/21 4:57 PM, Anatoly Pugachev wrote:
On Tue, May 25, 2021 at 4:03 PM Gerald Schaefer gerald.schaefer@linux.ibm.com wrote:
In pmd/pud_advanced_tests(), the vaddr is aligned up to the next pmd/pud entry, and so it does not match the given pmdp/pudp and (aligned down) pfn any more.
For s390, this results in memory corruption, because the IDTE instruction used e.g. in xxx_get_and_clear() will take the vaddr for some calculations, in combination with the given pmdp. It will then end up with a wrong table origin, ending on ...ff8, and some of those wrongly set low-order bits will also select a wrong pagetable level for the index addition. IDTE could therefore invalidate (or 0x20) something outside of the page tables, depending on the wrongly picked index, which in turn depends on the random vaddr.
As result, we sometimes see "BUG task_struct (Not tainted): Padding overwritten" on s390, where one 0x5a padding value got overwritten with 0x7a.
Fix this by aligning down, similar to how the pmd/pud_aligned pfns are calculated.
Fixes: a5c3b9ffb0f40 ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers") Cc: stable@vger.kernel.org # v5.9+ Signed-off-by: Gerald Schaefer gerald.schaefer@linux.ibm.com
boot tested on sparc64 with quick run of stress-ng ( --class memory --sequential -1 --timeout 10s -v --pathological --oomable --metrics-brief ) stress-ng: debug: [371408] system: Linux ttip 5.13.0-rc3-00043-gad9f25d33860-dirty #218 SMP Wed May 26 11:55:54 MSK 2021 sparc64
Tested-by: Anatoly Pugachev matorola@gmail.com
spac64 does not enable ARCH_HAS_DEBUG_VM_PGTABLE, did you enable it before running the test ? Did the entire test debug_vm_pgtable() run successfully on sparc64 ?
On Wed, May 26, 2021 at 3:35 PM Anshuman Khandual anshuman.khandual@arm.com wrote:
spac64 does not enable ARCH_HAS_DEBUG_VM_PGTABLE, did you enable it before running the test ? Did the entire test debug_vm_pgtable() run successfully on sparc64 ?
Ahh.. Sorry for the noise then... Thought that CONFIG_TRANSPARENT_HUGEPAGE would be enough...
linux-stable-mirror@lists.linaro.org
-
Anatoly Pugachev -
Anshuman Khandual -
Gerald Schaefer