From: Sasha Levin <sasha.levin@oracle.com>
To: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Andrew Morton <akpm@linux-foundation.org>,
Mel Gorman <mgorman@suse.de>, Rik van Riel <riel@redhat.com>
Cc: Andi Kleen <ak@linux.intel.com>,
Matthew Wilcox <matthew.r.wilcox@intel.com>,
Dave Hansen <dave.hansen@linux.intel.com>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Dave Chinner <david@fromorbit.com>, Ning Qu <quning@gmail.com>,
linux-mm@kvack.org, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org, Dave Jones <davej@redhat.com>,
Andrey Ryabinin <a.ryabinin@samsung.com>
Subject: Re: [PATCHv3 1/2] mm: introduce vm_ops->map_pages()
Date: Thu, 24 Jul 2014 09:05:42 -0400 [thread overview]
Message-ID: <53D104A6.4050402@oracle.com> (raw)
In-Reply-To: <53D07E96.5000006@oracle.com>
On 07/23/2014 11:33 PM, Sasha Levin wrote:
> On 02/27/2014 02:53 PM, Kirill A. Shutemov wrote:
>> > The patch introduces new vm_ops callback ->map_pages() and uses it for
>> > mapping easy accessible pages around fault address.
>> >
>> > On read page fault, if filesystem provides ->map_pages(), we try to map
>> > up to FAULT_AROUND_PAGES pages around page fault address in hope to
>> > reduce number of minor page faults.
>> >
>> > We call ->map_pages first and use ->fault() as fallback if page by the
>> > offset is not ready to be mapped (cold page cache or something).
>> >
>> > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
>> > ---
> Hi all,
>
> This patch triggers use-after-free when fuzzing using trinity and the KASAN
> patchset.
FWIW, if it helps, here's another KASAN report with the conventional BUG following it:
[ 360.498001] ==================================================================
[ 360.500896] AddressSanitizer: use after free in do_read_fault.isra.40+0x3c2/0x510 at addr ffff880581ee3fd0
[ 360.504474] page:ffffea001607b8c0 count:0 mapcount:0 mapping: (null) index:0x0
[ 360.507264] page flags: 0xefffff80000000()
[ 360.508655] page dumped because: kasan error
[ 360.509489] CPU: 8 PID: 9251 Comm: trinity-c159 Not tainted 3.16.0-rc6-next-20140723-sasha-00047-g289342b-dirty #929
[ 360.511717] 00000000000000ff 0000000000000000 ffffea001607b8c0 ffff8801ba8bbb98
[ 360.513272] ffffffff8fe40903 ffff8801ba8bbc68 ffff8801ba8bbc58 ffffffff8b42acfc
[ 360.514729] 0000000000000001 ffff880592deaa48 ffff8801ba84b038 ffff8801ba8bbbd0
[ 360.516156] Call Trace:
[ 360.516622] dump_stack (lib/dump_stack.c:52)
[ 360.517566] kasan_report_error (mm/kasan/report.c:98 mm/kasan/report.c:166)
[ 360.518745] ? debug_smp_processor_id (lib/smp_processor_id.c:57)
[ 360.519923] ? preempt_count_sub (kernel/sched/core.c:2606)
[ 360.521124] ? put_lock_stats.isra.13 (./arch/x86/include/asm/preempt.h:98 kernel/locking/lockdep.c:254)
[ 360.522431] ? do_read_fault.isra.40 (mm/memory.c:2784 mm/memory.c:2849 mm/memory.c:2898)
[ 360.523651] __asan_load8 (mm/kasan/kasan.c:364)
[ 360.524625] ? do_read_fault.isra.40 (mm/memory.c:2864 mm/memory.c:2898)
[ 360.525887] do_read_fault.isra.40 (mm/memory.c:2864 mm/memory.c:2898)
[ 360.527156] ? __rcu_read_unlock (kernel/rcu/update.c:101)
[ 360.528251] handle_mm_fault (mm/memory.c:3092 mm/memory.c:3225 mm/memory.c:3345 mm/memory.c:3374)
[ 360.529308] ? vmacache_update (mm/vmacache.c:61)
[ 360.530505] ? find_vma (mm/mmap.c:2027)
[ 360.531453] __do_page_fault (arch/x86/mm/fault.c:1231)
[ 360.532503] ? context_tracking_user_exit (kernel/context_tracking.c:184)
[ 360.533744] ? __this_cpu_preempt_check (lib/smp_processor_id.c:63)
[ 360.535001] ? trace_hardirqs_off_caller (kernel/locking/lockdep.c:2639 (discriminator 8))
[ 360.536262] ? trace_hardirqs_off (kernel/locking/lockdep.c:2645)
[ 360.537360] trace_do_page_fault (arch/x86/mm/fault.c:1314 include/linux/jump_label.h:115 include/linux/context_tracking_state.h:27 include/linux/context_tracking.h:45 arch/x86/mm/fault.c:1315)
[ 360.538493] do_async_page_fault (arch/x86/kernel/kvm.c:279)
[ 360.539567] async_page_fault (arch/x86/kernel/entry_64.S:1321)
[ 360.540668] Read of size 8 by thread T9251:
[ 360.541485] Memory state around the buggy address:
[ 360.542463] ffff880581ee3d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 360.543816] ffff880581ee3d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 360.545116] ffff880581ee3e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 360.546476] ffff880581ee3e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 360.547806] ffff880581ee3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 360.549112] >ffff880581ee3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 360.550507] ^
[ 360.551574] ffff880581ee4000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 360.552910] ffff880581ee4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 360.554207] ffff880581ee4100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 360.555621] ffff880581ee4180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 360.557035] ffff880581ee4200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 360.558489] ==================================================================
[ 360.559804] BUG: unable to handle kernel paging request at ffff880581ee3fd0
[ 360.559817] IP: do_read_fault.isra.40 (mm/memory.c:2864 mm/memory.c:2898)
[ 360.559827] PGD 147b9067 PUD 70353d067 PMD 70352d067 PTE 8000000581ee3060
[ 360.559836] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 360.559892] Dumping ftrace buffer:
[ 360.560117] (ftrace buffer empty)
[ 360.560132] Modules linked in:
[ 360.560145] CPU: 8 PID: 9251 Comm: trinity-c159 Not tainted 3.16.0-rc6-next-20140723-sasha-00047-g289342b-dirty #929
[ 360.560154] task: ffff8801ba84b000 ti: ffff8801ba8b8000 task.ti: ffff8801ba8b8000
[ 360.560172] RIP: do_read_fault.isra.40 (mm/memory.c:2864 mm/memory.c:2898)
[ 360.560180] RSP: 0000:ffff8801ba8bbc98 EFLAGS: 00010296
[ 360.560186] RAX: 0000000000000000 RBX: ffff8801ba8d5a00 RCX: 0000000000000006
[ 360.560192] RDX: 0000000000000006 RSI: ffffffff912f5fd5 RDI: 0000000000000282
[ 360.560199] RBP: ffff8801ba8bbd58 R08: 0000000000000001 R09: 0000000000000000
[ 360.560206] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801ba8ad470
[ 360.560213] R13: 00007f2411bfa000 R14: 0000000000000000 R15: ffff880581ee3fd0
[ 360.560222] FS: 00007f2412de6700(0000) GS:ffff8801de000000(0000) knlGS:0000000000000000
[ 360.560228] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 360.560234] CR2: ffff880581ee3fd0 CR3: 00000001ba89b000 CR4: 00000000000006a0
[ 360.560255] DR0: 00000000006ec000 DR1: 0000000000000000 DR2: 0000000000000000
[ 360.560262] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 00000000000d0602
[ 360.560264] Stack:
[ 360.560278] 0000000000000001 0000000000000000 ffff880581ee4030 ffff880592deaa30
[ 360.560290] 0000000000000005 00007f2411c07000 ffff8801ba8d5a90 ffff880592deaa30
[ 360.560297] 0000000000000000 000000a8ba84b038 000000000000000c 00007f2411c06220
[ 360.560299] Call Trace:
[ 360.560317] ? __rcu_read_unlock (kernel/rcu/update.c:101)
[ 360.560332] handle_mm_fault (mm/memory.c:3092 mm/memory.c:3225 mm/memory.c:3345 mm/memory.c:3374)
[ 360.560345] ? vmacache_update (mm/vmacache.c:61)
[ 360.560358] ? find_vma (mm/mmap.c:2027)
[ 360.560370] __do_page_fault (arch/x86/mm/fault.c:1231)
[ 360.560386] ? context_tracking_user_exit (kernel/context_tracking.c:184)
[ 360.560400] ? __this_cpu_preempt_check (lib/smp_processor_id.c:63)
[ 360.560413] ? trace_hardirqs_off_caller (kernel/locking/lockdep.c:2639 (discriminator 8))
[ 360.560425] ? trace_hardirqs_off (kernel/locking/lockdep.c:2645)
[ 360.560432] trace_do_page_fault (arch/x86/mm/fault.c:1314 include/linux/jump_label.h:115 include/linux/context_tracking_state.h:27 include/linux/context_tracking.h:45 arch/x86/mm/fault.c:1315)
[ 360.560440] do_async_page_fault (arch/x86/kernel/kvm.c:279)
[ 360.560447] async_page_fault (arch/x86/kernel/entry_64.S:1321)
[ 360.560458] Code: 47 f9 48 8b 8d 68 ff ff ff 48 29 f1 48 c1 e9 0c 49 8d 44 08 ff 48 39 c7 48 0f 46 c7 4c 89 ff 48 89 85 60 ff ff ff e8 3e 19 07 00 <49> 83 3f 00 0f 84 8f 00 00 00 49 83 c6 01 4c 39 b5 60 ff ff ff
All code
========
0: 47 f9 rex.RXB stc
2: 48 8b 8d 68 ff ff ff mov -0x98(%rbp),%rcx
9: 48 29 f1 sub %rsi,%rcx
c: 48 c1 e9 0c shr $0xc,%rcx
10: 49 8d 44 08 ff lea -0x1(%r8,%rcx,1),%rax
15: 48 39 c7 cmp %rax,%rdi
18: 48 0f 46 c7 cmovbe %rdi,%rax
1c: 4c 89 ff mov %r15,%rdi
1f: 48 89 85 60 ff ff ff mov %rax,-0xa0(%rbp)
26: e8 3e 19 07 00 callq 0x71969
2b:* 49 83 3f 00 cmpq $0x0,(%r15) <-- trapping instruction
2f: 0f 84 8f 00 00 00 je 0xc4
35: 49 83 c6 01 add $0x1,%r14
39: 4c 39 b5 60 ff ff ff cmp %r14,-0xa0(%rbp)
...
Code starting with the faulting instruction
===========================================
0: 49 83 3f 00 cmpq $0x0,(%r15)
4: 0f 84 8f 00 00 00 je 0x99
a: 49 83 c6 01 add $0x1,%r14
e: 4c 39 b5 60 ff ff ff cmp %r14,-0xa0(%rbp)
...
[ 360.560458] RIP do_read_fault.isra.40 (mm/memory.c:2864 mm/memory.c:2898)
[ 360.560458] RSP <ffff8801ba8bbc98>
[ 360.560458] CR2: ffff880581ee3fd0
[ 360.560458] ---[ end trace ccd7cee352be7945 ]---
Thanks,
Sasha
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sasha.levin@oracle.com>
To: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Andrew Morton <akpm@linux-foundation.org>,
Mel Gorman <mgorman@suse.de>, Rik van Riel <riel@redhat.com>
Cc: Andi Kleen <ak@linux.intel.com>,
Matthew Wilcox <matthew.r.wilcox@intel.com>,
Dave Hansen <dave.hansen@linux.intel.com>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Dave Chinner <david@fromorbit.com>, Ning Qu <quning@gmail.com>,
linux-mm@kvack.org, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org, Dave Jones <davej@redhat.com>,
Andrey Ryabinin <a.ryabinin@samsung.com>
Subject: Re: [PATCHv3 1/2] mm: introduce vm_ops->map_pages()
Date: Thu, 24 Jul 2014 09:05:42 -0400 [thread overview]
Message-ID: <53D104A6.4050402@oracle.com> (raw)
In-Reply-To: <53D07E96.5000006@oracle.com>
On 07/23/2014 11:33 PM, Sasha Levin wrote:
> On 02/27/2014 02:53 PM, Kirill A. Shutemov wrote:
>> > The patch introduces new vm_ops callback ->map_pages() and uses it for
>> > mapping easy accessible pages around fault address.
>> >
>> > On read page fault, if filesystem provides ->map_pages(), we try to map
>> > up to FAULT_AROUND_PAGES pages around page fault address in hope to
>> > reduce number of minor page faults.
>> >
>> > We call ->map_pages first and use ->fault() as fallback if page by the
>> > offset is not ready to be mapped (cold page cache or something).
>> >
>> > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
>> > ---
> Hi all,
>
> This patch triggers use-after-free when fuzzing using trinity and the KASAN
> patchset.
FWIW, if it helps, here's another KASAN report with the conventional BUG following it:
[ 360.498001] ==================================================================
[ 360.500896] AddressSanitizer: use after free in do_read_fault.isra.40+0x3c2/0x510 at addr ffff880581ee3fd0
[ 360.504474] page:ffffea001607b8c0 count:0 mapcount:0 mapping: (null) index:0x0
[ 360.507264] page flags: 0xefffff80000000()
[ 360.508655] page dumped because: kasan error
[ 360.509489] CPU: 8 PID: 9251 Comm: trinity-c159 Not tainted 3.16.0-rc6-next-20140723-sasha-00047-g289342b-dirty #929
[ 360.511717] 00000000000000ff 0000000000000000 ffffea001607b8c0 ffff8801ba8bbb98
[ 360.513272] ffffffff8fe40903 ffff8801ba8bbc68 ffff8801ba8bbc58 ffffffff8b42acfc
[ 360.514729] 0000000000000001 ffff880592deaa48 ffff8801ba84b038 ffff8801ba8bbbd0
[ 360.516156] Call Trace:
[ 360.516622] dump_stack (lib/dump_stack.c:52)
[ 360.517566] kasan_report_error (mm/kasan/report.c:98 mm/kasan/report.c:166)
[ 360.518745] ? debug_smp_processor_id (lib/smp_processor_id.c:57)
[ 360.519923] ? preempt_count_sub (kernel/sched/core.c:2606)
[ 360.521124] ? put_lock_stats.isra.13 (./arch/x86/include/asm/preempt.h:98 kernel/locking/lockdep.c:254)
[ 360.522431] ? do_read_fault.isra.40 (mm/memory.c:2784 mm/memory.c:2849 mm/memory.c:2898)
[ 360.523651] __asan_load8 (mm/kasan/kasan.c:364)
[ 360.524625] ? do_read_fault.isra.40 (mm/memory.c:2864 mm/memory.c:2898)
[ 360.525887] do_read_fault.isra.40 (mm/memory.c:2864 mm/memory.c:2898)
[ 360.527156] ? __rcu_read_unlock (kernel/rcu/update.c:101)
[ 360.528251] handle_mm_fault (mm/memory.c:3092 mm/memory.c:3225 mm/memory.c:3345 mm/memory.c:3374)
[ 360.529308] ? vmacache_update (mm/vmacache.c:61)
[ 360.530505] ? find_vma (mm/mmap.c:2027)
[ 360.531453] __do_page_fault (arch/x86/mm/fault.c:1231)
[ 360.532503] ? context_tracking_user_exit (kernel/context_tracking.c:184)
[ 360.533744] ? __this_cpu_preempt_check (lib/smp_processor_id.c:63)
[ 360.535001] ? trace_hardirqs_off_caller (kernel/locking/lockdep.c:2639 (discriminator 8))
[ 360.536262] ? trace_hardirqs_off (kernel/locking/lockdep.c:2645)
[ 360.537360] trace_do_page_fault (arch/x86/mm/fault.c:1314 include/linux/jump_label.h:115 include/linux/context_tracking_state.h:27 include/linux/context_tracking.h:45 arch/x86/mm/fault.c:1315)
[ 360.538493] do_async_page_fault (arch/x86/kernel/kvm.c:279)
[ 360.539567] async_page_fault (arch/x86/kernel/entry_64.S:1321)
[ 360.540668] Read of size 8 by thread T9251:
[ 360.541485] Memory state around the buggy address:
[ 360.542463] ffff880581ee3d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 360.543816] ffff880581ee3d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 360.545116] ffff880581ee3e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 360.546476] ffff880581ee3e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 360.547806] ffff880581ee3f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 360.549112] >ffff880581ee3f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 360.550507] ^
[ 360.551574] ffff880581ee4000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 360.552910] ffff880581ee4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 360.554207] ffff880581ee4100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 360.555621] ffff880581ee4180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 360.557035] ffff880581ee4200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 360.558489] ==================================================================
[ 360.559804] BUG: unable to handle kernel paging request at ffff880581ee3fd0
[ 360.559817] IP: do_read_fault.isra.40 (mm/memory.c:2864 mm/memory.c:2898)
[ 360.559827] PGD 147b9067 PUD 70353d067 PMD 70352d067 PTE 8000000581ee3060
[ 360.559836] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 360.559892] Dumping ftrace buffer:
[ 360.560117] (ftrace buffer empty)
[ 360.560132] Modules linked in:
[ 360.560145] CPU: 8 PID: 9251 Comm: trinity-c159 Not tainted 3.16.0-rc6-next-20140723-sasha-00047-g289342b-dirty #929
[ 360.560154] task: ffff8801ba84b000 ti: ffff8801ba8b8000 task.ti: ffff8801ba8b8000
[ 360.560172] RIP: do_read_fault.isra.40 (mm/memory.c:2864 mm/memory.c:2898)
[ 360.560180] RSP: 0000:ffff8801ba8bbc98 EFLAGS: 00010296
[ 360.560186] RAX: 0000000000000000 RBX: ffff8801ba8d5a00 RCX: 0000000000000006
[ 360.560192] RDX: 0000000000000006 RSI: ffffffff912f5fd5 RDI: 0000000000000282
[ 360.560199] RBP: ffff8801ba8bbd58 R08: 0000000000000001 R09: 0000000000000000
[ 360.560206] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801ba8ad470
[ 360.560213] R13: 00007f2411bfa000 R14: 0000000000000000 R15: ffff880581ee3fd0
[ 360.560222] FS: 00007f2412de6700(0000) GS:ffff8801de000000(0000) knlGS:0000000000000000
[ 360.560228] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 360.560234] CR2: ffff880581ee3fd0 CR3: 00000001ba89b000 CR4: 00000000000006a0
[ 360.560255] DR0: 00000000006ec000 DR1: 0000000000000000 DR2: 0000000000000000
[ 360.560262] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 00000000000d0602
[ 360.560264] Stack:
[ 360.560278] 0000000000000001 0000000000000000 ffff880581ee4030 ffff880592deaa30
[ 360.560290] 0000000000000005 00007f2411c07000 ffff8801ba8d5a90 ffff880592deaa30
[ 360.560297] 0000000000000000 000000a8ba84b038 000000000000000c 00007f2411c06220
[ 360.560299] Call Trace:
[ 360.560317] ? __rcu_read_unlock (kernel/rcu/update.c:101)
[ 360.560332] handle_mm_fault (mm/memory.c:3092 mm/memory.c:3225 mm/memory.c:3345 mm/memory.c:3374)
[ 360.560345] ? vmacache_update (mm/vmacache.c:61)
[ 360.560358] ? find_vma (mm/mmap.c:2027)
[ 360.560370] __do_page_fault (arch/x86/mm/fault.c:1231)
[ 360.560386] ? context_tracking_user_exit (kernel/context_tracking.c:184)
[ 360.560400] ? __this_cpu_preempt_check (lib/smp_processor_id.c:63)
[ 360.560413] ? trace_hardirqs_off_caller (kernel/locking/lockdep.c:2639 (discriminator 8))
[ 360.560425] ? trace_hardirqs_off (kernel/locking/lockdep.c:2645)
[ 360.560432] trace_do_page_fault (arch/x86/mm/fault.c:1314 include/linux/jump_label.h:115 include/linux/context_tracking_state.h:27 include/linux/context_tracking.h:45 arch/x86/mm/fault.c:1315)
[ 360.560440] do_async_page_fault (arch/x86/kernel/kvm.c:279)
[ 360.560447] async_page_fault (arch/x86/kernel/entry_64.S:1321)
[ 360.560458] Code: 47 f9 48 8b 8d 68 ff ff ff 48 29 f1 48 c1 e9 0c 49 8d 44 08 ff 48 39 c7 48 0f 46 c7 4c 89 ff 48 89 85 60 ff ff ff e8 3e 19 07 00 <49> 83 3f 00 0f 84 8f 00 00 00 49 83 c6 01 4c 39 b5 60 ff ff ff
All code
========
0: 47 f9 rex.RXB stc
2: 48 8b 8d 68 ff ff ff mov -0x98(%rbp),%rcx
9: 48 29 f1 sub %rsi,%rcx
c: 48 c1 e9 0c shr $0xc,%rcx
10: 49 8d 44 08 ff lea -0x1(%r8,%rcx,1),%rax
15: 48 39 c7 cmp %rax,%rdi
18: 48 0f 46 c7 cmovbe %rdi,%rax
1c: 4c 89 ff mov %r15,%rdi
1f: 48 89 85 60 ff ff ff mov %rax,-0xa0(%rbp)
26: e8 3e 19 07 00 callq 0x71969
2b:* 49 83 3f 00 cmpq $0x0,(%r15) <-- trapping instruction
2f: 0f 84 8f 00 00 00 je 0xc4
35: 49 83 c6 01 add $0x1,%r14
39: 4c 39 b5 60 ff ff ff cmp %r14,-0xa0(%rbp)
...
Code starting with the faulting instruction
===========================================
0: 49 83 3f 00 cmpq $0x0,(%r15)
4: 0f 84 8f 00 00 00 je 0x99
a: 49 83 c6 01 add $0x1,%r14
e: 4c 39 b5 60 ff ff ff cmp %r14,-0xa0(%rbp)
...
[ 360.560458] RIP do_read_fault.isra.40 (mm/memory.c:2864 mm/memory.c:2898)
[ 360.560458] RSP <ffff8801ba8bbc98>
[ 360.560458] CR2: ffff880581ee3fd0
[ 360.560458] ---[ end trace ccd7cee352be7945 ]---
Thanks,
Sasha
next prev parent reply other threads:[~2014-07-24 13:05 UTC|newest]
Thread overview: 73+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-02-27 19:53 [PATCHv3 0/2] mm: map few pages around fault address if they are in page cache Kirill A. Shutemov
2014-02-27 19:53 ` Kirill A. Shutemov
2014-02-27 19:53 ` [PATCHv3 1/2] mm: introduce vm_ops->map_pages() Kirill A. Shutemov
2014-02-27 19:53 ` Kirill A. Shutemov
2014-02-27 21:59 ` Dave Hansen
2014-02-27 21:59 ` Dave Hansen
2014-02-27 22:06 ` Linus Torvalds
2014-02-27 22:06 ` Linus Torvalds
2014-02-27 22:34 ` Dave Hansen
2014-02-27 22:34 ` Dave Hansen
2014-02-28 0:18 ` Kirill A. Shutemov
2014-02-28 0:18 ` Kirill A. Shutemov
2014-02-28 11:50 ` Benjamin Herrenschmidt
2014-02-28 11:50 ` Benjamin Herrenschmidt
2014-02-27 22:08 ` Andrew Morton
2014-02-27 22:08 ` Andrew Morton
2014-03-03 23:16 ` Andrew Morton
2014-03-04 1:26 ` Kirill A. Shutemov
2014-03-04 1:26 ` Kirill A. Shutemov
2014-03-04 1:26 ` Kirill A. Shutemov
2014-03-05 0:04 ` Rusty Russell
2014-03-05 0:04 ` Rusty Russell
2014-03-05 20:02 ` Andrew Morton
2014-03-05 20:02 ` Andrew Morton
2014-07-24 3:33 ` Sasha Levin
2014-07-24 3:33 ` Sasha Levin
2014-07-24 6:53 ` Andrey Ryabinin
2014-07-24 6:53 ` Andrey Ryabinin
2014-07-24 12:48 ` Sasha Levin
2014-07-24 12:48 ` Sasha Levin
2014-07-24 13:05 ` Sasha Levin [this message]
2014-07-24 13:05 ` Sasha Levin
2014-07-24 13:30 ` Konstantin Khlebnikov
2014-07-24 13:30 ` Konstantin Khlebnikov
2014-07-28 7:43 ` [PATCH] mm: don't allow fault_around_bytes to be 0 Andrey Ryabinin
2014-07-28 7:43 ` Andrey Ryabinin
2014-07-28 7:47 ` Andrey Ryabinin
2014-07-28 7:47 ` Andrey Ryabinin
2014-07-28 9:36 ` Kirill A. Shutemov
2014-07-28 9:36 ` Kirill A. Shutemov
2014-07-28 9:36 ` Kirill A. Shutemov
2014-07-28 10:27 ` Andrey Ryabinin
2014-07-28 10:27 ` Andrey Ryabinin
2014-07-28 10:27 ` Andrey Ryabinin
2014-07-28 10:27 ` Andrey Ryabinin
2014-07-28 10:52 ` Kirill A. Shutemov
2014-07-28 10:52 ` Kirill A. Shutemov
2014-07-28 12:32 ` Sasha Levin
2014-07-28 12:32 ` Sasha Levin
2014-07-28 22:43 ` David Rientjes
2014-07-28 22:43 ` David Rientjes
2014-07-28 15:26 ` Dave Hansen
2014-07-28 15:26 ` Dave Hansen
2014-02-27 19:53 ` [PATCHv3 2/2] mm: implement ->map_pages for page cache Kirill A. Shutemov
2014-02-27 19:53 ` Kirill A. Shutemov
2014-02-27 21:47 ` Andrew Morton
2014-02-27 21:47 ` Andrew Morton
2014-02-28 0:31 ` Kirill A. Shutemov
2014-02-28 0:31 ` Kirill A. Shutemov
2014-04-02 18:03 ` Konstantin Khlebnikov
2014-04-02 18:03 ` Konstantin Khlebnikov
2014-04-02 19:07 ` Kirill A. Shutemov
2014-04-02 19:07 ` Kirill A. Shutemov
2014-02-27 21:28 ` [PATCHv3 0/2] mm: map few pages around fault address if they are in " Linus Torvalds
2014-02-27 21:28 ` Linus Torvalds
2014-02-28 0:10 ` Kirill A. Shutemov
2014-02-28 0:10 ` Kirill A. Shutemov
2014-02-28 3:52 ` Wilcox, Matthew R
2014-02-28 3:52 ` Wilcox, Matthew R
2014-02-28 23:08 ` Linus Torvalds
2014-02-28 23:08 ` Linus Torvalds
2014-03-12 14:22 ` Kirill A. Shutemov
2014-03-12 14:22 ` Kirill A. Shutemov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=53D104A6.4050402@oracle.com \
--to=sasha.levin@oracle.com \
--cc=a.ryabinin@samsung.com \
--cc=ak@linux.intel.com \
--cc=akpm@linux-foundation.org \
--cc=dave.hansen@linux.intel.com \
--cc=davej@redhat.com \
--cc=david@fromorbit.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=matthew.r.wilcox@intel.com \
--cc=mgorman@suse.de \
--cc=quning@gmail.com \
--cc=riel@redhat.com \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.