mm/v9fs: kernel panic accessing kmap()ed pages

[Sasha Levin <sasha.levin@oracle.com>]

Hi all,

While fuzzing with trinity inside a KVM tools guest running the latest -next
kernel, I've stumbled on the following spew:

[12886.637991] BUG: unable to handle kernel paging request at ffff88017dce7000
[12886.640053] IP: memset (arch/x86/lib/memset_64.S:84)
[12886.640053] PGD 15b46067 PUD 9763c5067 PMD 9761d6067 PTE 800000017dce7060
[12886.640053] Oops: 0002 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[12886.640053] Dumping ftrace buffer:
[12886.640053]    (ftrace buffer empty)
[12886.640053] Modules linked in:
[12886.640053] CPU: 4 PID: 7421 Comm: modprobe Not tainted 3.17.0-rc1-next-20140823-sasha-00034-g503bc40 #1077
[12886.640053] task: ffff8804c2288000 ti: ffff88008398c000 task.ti: ffff88008398c000
[12886.640053] RIP: memset (arch/x86/lib/memset_64.S:84)
[12886.640053] RSP: 0018:ffff88008398f9f0  EFLAGS: 00010212
[12886.640053] RAX: 0000000000000000 RBX: ffffea0005f6e800 RCX: 03ffffffffffae7f
[12886.640053] RDX: fffffffffffe4c08 RSI: 0000000000000000 RDI: ffff88017dce6ff8
[12886.640053] RBP: ffff88008398fa28 R08: 0000000000000002 R09: 0000000000000006
[12886.640053] R10: ffff88017dbbc3f6 R11: 0000000000000000 R12: ffff880271538de8
[12886.640053] R13: ffff88076b4ff500 R14: ffff88017dba0000 R15: ffffea0005f6e820
[12886.640053] FS:  0000000000000000(0000) GS:ffff880277c00000(0000) knlGS:0000000000000000
[12886.640053] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[12886.640053] CR2: ffff88017dce7000 CR3: 00000007990c2000 CR4: 00000000000006a0
[12886.640053] Stack:
[12886.640053]  ffffffff8e7a9a25 ffff88008398fa08 ffffffff8e2a77cd ffffea0005f6e800
[12886.640053]  ffff88008398fb38 ffff880271538ff8 ffff8804c2288000 ffff88008398fa38
[12886.640053]  ffffffff8e7a9b75 ffff88008398fa98 ffffffff8e2a4b25 ffffffff8e7acf40
[12886.640053] Call Trace:
[12886.640053] ? v9fs_fid_readpage (./arch/x86/include/asm/bitops.h:75 include/linux/page-flags.h:321 fs/9p/vfs_addr.c:79)
[12886.640053] ? lru_cache_add (mm/swap.c:665)
[12886.640053] v9fs_vfs_readpage (fs/9p/vfs_addr.c:101)
[12886.640053] read_cache_pages (mm/readahead.c:100)
[12886.640053] ? v9fs_cache_session_get_key (fs/9p/cache.c:306)
[12886.640053] ? v9fs_write_begin (fs/9p/vfs_addr.c:99)
[12886.640053] v9fs_vfs_readpages (fs/9p/vfs_addr.c:127)
[12886.640053] __do_page_cache_readahead (mm/readahead.c:123 mm/readahead.c:200)
[12886.640053] ? __do_page_cache_readahead (include/linux/rcupdate.h:814 mm/readahead.c:178)
[12886.640053] filemap_fault (include/linux/memcontrol.h:137 include/linux/memcontrol.h:194 mm/filemap.c:1891)
[12886.640053] __do_fault (mm/memory.c:2712)
[12886.640053] ? _raw_spin_unlock (./arch/x86/include/asm/preempt.h:98 include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:183)
[12886.640053] do_read_fault.isra.40 (mm/memory.c:2901)
[12886.640053] ? get_parent_ip (kernel/sched/core.c:2552)
[12886.640053] ? preempt_count_sub (kernel/sched/core.c:2608)
[12886.640053] __handle_mm_fault (mm/memory.c:3048 mm/memory.c:3214 mm/memory.c:3341)
[12886.640053] handle_mm_fault (include/linux/memcontrol.h:120 mm/memory.c:3373)
[12886.640053] ? __do_page_fault (arch/x86/mm/fault.c:1163)
[12886.640053] __do_page_fault (arch/x86/mm/fault.c:1231)
[12886.640053] ? vtime_account_user (kernel/sched/cputime.c:687)
[12886.640053] ? get_parent_ip (kernel/sched/core.c:2552)
[12886.640053] ? preempt_count_sub (kernel/sched/core.c:2608)
[12886.640053] ? context_tracking_user_exit (kernel/context_tracking.c:184)
[12886.640053] ? __this_cpu_preempt_check (lib/smp_processor_id.c:63)
[12886.640053] ? trace_hardirqs_off_caller (kernel/locking/lockdep.c:2640 (discriminator 2))
[12886.640053] trace_do_page_fault (arch/x86/mm/fault.c:1314 include/linux/jump_label.h:114 include/linux/context_tracking_state.h:27 include/linux/context_tracking.h:45 arch/x86/mm/fault.c:1315)
[12886.640053] do_async_page_fault (arch/x86/kernel/kvm.c:264)
[12886.640053] async_page_fault (arch/x86/kernel/entry_64.S:1313)
[12886.640053] Code: 01 01 01 01 01 01 48 0f af c1 41 89 f9 41 83 e1 07 75 70 48 89 d1 48 c1 e9 06 74 39 66 0f 1f 84 00 00 00 00 00 48 ff c9 48 89 07 <48> 89 47 08 48 89 47 10 48 89 47 18 48 89 47 20 48 89 47 28 48
All code
========
   0:	01 01                	add    %eax,(%rcx)
   2:	01 01                	add    %eax,(%rcx)
   4:	01 01                	add    %eax,(%rcx)
   6:	48 0f af c1          	imul   %rcx,%rax
   a:	41 89 f9             	mov    %edi,%r9d
   d:	41 83 e1 07          	and    $0x7,%r9d
  11:	75 70                	jne    0x83
  13:	48 89 d1             	mov    %rdx,%rcx
  16:	48 c1 e9 06          	shr    $0x6,%rcx
  1a:	74 39                	je     0x55
  1c:	66 0f 1f 84 00 00 00 	nopw   0x0(%rax,%rax,1)
  23:	00 00
  25:	48 ff c9             	dec    %rcx
  28:	48 89 07             	mov    %rax,(%rdi)
  2b:*	48 89 47 08          	mov    %rax,0x8(%rdi)		<-- trapping instruction
  2f:	48 89 47 10          	mov    %rax,0x10(%rdi)
  33:	48 89 47 18          	mov    %rax,0x18(%rdi)
  37:	48 89 47 20          	mov    %rax,0x20(%rdi)
  3b:	48 89 47 28          	mov    %rax,0x28(%rdi)
  3f:	48                   	rex.W
	...

Code starting with the faulting instruction
===========================================
   0:	48 89 47 08          	mov    %rax,0x8(%rdi)
   4:	48 89 47 10          	mov    %rax,0x10(%rdi)
   8:	48 89 47 18          	mov    %rax,0x18(%rdi)
   c:	48 89 47 20          	mov    %rax,0x20(%rdi)
  10:	48 89 47 28          	mov    %rax,0x28(%rdi)
  14:	48                   	rex.W
	...
[12886.640053] RIP memset (arch/x86/lib/memset_64.S:84)
[12886.640053]  RSP <ffff88008398f9f0>
[12886.640053] CR2: ffff88017dce7000


Thanks,
Sasha

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>