From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A243C83F27 for ; Tue, 15 Jul 2025 13:24:17 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 544DD8D000C; Tue, 15 Jul 2025 09:24:13 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 4F4638D0001; Tue, 15 Jul 2025 09:24:13 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 36ED88D000C; Tue, 15 Jul 2025 09:24:13 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 2047D8D0001 for ; Tue, 15 Jul 2025 09:24:13 -0400 (EDT) Received: from smtpin18.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id E48591A03FC for ; Tue, 15 Jul 2025 13:24:12 +0000 (UTC) X-FDA: 83666567544.18.FA8D9E0 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by imf11.hostedemail.com (Postfix) with ESMTP id BBBF340012 for ; Tue, 15 Jul 2025 13:24:10 +0000 (UTC) Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=QAWu+Suy; spf=pass (imf11.hostedemail.com: domain of dhildenb@redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=dhildenb@redhat.com; dmarc=pass (policy=quarantine) header.from=redhat.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1752585850; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=mtQyovPa5kcBmFcu8HFFL9PcOAuE/hqSO0jegAuRWN8=; b=h48eNA0KW4oI6ytuYXuB9hKDLMiDHXHCuumrEYR+JBDntX0jck6AxGBTCyE3D0VhLJVDQv 9WDL6CtTeKMjSRTxyPEZqX/6VlalebYBUT2scPhtDbTjvdvrvFkFteEzqNUFLA9IpRNpSX Gx2yezFLW3pVuI7iKQAK3wvhl1oHzZg= ARC-Authentication-Results: i=1; imf11.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=QAWu+Suy; spf=pass (imf11.hostedemail.com: domain of dhildenb@redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=dhildenb@redhat.com; dmarc=pass (policy=quarantine) header.from=redhat.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1752585850; a=rsa-sha256; cv=none; b=qqJPnD6w1ZV0nj3NimUKPQDxTsLZCFNxqVqLo/S8wT+IH7VTkWhaj9AFqGqUzI8wYagk13 j+rrJxwc6uDUJ8SR2rgm48x0zoVJqar8C9MUy/adBYTnMx2lzXIpyJc/dA1hCV6M50zx9/ 21ac8HJDIA4DDoiVdu5iET9p3FbKuJc= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1752585850; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mtQyovPa5kcBmFcu8HFFL9PcOAuE/hqSO0jegAuRWN8=; b=QAWu+SuyFjdlhVM97JeXfgZCx3qruF1XR7W7w41lpAcOj+cvbKzM1Ix8L1rF96plfEm1Z0 vGjiLlc92/h91FcXIsrL7uJcKVAeiIpJpo4WSmsbl5ZQ0wfoJAoj+u9vGYuKwGX12TBjxo vrcR2MIHb03dtEI24cVwYCOjJPnggK0= Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-482-1I_vrRLVO9WrLiSsh1DykA-1; Tue, 15 Jul 2025 09:24:08 -0400 X-MC-Unique: 1I_vrRLVO9WrLiSsh1DykA-1 X-Mimecast-MFC-AGG-ID: 1I_vrRLVO9WrLiSsh1DykA_1752585848 Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-4562985ac6aso5554165e9.3 for ; Tue, 15 Jul 2025 06:24:08 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1752585847; x=1753190647; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=mtQyovPa5kcBmFcu8HFFL9PcOAuE/hqSO0jegAuRWN8=; b=F4pY8Tn6TAXwqR3p2/FzHgVz/wDkrEHx15lBK0a/nnVB1hv+ACfDKPxi7HOtxG8bxc hN9M74qRAUL0G7AyexcvBUN4UEknELQxnpOShreOmeSYFGWZQBndE5coP1hlTCWZKX+2 9AvxcO+TuoWPJIMMT69HoNREGxd5aLC9jGsfnVlyjkW7cBaD0RIhvIHO3tvxr3kCFntD ftIKLNB9FcV/Wm6+QUSo/AAoYBMPp6pTVe0LY1iYX6bxDz81DYLdYDnRu1Gba+XUtwuK G0NX+GhiICBL5Oegav4CDB521N8o3DcIdi1nJfvEkridpzcT0zSDhqIWUA7wvY5tQ+7s SLXg== X-Gm-Message-State: AOJu0Yw89QQ8NIsmxnqyvMX+hNRwPim8u7eCmRlaUKhWNYLr8Nr7h5g5 Vr4vRw+B0qa3/oB7UcQWXPF3spzJHpYSwInt5Yptysb2POIUWjMBUO442oXiEgawiPRwysvTJgH A2Db9+IsWDAAosiQTnoJM3bfGFy1b7QkaoO+P4aE3pmOWgMfLD+ot X-Gm-Gg: ASbGncv3p8bSZtmQleMlz5Fro4q5sJ4iO2IyabQtyIE40PeTE6nZBYyhIoYCZ/7HqgP vsmHp9FRrAKKi5KE0s3sfyBKPAITJ/7pmH6C+R7pGMtanP/ss9xeEQKCQXaq7ipkpepNHeEj+Mk fNza8ZwGXSkSOgYxhviaUx3fMDeDA9x+pAmPiH4IxA+YTn5RfyNTxzFYrDIgynSHS0/zZVhzQur Fud0bc8eGdiKzrXUdJV/LBBdl44gcAwwQ8t0SbE2IMBiqWpkdMyyqRv4wt1T6rZ45gDkIAO9Rww Ub5qrUpDeZupz5CeGuIlVAxUURFpeUSSGoizwg3uYBTFzVJwVJKD6IzO3WRjTq0amXoGmZAQDMZ Lcjp1Exp048UvrpFOa0xkan76 X-Received: by 2002:a05:600c:a03:b0:43c:fdbe:4398 with SMTP id 5b1f17b1804b1-454ec14d7a9mr155614875e9.6.1752585847408; Tue, 15 Jul 2025 06:24:07 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHhLxz868pyKkYQ3l5UGek/RKFLaiQYjZa6zO7PGU/KyOxr3dY8d03i0aN/xQxZNdYxrPnkbQ== X-Received: by 2002:a05:600c:a03:b0:43c:fdbe:4398 with SMTP id 5b1f17b1804b1-454ec14d7a9mr155614375e9.6.1752585846779; Tue, 15 Jul 2025 06:24:06 -0700 (PDT) Received: from localhost (p200300d82f2849002c244e201f219fbd.dip0.t-ipconnect.de. [2003:d8:2f28:4900:2c24:4e20:1f21:9fbd]) by smtp.gmail.com with UTF8SMTPSA id ffacd0b85a97d-3b5e8bd1784sm15006827f8f.5.2025.07.15.06.24.05 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 15 Jul 2025 06:24:06 -0700 (PDT) From: David Hildenbrand To: linux-kernel@vger.kernel.org Cc: linux-mm@kvack.org, xen-devel@lists.xenproject.org, linux-fsdevel@vger.kernel.org, nvdimm@lists.linux.dev, David Hildenbrand , Andrew Morton , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , Dan Williams , Matthew Wilcox , Jan Kara , Alexander Viro , Christian Brauner , Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Zi Yan , Baolin Wang , Nico Pache , Ryan Roberts , Dev Jain , Barry Song , Jann Horn , Pedro Falcato , Hugh Dickins , Oscar Salvador , Lance Yang Subject: [PATCH v1 6/9] mm/memory: convert print_bad_pte() to print_bad_page_map() Date: Tue, 15 Jul 2025 15:23:47 +0200 Message-ID: <20250715132350.2448901-7-david@redhat.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250715132350.2448901-1-david@redhat.com> References: <20250715132350.2448901-1-david@redhat.com> MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: iitrDOcTBz_7UiWUfN0Cgn3LYZsr8iJ_cPAvIOnT58U_1752585848 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: 8bit content-type: text/plain; charset="US-ASCII"; x-default=true X-Stat-Signature: 1dsp6a18xfb4jfunju44i8bak3ms1uce X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: BBBF340012 X-Rspam-User: X-HE-Tag: 1752585850-791053 X-HE-Meta: U2FsdGVkX19/CV25b2daiTVlzQQ6lS/i8ctmPer+U5TcooILlh0ta9LKV8r1RZjU4UGTJepLBWLjF6aVptlAie5qUrROE9qHMpHJUk86TvkRLfA3xmWuFxM12LHIeR3l0r+ZlmoOv+MfmKnKvvLg+TZ6QB2tLKIA6/D/vuBImsnkn/7N1vv822/JCy5O9X364nDDmtJOcOYTNRMLDzyhDfHSfodVMwJnEBf89+LEc498826+HAzt7wA1HaD2STs3DrsJ8H/IHH0pLNlIzIIZNguhqePdu0wJkEI3yDrtD0kQjXZ43WtlXxhoUi6sMDwVAAkU9h1lszALFx0p0NqHELIWzvTTnnY5ld2F4G/gj52Mo9e6AzIosauiI5GR95WoEIuECN+j3ZCia403ZIcysNo9IRBq3HsnGMrv4t7RzJGgQAfYl1r50lWyq61iHnYnI7YLcb8eQYT4n+nDvf8jrOVoTe2xBBuIG6zo2UaAT2WnnlltfKl6he5d3Xw5eyVqb0a4LSAeibpRWSkzcFMyWbyl9gdJ8N6tknis5uH/BgAq/tn9d1jpSWLbFVv01gJsot9NaJ5s4UqmkD086WqFeYboX71roljPlkZFa5Keh4a8rbAvNThrwfxiiwVFcjNsdvxL22Vwj78DQz3JXHVWeWil95QR6yvcr9PDNNIP1QYf/TaJk0xWGR8pjzzLC/uoP2I2Se7Fd326/RV4adYNJhxtvrHx0+P55h+aiA4eHw420q6d5a2KBppIAbyxAtExYHSsP2wrKyprC7e4Od7MArKNp5ZofdUU/ckccEKQykeMaXaRwcp8GHTWPGq/zwvcIwAo0u3IQCEdFT3rZwDkZ2WkIYYDPmFyS7q7Ou5CGks+1CaZHZp+PdoPPEi4TpiuMBm6balGmEazaqa6bkOluHOxZAfo807qZI7pcyvFiiQhPYgy4vZLl83becDlzWSXpD3lz1VBvhDo+HiuGOR e5n9t4RP 7XanSs7GdqyQ7kFiB6QLDi32CvXPZGbycTS8PfWifcl4rYAwclUuUjQSVDkbz3ALF9xHY3Z1hwaFx4Kve4OCdmY5zQY6PQkYQZNLksSFAs3gURAMdHhNoFZxttmY+GLVVBo5kldg16ZX7Sy8fAOWURF8blHTZKftU9WZF8yaVuPTnnjB785X2StUpLb+K3pR4Yq1jqXKrrs2gx5F7wMTk+R1dDtwbSDsh7SXNHIeiXsfJ6aM5Znr+Np9NYk7Zpf9ohr3qy+pCp64Rjpa9pHKvzgApfV8txoUK3/n83n5BioPUYC6ZSt2nhDsWF5Nq9Q6q9PoFN0tRzWz35uPT8vk7ffYJc8LF000OIVya+8SBNQhWoItaQgK5KrodvxB2W02YgiTcDJYQP36ope/jf3kaW1tIHZ6XllQ+LZUwCWx3MMmPCUsVNOwpqDYhTLxoFNT2iME/m1+TKRlZaxfKQamG7IHnKXflK252ydCGfUMnM23Ny3LT5L3XmF0RUkxK25+p6BrfDldAhnFWXoaG2lfeD24C0jHbYUpo2nkDNO83LclgurWSBsVlPLaf1OUvkGGDzfkpahwodfSs/7jl0GQHzi/euA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: print_bad_pte() looks like something that should actually be a WARN or similar, but historically it apparently has proven to be useful to detect corruption of page tables even on production systems -- report the issue and keep the system running to make it easier to actually detect what is going wrong (e.g., multiple such messages might shed a light). As we want to unify vm_normal_page_*() handling for PTE/PMD/PUD, we'll have to take care of print_bad_pte() as well. Let's prepare for using print_bad_pte() also for non-PTEs by adjusting the implementation and renaming the function -- we'll rename it to what we actually print: bad (page) mappings. Maybe it should be called "print_bad_table_entry()"? We'll just call it "print_bad_page_map()" because the assumption is that we are dealing with some (previously) present page table entry that got corrupted in weird ways. Whether it is a PTE or something else will usually become obvious from the page table dump or from the dumped stack. If ever required in the future, we could pass the entry level type similar to "enum rmap_level". For now, let's keep it simple. To make the function a bit more readable, factor out the ratelimit check into is_bad_page_map_ratelimited() and place the dumping of page table content into __dump_bad_page_map_pgtable(). We'll now dump information from each level in a single line, and just stop the table walk once we hit something that is not a present page table. Use print_bad_page_map() in vm_normal_page_pmd() similar to how we do it for vm_normal_page(), now that we have a function that can handle it. The report will now look something like (dumping pgd to pmd values): [ 77.943408] BUG: Bad page map in process XXX entry:80000001233f5867 [ 77.944077] addr:00007fd84bb1c000 vm_flags:08100071 anon_vma: ... [ 77.945186] pgd:10a89f067 p4d:10a89f067 pud:10e5a2067 pmd:105327067 Signed-off-by: David Hildenbrand --- mm/memory.c | 120 ++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 94 insertions(+), 26 deletions(-) diff --git a/mm/memory.c b/mm/memory.c index a4f62923b961c..00ee0df020503 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -479,22 +479,8 @@ static inline void add_mm_rss_vec(struct mm_struct *mm, int *rss) add_mm_counter(mm, i, rss[i]); } -/* - * This function is called to print an error when a bad pte - * is found. For example, we might have a PFN-mapped pte in - * a region that doesn't allow it. - * - * The calling function must still handle the error. - */ -static void print_bad_pte(struct vm_area_struct *vma, unsigned long addr, - pte_t pte, struct page *page) +static bool is_bad_page_map_ratelimited(void) { - pgd_t *pgd = pgd_offset(vma->vm_mm, addr); - p4d_t *p4d = p4d_offset(pgd, addr); - pud_t *pud = pud_offset(p4d, addr); - pmd_t *pmd = pmd_offset(pud, addr); - struct address_space *mapping; - pgoff_t index; static unsigned long resume; static unsigned long nr_shown; static unsigned long nr_unshown; @@ -506,7 +492,7 @@ static void print_bad_pte(struct vm_area_struct *vma, unsigned long addr, if (nr_shown == 60) { if (time_before(jiffies, resume)) { nr_unshown++; - return; + return true; } if (nr_unshown) { pr_alert("BUG: Bad page map: %lu messages suppressed\n", @@ -517,15 +503,87 @@ static void print_bad_pte(struct vm_area_struct *vma, unsigned long addr, } if (nr_shown++ == 0) resume = jiffies + 60 * HZ; + return false; +} + +static void __dump_bad_page_map_pgtable(struct mm_struct *mm, unsigned long addr) +{ + unsigned long long pgdv, p4dv, pudv, pmdv; + pgd_t pgd, *pgdp; + p4d_t p4d, *p4dp; + pud_t pud, *pudp; + pmd_t *pmdp; + + /* + * This looks like a fully lockless walk, however, the caller is + * expected to hold the leaf page table lock in addition to other + * rmap/mm/vma locks. So this is just a re-walk to dump page table + * content while any concurrent modifications should be completely + * prevented. + */ + pgdp = pgd_offset(mm, addr); + pgd = pgdp_get(pgdp); + pgdv = pgd_val(pgd); + + if (!pgd_present(pgd) || pgd_leaf(pgd)) { + pr_alert("pgd:%08llx\n", pgdv); + return; + } + + p4dp = p4d_offset(pgdp, addr); + p4d = p4dp_get(p4dp); + p4dv = p4d_val(p4d); + + if (!p4d_present(p4d) || p4d_leaf(p4d)) { + pr_alert("pgd:%08llx p4d:%08llx\n", pgdv, p4dv); + return; + } + + pudp = pud_offset(p4dp, addr); + pud = pudp_get(pudp); + pudv = pud_val(pud); + + if (!pud_present(pud) || pud_leaf(pud)) { + pr_alert("pgd:%08llx p4d:%08llx pud:%08llx\n", pgdv, p4dv, pudv); + return; + } + + pmdp = pmd_offset(pudp, addr); + pmdv = pmd_val(pmdp_get(pmdp)); + + /* + * Dumping the PTE would be nice, but it's tricky with CONFIG_HIGHPTE, + * because the table should already be mapped by the caller and + * doing another map would be bad. print_bad_page_map() should + * already take care of printing the PTE. + */ + pr_alert("pgd:%08llx p4d:%08llx pud:%08llx pmd:%08llx\n", pgdv, + p4dv, pudv, pmdv); +} + +/* + * This function is called to print an error when a bad page table entry (e.g., + * corrupted page table entry) is found. For example, we might have a + * PFN-mapped pte in a region that doesn't allow it. + * + * The calling function must still handle the error. + */ +static void print_bad_page_map(struct vm_area_struct *vma, + unsigned long addr, unsigned long long entry, struct page *page) +{ + struct address_space *mapping; + pgoff_t index; + + if (is_bad_page_map_ratelimited()) + return; mapping = vma->vm_file ? vma->vm_file->f_mapping : NULL; index = linear_page_index(vma, addr); - pr_alert("BUG: Bad page map in process %s pte:%08llx pmd:%08llx\n", - current->comm, - (long long)pte_val(pte), (long long)pmd_val(*pmd)); + pr_alert("BUG: Bad page map in process %s entry:%08llx", current->comm, entry); + __dump_bad_page_map_pgtable(vma->vm_mm, addr); if (page) - dump_page(page, "bad pte"); + dump_page(page, "bad page map"); pr_alert("addr:%px vm_flags:%08lx anon_vma:%px mapping:%px index:%lx\n", (void *)addr, vma->vm_flags, vma->anon_vma, mapping, index); pr_alert("file:%pD fault:%ps mmap:%ps mmap_prepare: %ps read_folio:%ps\n", @@ -603,7 +661,7 @@ struct page *vm_normal_page(struct vm_area_struct *vma, unsigned long addr, if (is_zero_pfn(pfn)) return NULL; - print_bad_pte(vma, addr, pte, NULL); + print_bad_page_map(vma, addr, pte_val(pte), NULL); return NULL; } @@ -631,7 +689,7 @@ struct page *vm_normal_page(struct vm_area_struct *vma, unsigned long addr, check_pfn: if (unlikely(pfn > highest_memmap_pfn)) { - print_bad_pte(vma, addr, pte, NULL); + print_bad_page_map(vma, addr, pte_val(pte), NULL); return NULL; } @@ -660,8 +718,15 @@ struct page *vm_normal_page_pmd(struct vm_area_struct *vma, unsigned long addr, { unsigned long pfn = pmd_pfn(pmd); - if (unlikely(pmd_special(pmd))) + if (unlikely(pmd_special(pmd))) { + if (vma->vm_flags & (VM_PFNMAP | VM_MIXEDMAP)) + return NULL; + if (is_huge_zero_pfn(pfn)) + return NULL; + + print_bad_page_map(vma, addr, pmd_val(pmd), NULL); return NULL; + } if (unlikely(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP))) { if (vma->vm_flags & VM_MIXEDMAP) { @@ -680,8 +745,10 @@ struct page *vm_normal_page_pmd(struct vm_area_struct *vma, unsigned long addr, if (is_huge_zero_pfn(pfn)) return NULL; - if (unlikely(pfn > highest_memmap_pfn)) + if (unlikely(pfn > highest_memmap_pfn)) { + print_bad_page_map(vma, addr, pmd_val(pmd), NULL); return NULL; + } /* * NOTE! We still have PageReserved() pages in the page tables. @@ -1515,7 +1582,7 @@ static __always_inline void zap_present_folio_ptes(struct mmu_gather *tlb, folio_remove_rmap_ptes(folio, page, nr, vma); if (unlikely(folio_mapcount(folio) < 0)) - print_bad_pte(vma, addr, ptent, page); + print_bad_page_map(vma, addr, pte_val(ptent), page); } if (unlikely(__tlb_remove_folio_pages(tlb, page, nr, delay_rmap))) { *force_flush = true; @@ -4513,7 +4580,8 @@ vm_fault_t do_swap_page(struct vm_fault *vmf) } else if (is_pte_marker_entry(entry)) { ret = handle_pte_marker(vmf); } else { - print_bad_pte(vma, vmf->address, vmf->orig_pte, NULL); + print_bad_page_map(vma, vmf->address, + pte_val(vmf->orig_pte), NULL); ret = VM_FAULT_SIGBUS; } goto out; -- 2.50.1