* [PATCH] powerpc/mm: Fix kernel crash on page table free
@ 2018-05-30 12:32 Aneesh Kumar K.V
2018-06-01 15:55 ` Michael Ellerman
2018-06-14 21:54 ` [PATCH] " Christophe Leroy
0 siblings, 2 replies; 4+ messages in thread
From: Aneesh Kumar K.V @ 2018-05-30 12:32 UTC (permalink / raw)
To: benh, paulus, mpe; +Cc: linuxppc-dev, Aneesh Kumar K.V
Fix the below crash on BookE 64. pgtable_page_dtor expects struct page *arg.
Also call the destructor on non book3s platforms correctly. This free up the
split ptl locks correctly if we had allocated them before.
Call Trace:
[c0000000f30c7520] [c00000000021eeec] .kmem_cache_free+0x9c/0x44c (unreliable)
[c0000000f30c75c0] [c0000000001ee07c] .ptlock_free+0x1c/0x30
[c0000000f30c7630] [c0000000001ee260] .tlb_remove_table+0xdc/0x224
[c0000000f30c76c0] [c0000000001ee640] .free_pgd_range+0x298/0x500
[c0000000f30c77d0] [c000000000232afc] .shift_arg_pages+0x10c/0x1e0
[c0000000f30c7910] [c000000000232dd0] .setup_arg_pages+0x200/0x25c
[c0000000f30c79c0] [c0000000002ad4fc] .load_elf_binary+0x450/0x16c8
[c0000000f30c7b10] [c000000000234914] .search_binary_handler.part.11+0x9c/0x248
[c0000000f30c7bb0] [c00000000023595c] .do_execveat_common.isra.13+0x868/0xc18
[c0000000f30c7cb0] [c00000000000184c] .run_init_process+0x34/0x4c
[c0000000f30c7d30] [c000000000001880] .try_to_run_init_process+0x1c/0x68
[c0000000f30c7db0] [c000000000002bd8] .kernel_init+0xdc/0x130
[c0000000f30c7e30] [c0000000000009dc] .ret_from_kernel_thread+0x58/0x7c
Fixes: 702346768 ("powerpc/mm/nohash: Remove pte fragment dependency from nohash")
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
---
arch/powerpc/include/asm/book3s/32/pgalloc.h | 1 +
arch/powerpc/include/asm/nohash/32/pgalloc.h | 1 +
arch/powerpc/include/asm/nohash/64/pgalloc.h | 2 +-
3 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h b/arch/powerpc/include/asm/book3s/32/pgalloc.h
index 5073cc75f1c8..6a6673907e45 100644
--- a/arch/powerpc/include/asm/book3s/32/pgalloc.h
+++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h
@@ -99,6 +99,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage)
static inline void pgtable_free(void *table, unsigned index_size)
{
if (!index_size) {
+ pgtable_page_dtor(virt_to_page(table));
free_page((unsigned long)table);
} else {
BUG_ON(index_size > MAX_PGTABLE_INDEX_SIZE);
diff --git a/arch/powerpc/include/asm/nohash/32/pgalloc.h b/arch/powerpc/include/asm/nohash/32/pgalloc.h
index 29d37bd1f3b3..1707781d2f20 100644
--- a/arch/powerpc/include/asm/nohash/32/pgalloc.h
+++ b/arch/powerpc/include/asm/nohash/32/pgalloc.h
@@ -100,6 +100,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage)
static inline void pgtable_free(void *table, unsigned index_size)
{
if (!index_size) {
+ pgtable_page_dtor(virt_to_page(table));
free_page((unsigned long)table);
} else {
BUG_ON(index_size > MAX_PGTABLE_INDEX_SIZE);
diff --git a/arch/powerpc/include/asm/nohash/64/pgalloc.h b/arch/powerpc/include/asm/nohash/64/pgalloc.h
index 21624ff1f065..0e693f322cb2 100644
--- a/arch/powerpc/include/asm/nohash/64/pgalloc.h
+++ b/arch/powerpc/include/asm/nohash/64/pgalloc.h
@@ -133,7 +133,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage)
static inline void pgtable_free(void *table, int shift)
{
if (!shift) {
- pgtable_page_dtor(table);
+ pgtable_page_dtor(virt_to_page(table));
free_page((unsigned long)table);
} else {
BUG_ON(shift > MAX_PGTABLE_INDEX_SIZE);
--
2.17.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: powerpc/mm: Fix kernel crash on page table free
2018-05-30 12:32 [PATCH] powerpc/mm: Fix kernel crash on page table free Aneesh Kumar K.V
@ 2018-06-01 15:55 ` Michael Ellerman
2018-06-14 21:54 ` [PATCH] " Christophe Leroy
1 sibling, 0 replies; 4+ messages in thread
From: Michael Ellerman @ 2018-06-01 15:55 UTC (permalink / raw)
To: Aneesh Kumar K.V, benh, paulus; +Cc: Aneesh Kumar K.V, linuxppc-dev
On Wed, 2018-05-30 at 12:32:25 UTC, "Aneesh Kumar K.V" wrote:
> Fix the below crash on BookE 64. pgtable_page_dtor expects struct page *arg.
>
> Also call the destructor on non book3s platforms correctly. This free up the
> split ptl locks correctly if we had allocated them before.
>
> Call Trace:
> [c0000000f30c7520] [c00000000021eeec] .kmem_cache_free+0x9c/0x44c (unreliable)
> [c0000000f30c75c0] [c0000000001ee07c] .ptlock_free+0x1c/0x30
> [c0000000f30c7630] [c0000000001ee260] .tlb_remove_table+0xdc/0x224
> [c0000000f30c76c0] [c0000000001ee640] .free_pgd_range+0x298/0x500
> [c0000000f30c77d0] [c000000000232afc] .shift_arg_pages+0x10c/0x1e0
> [c0000000f30c7910] [c000000000232dd0] .setup_arg_pages+0x200/0x25c
> [c0000000f30c79c0] [c0000000002ad4fc] .load_elf_binary+0x450/0x16c8
> [c0000000f30c7b10] [c000000000234914] .search_binary_handler.part.11+0x9c/0x248
> [c0000000f30c7bb0] [c00000000023595c] .do_execveat_common.isra.13+0x868/0xc18
> [c0000000f30c7cb0] [c00000000000184c] .run_init_process+0x34/0x4c
> [c0000000f30c7d30] [c000000000001880] .try_to_run_init_process+0x1c/0x68
> [c0000000f30c7db0] [c000000000002bd8] .kernel_init+0xdc/0x130
> [c0000000f30c7e30] [c0000000000009dc] .ret_from_kernel_thread+0x58/0x7c
>
> Fixes: 702346768 ("powerpc/mm/nohash: Remove pte fragment dependency from nohash")
> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
Applied to powerpc next, thanks.
https://git.kernel.org/powerpc/c/667416f38554eef94485496f3a27b9
cheers
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] powerpc/mm: Fix kernel crash on page table free
2018-05-30 12:32 [PATCH] powerpc/mm: Fix kernel crash on page table free Aneesh Kumar K.V
2018-06-01 15:55 ` Michael Ellerman
@ 2018-06-14 21:54 ` Christophe Leroy
2018-06-15 10:15 ` Aneesh Kumar K.V
1 sibling, 1 reply; 4+ messages in thread
From: Christophe Leroy @ 2018-06-14 21:54 UTC (permalink / raw)
To: Aneesh Kumar K.V, benh, paulus, mpe; +Cc: linuxppc-dev
On 05/30/2018 12:32 PM, Aneesh Kumar K.V wrote:
> Fix the below crash on BookE 64. pgtable_page_dtor expects struct page *arg.
>
> Also call the destructor on non book3s platforms correctly. This free up the
> split ptl locks correctly if we had allocated them before.
>
> Call Trace:
> [c0000000f30c7520] [c00000000021eeec] .kmem_cache_free+0x9c/0x44c (unreliable)
> [c0000000f30c75c0] [c0000000001ee07c] .ptlock_free+0x1c/0x30
> [c0000000f30c7630] [c0000000001ee260] .tlb_remove_table+0xdc/0x224
> [c0000000f30c76c0] [c0000000001ee640] .free_pgd_range+0x298/0x500
> [c0000000f30c77d0] [c000000000232afc] .shift_arg_pages+0x10c/0x1e0
> [c0000000f30c7910] [c000000000232dd0] .setup_arg_pages+0x200/0x25c
> [c0000000f30c79c0] [c0000000002ad4fc] .load_elf_binary+0x450/0x16c8
> [c0000000f30c7b10] [c000000000234914] .search_binary_handler.part.11+0x9c/0x248
> [c0000000f30c7bb0] [c00000000023595c] .do_execveat_common.isra.13+0x868/0xc18
> [c0000000f30c7cb0] [c00000000000184c] .run_init_process+0x34/0x4c
> [c0000000f30c7d30] [c000000000001880] .try_to_run_init_process+0x1c/0x68
> [c0000000f30c7db0] [c000000000002bd8] .kernel_init+0xdc/0x130
> [c0000000f30c7e30] [c0000000000009dc] .ret_from_kernel_thread+0x58/0x7c
>
> Fixes: 702346768 ("powerpc/mm/nohash: Remove pte fragment dependency from nohash")
> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
> ---
> arch/powerpc/include/asm/book3s/32/pgalloc.h | 1 +
> arch/powerpc/include/asm/nohash/32/pgalloc.h | 1 +
> arch/powerpc/include/asm/nohash/64/pgalloc.h | 2 +-
> 3 files changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h b/arch/powerpc/include/asm/book3s/32/pgalloc.h
> index 5073cc75f1c8..6a6673907e45 100644
> --- a/arch/powerpc/include/asm/book3s/32/pgalloc.h
> +++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h
> @@ -99,6 +99,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage)
> static inline void pgtable_free(void *table, unsigned index_size)
> {
> if (!index_size) {
> + pgtable_page_dtor(virt_to_page(table));
__pte_free_tlb() already calls pgtable_page_dtor(table) before calling
pgtable_free() via pgtable_free_tlb().
Is it normal to call it twice ?
> free_page((unsigned long)table);
> } else {
> BUG_ON(index_size > MAX_PGTABLE_INDEX_SIZE);
> diff --git a/arch/powerpc/include/asm/nohash/32/pgalloc.h b/arch/powerpc/include/asm/nohash/32/pgalloc.h
> index 29d37bd1f3b3..1707781d2f20 100644
> --- a/arch/powerpc/include/asm/nohash/32/pgalloc.h
> +++ b/arch/powerpc/include/asm/nohash/32/pgalloc.h
> @@ -100,6 +100,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage)
> static inline void pgtable_free(void *table, unsigned index_size)
> {
> if (!index_size) {
> + pgtable_page_dtor(virt_to_page(table));
Same here
Christophe
> free_page((unsigned long)table);
> } else {
> BUG_ON(index_size > MAX_PGTABLE_INDEX_SIZE);
> diff --git a/arch/powerpc/include/asm/nohash/64/pgalloc.h b/arch/powerpc/include/asm/nohash/64/pgalloc.h
> index 21624ff1f065..0e693f322cb2 100644
> --- a/arch/powerpc/include/asm/nohash/64/pgalloc.h
> +++ b/arch/powerpc/include/asm/nohash/64/pgalloc.h
> @@ -133,7 +133,7 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage)
> static inline void pgtable_free(void *table, int shift)
> {
> if (!shift) {
> - pgtable_page_dtor(table);
> + pgtable_page_dtor(virt_to_page(table));
> free_page((unsigned long)table);
> } else {
> BUG_ON(shift > MAX_PGTABLE_INDEX_SIZE);
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] powerpc/mm: Fix kernel crash on page table free
2018-06-14 21:54 ` [PATCH] " Christophe Leroy
@ 2018-06-15 10:15 ` Aneesh Kumar K.V
0 siblings, 0 replies; 4+ messages in thread
From: Aneesh Kumar K.V @ 2018-06-15 10:15 UTC (permalink / raw)
To: Christophe Leroy, benh, paulus, mpe; +Cc: linuxppc-dev
On 06/15/2018 03:24 AM, Christophe Leroy wrote:
>
>
> On 05/30/2018 12:32 PM, Aneesh Kumar K.V wrote:
>> Fix the below crash on BookE 64. pgtable_page_dtor expects struct page
>> *arg.
>>
>> Also call the destructor on non book3s platforms correctly. This free
>> up the
>> split ptl locks correctly if we had allocated them before.
>>
>> Call Trace:
>> [c0000000f30c7520] [c00000000021eeec] .kmem_cache_free+0x9c/0x44c
>> (unreliable)
>> [c0000000f30c75c0] [c0000000001ee07c] .ptlock_free+0x1c/0x30
>> [c0000000f30c7630] [c0000000001ee260] .tlb_remove_table+0xdc/0x224
>> [c0000000f30c76c0] [c0000000001ee640] .free_pgd_range+0x298/0x500
>> [c0000000f30c77d0] [c000000000232afc] .shift_arg_pages+0x10c/0x1e0
>> [c0000000f30c7910] [c000000000232dd0] .setup_arg_pages+0x200/0x25c
>> [c0000000f30c79c0] [c0000000002ad4fc] .load_elf_binary+0x450/0x16c8
>> [c0000000f30c7b10] [c000000000234914]
>> .search_binary_handler.part.11+0x9c/0x248
>> [c0000000f30c7bb0] [c00000000023595c]
>> .do_execveat_common.isra.13+0x868/0xc18
>> [c0000000f30c7cb0] [c00000000000184c] .run_init_process+0x34/0x4c
>> [c0000000f30c7d30] [c000000000001880] .try_to_run_init_process+0x1c/0x68
>> [c0000000f30c7db0] [c000000000002bd8] .kernel_init+0xdc/0x130
>> [c0000000f30c7e30] [c0000000000009dc] .ret_from_kernel_thread+0x58/0x7c
>>
>> Fixes: 702346768 ("powerpc/mm/nohash: Remove pte fragment dependency
>> from nohash")
>> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
>> ---
>> arch/powerpc/include/asm/book3s/32/pgalloc.h | 1 +
>> arch/powerpc/include/asm/nohash/32/pgalloc.h | 1 +
>> arch/powerpc/include/asm/nohash/64/pgalloc.h | 2 +-
>> 3 files changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h
>> b/arch/powerpc/include/asm/book3s/32/pgalloc.h
>> index 5073cc75f1c8..6a6673907e45 100644
>> --- a/arch/powerpc/include/asm/book3s/32/pgalloc.h
>> +++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h
>> @@ -99,6 +99,7 @@ static inline void pte_free(struct mm_struct *mm,
>> pgtable_t ptepage)
>> static inline void pgtable_free(void *table, unsigned index_size)
>> {
>> if (!index_size) {
>> + pgtable_page_dtor(virt_to_page(table));
>
> __pte_free_tlb() already calls pgtable_page_dtor(table) before calling
> pgtable_free() via pgtable_free_tlb().
>
> Is it normal to call it twice ?
No. We should call pgtable_page_dtor only in the rcu callback. So we
should remove it from __pte_free_tlb().
>
>> free_page((unsigned long)table);
>> } else {
>> BUG_ON(index_size > MAX_PGTABLE_INDEX_SIZE);
>> diff --git a/arch/powerpc/include/asm/nohash/32/pgalloc.h
>> b/arch/powerpc/include/asm/nohash/32/pgalloc.h
>> index 29d37bd1f3b3..1707781d2f20 100644
>> --- a/arch/powerpc/include/asm/nohash/32/pgalloc.h
>> +++ b/arch/powerpc/include/asm/nohash/32/pgalloc.h
>> @@ -100,6 +100,7 @@ static inline void pte_free(struct mm_struct *mm,
>> pgtable_t ptepage)
>> static inline void pgtable_free(void *table, unsigned index_size)
>> {
>> if (!index_size) {
>> + pgtable_page_dtor(virt_to_page(table));
>
> Same here
I don't have the facility to test anything other than book3s64. Can you
do a patch for this?
-aneesh
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-06-15 10:15 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-05-30 12:32 [PATCH] powerpc/mm: Fix kernel crash on page table free Aneesh Kumar K.V
2018-06-01 15:55 ` Michael Ellerman
2018-06-14 21:54 ` [PATCH] " Christophe Leroy
2018-06-15 10:15 ` Aneesh Kumar K.V
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).