From: Dongyang Wang <dongyang.wang@windriver.com>
To: <manfred@colorfullife.com>
Cc: <akpm@linux-foundation.org>, <christian.brauner@ubuntu.com>,
<dave@stgolabs.net>, <dongyang.wang@windriver.com>,
<ebiederm@xmission.com>, <legion@kernel.org>,
<linux-kernel@vger.kernel.org>, <varad.gautam@suse.com>
Subject: Re: [PATCH] To fix the below failure of handling page fault caused by the invalid input from user.
Date: Wed, 9 Feb 2022 15:28:20 +0800 [thread overview]
Message-ID: <20220209072820.18238-1-dongyang.wang@windriver.com> (raw)
In-Reply-To: <56982041-c7ac-fc68-f5df-12a11d351ed6@colorfullife.com>
Hi Manfred,
I'm sorry for the late reply (we have a Chinese Lunar New Year).
>>> On 1/26/22 03:42, Andrew Morton wrote:
>>>> On Tue, 18 Jan 2022 17:19:52 +0800 Dongyang Wang <dongyang.wang@windriver.com> wrote:
>>>>
>>>>> [786058.308965] Unable to handle kernel paging request at virtual address 01000004
>>>>> [786058.316286] pgd = 38a99693
>>>>> [786058.319080] [01000004] *pgd=07800003, *pmd=00000000
>>>>> [786058.324056] Internal error: Oops: 206 [#1] PREEMPT SMP ARM
>>>>> [786058.324100] CPU: PID: Comm: Tainted: G C
>>>>> [786058.324102] Hardware name:
>>>>> [786058.324114] PC is at __copy_to_user_std+0x4c/0x3c4
>>>>> [786058.324120] LR is at store_msg+0xc0/0xe8
>>>>> [786058.324124] pc : [<c0c0587c>] lr : [<c0871d04>] psr: 20010013
>>>>> [786058.324126] sp : c3503ec4 ip : 00000000 fp : b4c9a660
>>>>> [786058.324129] r10: c4228dc0 r9 : c3502000 r8 : 00000ffc
>>>>> [786058.324132] r7 : 01000000 r6 : 546d3f8b r5 : b4911690 r4 : 00000ffc
>>>>> [786058.324134] r3 : 00000000 r2 : 00000f7c r1 : 01000004 r0 : b4911690
>>>>> [786058.324139] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
>>>>> [786058.324142] Control: 30c5387d Table: 0edc2040 DAC: 55555555
>>>>> [786058.324145] Process (pid: , stack limit = 0x25018bdf)
>>> Why is process and pid: empty? Is this some kind of kernel process calling?
>> The pid is 8369, it's a userspace app.
>>
>>>>> [786058.324148] Stack: (0xc3503ec4 to 0xc3504000)
>>>>> [786058.324153] 3ec0: b4911690 546d3f8b 01000000 00000ffc b4911690 00000ffc 00000000
>>>>> [786058.324157] 3ee0: 00000ffc c0871d04 546d4f73 c3407801 c3503f28 c3407800 00000000 b49106a8
>>>>> [786058.324161] 3f00: c4228dc0 c087abd4 00000002 b49106a8 617b9d03 00000000 00000000 c121d508
>>>>> [786058.324165] 3f20: 00000000 bf06a1a8 d1b634cc 16b26e77 c5af5280 00000100 00000200 db806540
>>>>> [786058.324170] 3f40: 00000001 c121d508 00000008 0000005c 00000000 00010008 b49106a8 c0601208
>>>>> [786058.324173] 3f60: c3502000 00000040 b4c9a660 c087b474 c3503f78 c121d508 617b9d03 00000000
>>>>> [786058.324177] 3f80: 2303d6cc 00000115 c0601208 c121d508 b4c9a660 b4c9a660 00000001 b49106a8
>>>>> [786058.324181] 3fa0: 00000115 c06011dc b4c9a660 00000001 0000005c b49106a8 00010008 00000000
>>>>> [786058.324185] 3fc0: b4c9a660 00000001 b49106a8 00000115 00000000 b4c9b400 00000000 b4c9a660
>>>>> [786058.324189] 3fe0: 00000115 b4c9a650 b6b253bd b6b254b6 800d0030 0000005c 00000000 00000000
>>>>> [786058.324201] [<c0c0587c>] (__copy_to_user_std) from [<c0871d04>] (store_msg+0xc0/0xe8)
>
>I would search here: __copy_to_user_std should fail if the address is
>invalid.
>
>For whatever reasons, it produces a page fault.
Totally agree with you.
>First: Is this reproducible? Does it fail immediately if you pass an
>invalid value to mq_timedreceive()?
This crash info is from another team. It can't be reproduced until now.
Yesterday, I changed the 'u_msg_ptr' and 'msg_ptr->m_ts' to a wrong value, but don't cause crash.
I will watch this part.
>https://elixir.bootlin.com/linux/v4.18.20/source/arch/arm/include/asm/uaccess.h#L464
>
>It seems ARM has special optimizations (CONFIG_UACCESS_WITH_MEMCPY), and
>I cannot see if this is MMU or NO_MMU
This is MMU.
next prev parent reply other threads:[~2022-02-09 7:49 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-18 9:19 [PATCH] To fix the below failure of handling page fault caused by the invalid input from user Dongyang Wang
2022-01-26 2:42 ` Andrew Morton
2022-01-26 16:52 ` Manfred Spraul
2022-01-29 15:02 ` Dongyang Wang
2022-01-29 15:59 ` Manfred Spraul
2022-02-09 7:28 ` Dongyang Wang [this message]
2022-03-04 7:33 ` Dongyang Wang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220209072820.18238-1-dongyang.wang@windriver.com \
--to=dongyang.wang@windriver.com \
--cc=akpm@linux-foundation.org \
--cc=christian.brauner@ubuntu.com \
--cc=dave@stgolabs.net \
--cc=ebiederm@xmission.com \
--cc=legion@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=manfred@colorfullife.com \
--cc=varad.gautam@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox