[PATCH 4.4-stable] kaiser: Set _PAGE_NX only if supported

[PATCH 4.4-stable] kaiser: Set _PAGE_NX only if supported

[Lepton Wu]

This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed
out that the reason of that crash is that NX bit get set for page tables.
It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map

See https://www.spinics.net/lists/kernel/msg2689835.html for details.

Signed-off-by: Lepton Wu <ytht.net@gmail.com>
---
 arch/x86/mm/kaiser.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
index 6a7a77929a8c..936672f71139 100644
--- a/arch/x86/mm/kaiser.c
+++ b/arch/x86/mm/kaiser.c
@@ -198,6 +198,10 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,
 	 * requires that not to be #defined to 0): so mask it off here.
 	 */
 	flags &= ~_PAGE_GLOBAL;
+	/* If CPU doesn't support NX, don't set it. */
+        if (!(__supported_pte_mask & _PAGE_NX))
+		flags &= ~_PAGE_NX;
+
 
 	for (; address < end_addr; address += PAGE_SIZE) {
 		target_address = get_pa_from_mapping(address);
-- 
2.16.0.rc1.238.g530d649a79-goog

[PATCH 4.4-stable v2] kaiser: Set _PAGE_NX only if supported

[Lepton Wu]

This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed
out that the reason of that crash is that NX bit get set for page tables.
It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map

See https://www.spinics.net/lists/kernel/msg2689835.html for details.

Signed-off-by: Lepton Wu <ytht.net@gmail.com>
---
 arch/x86/mm/kaiser.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
index 6a7a77929a8c..8af98513d36c 100644
--- a/arch/x86/mm/kaiser.c
+++ b/arch/x86/mm/kaiser.c
@@ -198,6 +198,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,
 	 * requires that not to be #defined to 0): so mask it off here.
 	 */
 	flags &= ~_PAGE_GLOBAL;
+	if (!(__supported_pte_mask & _PAGE_NX))
+		flags &= ~_PAGE_NX;
 
 	for (; address < end_addr; address += PAGE_SIZE) {
 		target_address = get_pa_from_mapping(address);
-- 
2.16.0.rc1.238.g530d649a79-goog

Re: [PATCH 4.4-stable] kaiser: Set _PAGE_NX only if supported

[Guenter Roeck]

On Fri, Jan 12, 2018 at 1:31 PM, Lepton Wu <ytht.net@gmail.com> wrote:
> This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed
> out that the reason of that crash is that NX bit get set for page tables.
> It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map
>
> See https://www.spinics.net/lists/kernel/msg2689835.html for details.
>
You might want to use

Link: https://www.spinics.net/lists/kernel/msg2689835.html

instead.

> Signed-off-by: Lepton Wu <ytht.net@gmail.com>
> ---
>  arch/x86/mm/kaiser.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
> index 6a7a77929a8c..936672f71139 100644
> --- a/arch/x86/mm/kaiser.c
> +++ b/arch/x86/mm/kaiser.c
> @@ -198,6 +198,10 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,
>          * requires that not to be #defined to 0): so mask it off here.
>          */
>         flags &= ~_PAGE_GLOBAL;
> +       /* If CPU doesn't support NX, don't set it. */
> +        if (!(__supported_pte_mask & _PAGE_NX))

This line has spaces instead of a tab at the beginning of the line,
resulting in a checkpatch error.

Otherwise feel free to add

Reviewed-by: Guenter Roeck <groeck@chromium.org>

to the next version. Thanks a lot for tracking this down!

Guenter

> +               flags &= ~_PAGE_NX;
> +
>
>         for (; address < end_addr; address += PAGE_SIZE) {
>                 target_address = get_pa_from_mapping(address);
> --
> 2.16.0.rc1.238.g530d649a79-goog
>

[PATCH 4.4-stable v3] kaiser: Set _PAGE_NX only if supported

[Lepton Wu]

This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed
out that the reason of that crash is that NX bit get set for page tables.
It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map

Link: https://www.spinics.net/lists/kernel/msg2689835.html

Signed-off-by: Lepton Wu <ytht.net@gmail.com>
---
 arch/x86/mm/kaiser.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
index 6a7a77929a8c..8af98513d36c 100644
--- a/arch/x86/mm/kaiser.c
+++ b/arch/x86/mm/kaiser.c
@@ -198,6 +198,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,
 	 * requires that not to be #defined to 0): so mask it off here.
 	 */
 	flags &= ~_PAGE_GLOBAL;
+	if (!(__supported_pte_mask & _PAGE_NX))
+		flags &= ~_PAGE_NX;
 
 	for (; address < end_addr; address += PAGE_SIZE) {
 		target_address = get_pa_from_mapping(address);
-- 
2.16.0.rc1.238.g530d649a79-goog

[PATCH 4.4-stable v4] kaiser: Set _PAGE_NX only if supported

[Lepton Wu]

This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed
out that the reason of that crash is that NX bit get set for page tables.
It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map

Link: https://www.spinics.net/lists/kernel/msg2689835.html

Reviewed-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Lepton Wu <ytht.net@gmail.com>
---
 arch/x86/mm/kaiser.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
index 6a7a77929a8c..8af98513d36c 100644
--- a/arch/x86/mm/kaiser.c
+++ b/arch/x86/mm/kaiser.c
@@ -198,6 +198,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,
 	 * requires that not to be #defined to 0): so mask it off here.
 	 */
 	flags &= ~_PAGE_GLOBAL;
+	if (!(__supported_pte_mask & _PAGE_NX))
+		flags &= ~_PAGE_NX;
 
 	for (; address < end_addr; address += PAGE_SIZE) {
 		target_address = get_pa_from_mapping(address);
-- 
2.16.0.rc1.238.g530d649a79-goog

Re: [PATCH 4.4-stable v3] kaiser: Set _PAGE_NX only if supported

[Guenter Roeck]

On Fri, Jan 12, 2018 at 1:41 PM, Lepton Wu <ytht.net@gmail.com> wrote:
> This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed
> out that the reason of that crash is that NX bit get set for page tables.
> It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map
>
> Link: https://www.spinics.net/lists/kernel/msg2689835.html
>
> Signed-off-by: Lepton Wu <ytht.net@gmail.com>

Reviewed-by: Guenter Roeck <groeck@chromium.org>

Hint: You might want to version your patches; otherwise it is
difficult for the maintainer(s) to find the latest version.

Note that the fix probably also applies to v4.9 as well as to older
stable kernels.

Guenter

> ---
>  arch/x86/mm/kaiser.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
> index 6a7a77929a8c..8af98513d36c 100644
> --- a/arch/x86/mm/kaiser.c
> +++ b/arch/x86/mm/kaiser.c
> @@ -198,6 +198,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,
>          * requires that not to be #defined to 0): so mask it off here.
>          */
>         flags &= ~_PAGE_GLOBAL;
> +       if (!(__supported_pte_mask & _PAGE_NX))
> +               flags &= ~_PAGE_NX;
>
>         for (; address < end_addr; address += PAGE_SIZE) {
>                 target_address = get_pa_from_mapping(address);
> --
> 2.16.0.rc1.238.g530d649a79-goog
>

Re: [PATCH 4.4-stable v3] kaiser: Set _PAGE_NX only if supported

[lepton]

The last version is "V4" and I added it in subject.

On Fri, Jan 12, 2018 at 1:46 PM, Guenter Roeck <groeck@google.com> wrote:
> On Fri, Jan 12, 2018 at 1:41 PM, Lepton Wu <ytht.net@gmail.com> wrote:
>> This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed
>> out that the reason of that crash is that NX bit get set for page tables.
>> It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map
>>
>> Link: https://www.spinics.net/lists/kernel/msg2689835.html
>>
>> Signed-off-by: Lepton Wu <ytht.net@gmail.com>
>
> Reviewed-by: Guenter Roeck <groeck@chromium.org>
>
> Hint: You might want to version your patches; otherwise it is
> difficult for the maintainer(s) to find the latest version.
>
> Note that the fix probably also applies to v4.9 as well as to older
> stable kernels.
>
> Guenter
>
>> ---
>>  arch/x86/mm/kaiser.c | 2 ++
>>  1 file changed, 2 insertions(+)
>>
>> diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
>> index 6a7a77929a8c..8af98513d36c 100644
>> --- a/arch/x86/mm/kaiser.c
>> +++ b/arch/x86/mm/kaiser.c
>> @@ -198,6 +198,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,
>>          * requires that not to be #defined to 0): so mask it off here.
>>          */
>>         flags &= ~_PAGE_GLOBAL;
>> +       if (!(__supported_pte_mask & _PAGE_NX))
>> +               flags &= ~_PAGE_NX;
>>
>>         for (; address < end_addr; address += PAGE_SIZE) {
>>                 target_address = get_pa_from_mapping(address);
>> --
>> 2.16.0.rc1.238.g530d649a79-goog
>>

Re: [PATCH 4.4-stable v3] kaiser: Set _PAGE_NX only if supported

[lepton]

FYI, this patch also clean applied to 4.9.y tree. I guess I don't need
to send another one to 4.9 tree. Just applied it to 4.9 should be
fine.

On Fri, Jan 12, 2018 at 1:48 PM, lepton <ytht.net@gmail.com> wrote:
> The last version is "V4" and I added it in subject.
>
> On Fri, Jan 12, 2018 at 1:46 PM, Guenter Roeck <groeck@google.com> wrote:
>> On Fri, Jan 12, 2018 at 1:41 PM, Lepton Wu <ytht.net@gmail.com> wrote:
>>> This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed
>>> out that the reason of that crash is that NX bit get set for page tables.
>>> It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map
>>>
>>> Link: https://www.spinics.net/lists/kernel/msg2689835.html
>>>
>>> Signed-off-by: Lepton Wu <ytht.net@gmail.com>
>>
>> Reviewed-by: Guenter Roeck <groeck@chromium.org>
>>
>> Hint: You might want to version your patches; otherwise it is
>> difficult for the maintainer(s) to find the latest version.
>>
>> Note that the fix probably also applies to v4.9 as well as to older
>> stable kernels.
>>
>> Guenter
>>
>>> ---
>>>  arch/x86/mm/kaiser.c | 2 ++
>>>  1 file changed, 2 insertions(+)
>>>
>>> diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
>>> index 6a7a77929a8c..8af98513d36c 100644
>>> --- a/arch/x86/mm/kaiser.c
>>> +++ b/arch/x86/mm/kaiser.c
>>> @@ -198,6 +198,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,
>>>          * requires that not to be #defined to 0): so mask it off here.
>>>          */
>>>         flags &= ~_PAGE_GLOBAL;
>>> +       if (!(__supported_pte_mask & _PAGE_NX))
>>> +               flags &= ~_PAGE_NX;
>>>
>>>         for (; address < end_addr; address += PAGE_SIZE) {
>>>                 target_address = get_pa_from_mapping(address);
>>> --
>>> 2.16.0.rc1.238.g530d649a79-goog
>>>

Re: [PATCH 4.4-stable v3] kaiser: Set _PAGE_NX only if supported

[Greg Kroah-Hartman]

On Fri, Jan 12, 2018 at 03:05:10PM -0800, lepton wrote:
> FYI, this patch also clean applied to 4.9.y tree. I guess I don't need
> to send another one to 4.9 tree. Just applied it to 4.9 should be
> fine.

Now queued up to both 4.9 and 4.4 trees, many thanks for this.

greg k-h

Patch "kaiser: Set _PAGE_NX only if supported" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    kaiser: Set _PAGE_NX only if supported

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     kaiser-set-_page_nx-only-if-supported.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From ytht.net@gmail.com  Sat Jan 13 15:46:36 2018
From: Lepton Wu <ytht.net@gmail.com>
Date: Fri, 12 Jan 2018 13:42:56 -0800
Subject: kaiser: Set _PAGE_NX only if supported
To: stable@vger.kernel.org
Cc: gregkh@linuxfoundation.org, groeck@chromium.org, hshan@google.com, Lepton Wu <ytht.net@gmail.com>
Message-ID: <20180112214256.257463-1-ytht.net@gmail.com>

From: Lepton Wu <ytht.net@gmail.com>

This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed
out that the reason of that crash is that NX bit get set for page tables.
It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map

Link: https://www.spinics.net/lists/kernel/msg2689835.html

Reviewed-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Lepton Wu <ytht.net@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/mm/kaiser.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/arch/x86/mm/kaiser.c
+++ b/arch/x86/mm/kaiser.c
@@ -198,6 +198,8 @@ static int kaiser_add_user_map(const voi
 	 * requires that not to be #defined to 0): so mask it off here.
 	 */
 	flags &= ~_PAGE_GLOBAL;
+	if (!(__supported_pte_mask & _PAGE_NX))
+		flags &= ~_PAGE_NX;
 
 	for (; address < end_addr; address += PAGE_SIZE) {
 		target_address = get_pa_from_mapping(address);


Patches currently in stable-queue which might be from ytht.net@gmail.com are

queue-4.4/kaiser-set-_page_nx-only-if-supported.patch

Patch "kaiser: Set _PAGE_NX only if supported" has been added to the 4.9-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    kaiser: Set _PAGE_NX only if supported

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     kaiser-set-_page_nx-only-if-supported.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From ytht.net@gmail.com  Sat Jan 13 15:46:36 2018
From: Lepton Wu <ytht.net@gmail.com>
Date: Fri, 12 Jan 2018 13:42:56 -0800
Subject: kaiser: Set _PAGE_NX only if supported
To: stable@vger.kernel.org
Cc: gregkh@linuxfoundation.org, groeck@chromium.org, hshan@google.com, Lepton Wu <ytht.net@gmail.com>
Message-ID: <20180112214256.257463-1-ytht.net@gmail.com>

From: Lepton Wu <ytht.net@gmail.com>

This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed
out that the reason of that crash is that NX bit get set for page tables.
It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map

Link: https://www.spinics.net/lists/kernel/msg2689835.html

Reviewed-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Lepton Wu <ytht.net@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/mm/kaiser.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/arch/x86/mm/kaiser.c
+++ b/arch/x86/mm/kaiser.c
@@ -197,6 +197,8 @@ static int kaiser_add_user_map(const voi
 	 * requires that not to be #defined to 0): so mask it off here.
 	 */
 	flags &= ~_PAGE_GLOBAL;
+	if (!(__supported_pte_mask & _PAGE_NX))
+		flags &= ~_PAGE_NX;
 
 	for (; address < end_addr; address += PAGE_SIZE) {
 		target_address = get_pa_from_mapping(address);


Patches currently in stable-queue which might be from ytht.net@gmail.com are

queue-4.9/kaiser-set-_page_nx-only-if-supported.patch

Re: [PATCH 4.4-stable v3] kaiser: Set _PAGE_NX only if supported

[lepton]

FYI, I did a quick test for other recent updated linux-stable-rc tree,
it seems we also backport kaiser patch to 3.2.y and 3.16.y tree (but
not 3.18.y tree, why?),

3.2.y and 3.16.y has same issue, to fix it, these 2 branches also need
this patch. (it can clean apply).

They also need another earlier patch which has been merged to 4.4/4.9:

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/commit/?h=linux-4.4.y&id=b33c3c64c4786cd724ccde6fa97c87ada49f6a73

On Sat, Jan 13, 2018 at 6:51 AM, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> On Fri, Jan 12, 2018 at 03:05:10PM -0800, lepton wrote:
>> FYI, this patch also clean applied to 4.9.y tree. I guess I don't need
>> to send another one to 4.9 tree. Just applied it to 4.9 should be
>> fine.
>
> Now queued up to both 4.9 and 4.4 trees, many thanks for this.
>
> greg k-h

Re: [PATCH 4.4-stable v3] kaiser: Set _PAGE_NX only if supported

[Greg Kroah-Hartman]

On Sat, Jan 13, 2018 at 10:47:22AM -0800, lepton wrote:
> FYI, I did a quick test for other recent updated linux-stable-rc tree,
> it seems we also backport kaiser patch to 3.2.y and 3.16.y tree (but
> not 3.18.y tree, why?),

Because I don't want to :)

Seriously, the only people relying on 3.18 already picked the fixes up
from some other tree (i.e. the android-common tree), and I don't want to
do the x86 backport as it would be a mess and take up too much of my
time for absolutely no users.

thanks,

greg k-h

[PATCH 3.2-stable 1/2] kaiser: Set _PAGE_NX only if supported

[Juerg Haefliger]

From: Guenter Roeck <groeck@chromium.org>

This resolves a crash if loaded under qemu + haxm under windows.
See https://www.spinics.net/lists/kernel/msg2689835.html for details.
Here is a boot log (the log is from chromeos-4.4, but Tao Wu says that
the same log is also seen with vanilla v4.4.110-rc1).

[    0.712750] Freeing unused kernel memory: 552K
[    0.721821] init: Corrupted page table at address 57b029b332e0
[    0.722761] PGD 80000000bb238067 PUD bc36a067 PMD bc369067 PTE 45d2067
[    0.722761] Bad pagetable: 000b [#1] PREEMPT SMP
[    0.722761] Modules linked in:
[    0.722761] CPU: 1 PID: 1 Comm: init Not tainted 4.4.96 #31
[    0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014
[    0.722761] task: ffff8800bc290000 ti: ffff8800bc28c000 task.ti: ffff8800bc28c000
[    0.722761] RIP: 0010:[<ffffffff83f4129e>]  [<ffffffff83f4129e>] __clear_user+0x42/0x67
[    0.722761] RSP: 0000:ffff8800bc28fcf8  EFLAGS: 00010202
[    0.722761] RAX: 0000000000000000 RBX: 00000000000001a4 RCX: 00000000000001a4
[    0.722761] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000057b029b332e0
[    0.722761] RBP: ffff8800bc28fd08 R08: ffff8800bc290000 R09: ffff8800bb2f4000
[    0.722761] R10: ffff8800bc290000 R11: ffff8800bb2f4000 R12: 000057b029b332e0
[    0.722761] R13: 0000000000000000 R14: 000057b029b33340 R15: ffff8800bb1e2a00
[    0.722761] FS:  0000000000000000(0000) GS:ffff8800bfb00000(0000) knlGS:0000000000000000
[    0.722761] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[    0.722761] CR2: 000057b029b332e0 CR3: 00000000bb2f8000 CR4: 00000000000006e0
[    0.722761] Stack:
[    0.722761]  000057b029b332e0 ffff8800bb95fa80 ffff8800bc28fd18 ffffffff83f4120c
[    0.722761]  ffff8800bc28fe18 ffffffff83e9e7a1 ffff8800bc28fd68 0000000000000000
[    0.722761]  ffff8800bc290000 ffff8800bc290000 ffff8800bc290000 ffff8800bc290000
[    0.722761] Call Trace:
[    0.722761]  [<ffffffff83f4120c>] clear_user+0x2e/0x30
[    0.722761]  [<ffffffff83e9e7a1>] load_elf_binary+0xa7f/0x18f7
[    0.722761]  [<ffffffff83de2088>] search_binary_handler+0x86/0x19c
[    0.722761]  [<ffffffff83de389e>] do_execveat_common.isra.26+0x909/0xf98
[    0.722761]  [<ffffffff844febe0>] ? rest_init+0x87/0x87
[    0.722761]  [<ffffffff83de40be>] do_execve+0x23/0x25
[    0.722761]  [<ffffffff83c002e3>] run_init_process+0x2b/0x2d
[    0.722761]  [<ffffffff844fec4d>] kernel_init+0x6d/0xda
[    0.722761]  [<ffffffff84505b2f>] ret_from_fork+0x3f/0x70
[    0.722761]  [<ffffffff844febe0>] ? rest_init+0x87/0x87
[    0.722761] Code: 86 84 be 12 00 00 00 e8 87 0d e8 ff 66 66 90 48 89 d8 48 c1
eb 03 4c 89 e7 83 e0 07 48 89 d9 be 08 00 00 00 31 d2 48 85 c9 74 0a <48> 89 17
48 01 f7 ff c9 75 f6 48 89 c1 85 c9 74 09 88 17 48 ff
[    0.722761] RIP  [<ffffffff83f4129e>] __clear_user+0x42/0x67
[    0.722761]  RSP <ffff8800bc28fcf8>
[    0.722761] ---[ end trace def703879b4ff090 ]---
[    0.722761] BUG: sleeping function called from invalid context at /mnt/host/source/src/third_party/kernel/v4.4/kernel/locking/rwsem.c:21
[    0.722761] in_atomic(): 0, irqs_disabled(): 1, pid: 1, name: init
[    0.722761] CPU: 1 PID: 1 Comm: init Tainted: G      D         4.4.96 #31
[    0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014
[    0.722761]  0000000000000086 dcb5d76098c89836 ffff8800bc28fa30 ffffffff83f34004
[    0.722761]  ffffffff84839dc2 0000000000000015 ffff8800bc28fa40 ffffffff83d57dc9
[    0.722761]  ffff8800bc28fa68 ffffffff83d57e6a ffffffff84a53640 0000000000000000
[    0.722761] Call Trace:
[    0.722761]  [<ffffffff83f34004>] dump_stack+0x4d/0x63
[    0.722761]  [<ffffffff83d57dc9>] ___might_sleep+0x13a/0x13c
[    0.722761]  [<ffffffff83d57e6a>] __might_sleep+0x9f/0xa6
[    0.722761]  [<ffffffff84502788>] down_read+0x20/0x31
[    0.722761]  [<ffffffff83cc5d9b>] __blocking_notifier_call_chain+0x35/0x63
[    0.722761]  [<ffffffff83cc5ddd>] blocking_notifier_call_chain+0x14/0x16
[    0.800374] usb 1-1: new full-speed USB device number 2 using uhci_hcd
[    0.722761]  [<ffffffff83cefe97>] profile_task_exit+0x1a/0x1c
[    0.802309]  [<ffffffff83cac84e>] do_exit+0x39/0xe7f
[    0.802309]  [<ffffffff83ce5938>] ? vprintk_default+0x1d/0x1f
[    0.802309]  [<ffffffff83d7bb95>] ? printk+0x57/0x73
[    0.802309]  [<ffffffff83c46e25>] oops_end+0x80/0x85
[    0.802309]  [<ffffffff83c7b747>] pgtable_bad+0x8a/0x95
[    0.802309]  [<ffffffff83ca7f4a>] __do_page_fault+0x8c/0x352
[    0.802309]  [<ffffffff83eefba5>] ? file_has_perm+0xc4/0xe5
[    0.802309]  [<ffffffff83ca821c>] do_page_fault+0xc/0xe
[    0.802309]  [<ffffffff84507682>] page_fault+0x22/0x30
[    0.802309]  [<ffffffff83f4129e>] ? __clear_user+0x42/0x67
[    0.802309]  [<ffffffff83f4127f>] ? __clear_user+0x23/0x67
[    0.802309]  [<ffffffff83f4120c>] clear_user+0x2e/0x30
[    0.802309]  [<ffffffff83e9e7a1>] load_elf_binary+0xa7f/0x18f7
[    0.802309]  [<ffffffff83de2088>] search_binary_handler+0x86/0x19c
[    0.802309]  [<ffffffff83de389e>] do_execveat_common.isra.26+0x909/0xf98
[    0.802309]  [<ffffffff844febe0>] ? rest_init+0x87/0x87
[    0.802309]  [<ffffffff83de40be>] do_execve+0x23/0x25
[    0.802309]  [<ffffffff83c002e3>] run_init_process+0x2b/0x2d
[    0.802309]  [<ffffffff844fec4d>] kernel_init+0x6d/0xda
[    0.802309]  [<ffffffff84505b2f>] ret_from_fork+0x3f/0x70
[    0.802309]  [<ffffffff844febe0>] ? rest_init+0x87/0x87
[    0.830559] Kernel panic - not syncing: Attempted to kill init!  exitcode=0x00000009
[    0.830559]
[    0.831305] Kernel Offset: 0x2c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[    0.831305] ---[ end Kernel panic - not syncing: Attempted to kill init!  exitcode=0x00000009

The crash part of this problem may be solved with the following patch
(thanks to Hugh for the hint). There is still another problem, though -
with this patch applied, the qemu session aborts with "VCPU Shutdown
request", whatever that means.

Cc: lepton <ytht.net@gmail.com>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit b33c3c64c4786cd724ccde6fa97c87ada49f6a73 linux-4.4.y)
Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com>
---
 arch/x86/mm/kaiser.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
index a95acd4c71fa..8c95caecd330 100644
--- a/arch/x86/mm/kaiser.c
+++ b/arch/x86/mm/kaiser.c
@@ -411,7 +411,8 @@ pgd_t kaiser_set_shadow_pgd(pgd_t *pgdp, pgd_t pgd)
 			 * get out to userspace running on the kernel CR3,
 			 * userspace will crash instead of running.
 			 */
-			pgd.pgd |= _PAGE_NX;
+			if (__supported_pte_mask & _PAGE_NX)
+				pgd.pgd |= _PAGE_NX;
 		}
 	} else if (!pgd.pgd) {
 		/*
-- 
2.14.1

[PATCH 3.2-stable 2/2] kaiser: Set _PAGE_NX only if supported

[Juerg Haefliger]

From: Lepton Wu <ytht.net@gmail.com>

This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed
out that the reason of that crash is that NX bit get set for page tables.
It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map

Link: https://www.spinics.net/lists/kernel/msg2689835.html

Reviewed-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Lepton Wu <ytht.net@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(backported from Greg K-H's 4.4 stable-queue)
Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com>
---
 arch/x86/mm/kaiser.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
index 8c95caecd330..b6c645ec4906 100644
--- a/arch/x86/mm/kaiser.c
+++ b/arch/x86/mm/kaiser.c
@@ -189,6 +189,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,
 	 * requires that not to be #defined to 0): so mask it off here.
 	 */
 	flags &= ~_PAGE_GLOBAL;
+	if (!(__supported_pte_mask & _PAGE_NX))
+		flags &= ~_PAGE_NX;
 
 	if (flags & _PAGE_USER)
 		BUG_ON(address < FIXADDR_START || end_addr >= FIXADDR_TOP);
-- 
2.14.1

[PATCH 3.16-stable 1/2] kaiser: Set _PAGE_NX only if supported

[Juerg Haefliger]

From: Guenter Roeck <groeck@chromium.org>

This resolves a crash if loaded under qemu + haxm under windows.
See https://www.spinics.net/lists/kernel/msg2689835.html for details.
Here is a boot log (the log is from chromeos-4.4, but Tao Wu says that
the same log is also seen with vanilla v4.4.110-rc1).

[    0.712750] Freeing unused kernel memory: 552K
[    0.721821] init: Corrupted page table at address 57b029b332e0
[    0.722761] PGD 80000000bb238067 PUD bc36a067 PMD bc369067 PTE 45d2067
[    0.722761] Bad pagetable: 000b [#1] PREEMPT SMP
[    0.722761] Modules linked in:
[    0.722761] CPU: 1 PID: 1 Comm: init Not tainted 4.4.96 #31
[    0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014
[    0.722761] task: ffff8800bc290000 ti: ffff8800bc28c000 task.ti: ffff8800bc28c000
[    0.722761] RIP: 0010:[<ffffffff83f4129e>]  [<ffffffff83f4129e>] __clear_user+0x42/0x67
[    0.722761] RSP: 0000:ffff8800bc28fcf8  EFLAGS: 00010202
[    0.722761] RAX: 0000000000000000 RBX: 00000000000001a4 RCX: 00000000000001a4
[    0.722761] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000057b029b332e0
[    0.722761] RBP: ffff8800bc28fd08 R08: ffff8800bc290000 R09: ffff8800bb2f4000
[    0.722761] R10: ffff8800bc290000 R11: ffff8800bb2f4000 R12: 000057b029b332e0
[    0.722761] R13: 0000000000000000 R14: 000057b029b33340 R15: ffff8800bb1e2a00
[    0.722761] FS:  0000000000000000(0000) GS:ffff8800bfb00000(0000) knlGS:0000000000000000
[    0.722761] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[    0.722761] CR2: 000057b029b332e0 CR3: 00000000bb2f8000 CR4: 00000000000006e0
[    0.722761] Stack:
[    0.722761]  000057b029b332e0 ffff8800bb95fa80 ffff8800bc28fd18 ffffffff83f4120c
[    0.722761]  ffff8800bc28fe18 ffffffff83e9e7a1 ffff8800bc28fd68 0000000000000000
[    0.722761]  ffff8800bc290000 ffff8800bc290000 ffff8800bc290000 ffff8800bc290000
[    0.722761] Call Trace:
[    0.722761]  [<ffffffff83f4120c>] clear_user+0x2e/0x30
[    0.722761]  [<ffffffff83e9e7a1>] load_elf_binary+0xa7f/0x18f7
[    0.722761]  [<ffffffff83de2088>] search_binary_handler+0x86/0x19c
[    0.722761]  [<ffffffff83de389e>] do_execveat_common.isra.26+0x909/0xf98
[    0.722761]  [<ffffffff844febe0>] ? rest_init+0x87/0x87
[    0.722761]  [<ffffffff83de40be>] do_execve+0x23/0x25
[    0.722761]  [<ffffffff83c002e3>] run_init_process+0x2b/0x2d
[    0.722761]  [<ffffffff844fec4d>] kernel_init+0x6d/0xda
[    0.722761]  [<ffffffff84505b2f>] ret_from_fork+0x3f/0x70
[    0.722761]  [<ffffffff844febe0>] ? rest_init+0x87/0x87
[    0.722761] Code: 86 84 be 12 00 00 00 e8 87 0d e8 ff 66 66 90 48 89 d8 48 c1
eb 03 4c 89 e7 83 e0 07 48 89 d9 be 08 00 00 00 31 d2 48 85 c9 74 0a <48> 89 17
48 01 f7 ff c9 75 f6 48 89 c1 85 c9 74 09 88 17 48 ff
[    0.722761] RIP  [<ffffffff83f4129e>] __clear_user+0x42/0x67
[    0.722761]  RSP <ffff8800bc28fcf8>
[    0.722761] ---[ end trace def703879b4ff090 ]---
[    0.722761] BUG: sleeping function called from invalid context at /mnt/host/source/src/third_party/kernel/v4.4/kernel/locking/rwsem.c:21
[    0.722761] in_atomic(): 0, irqs_disabled(): 1, pid: 1, name: init
[    0.722761] CPU: 1 PID: 1 Comm: init Tainted: G      D         4.4.96 #31
[    0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014
[    0.722761]  0000000000000086 dcb5d76098c89836 ffff8800bc28fa30 ffffffff83f34004
[    0.722761]  ffffffff84839dc2 0000000000000015 ffff8800bc28fa40 ffffffff83d57dc9
[    0.722761]  ffff8800bc28fa68 ffffffff83d57e6a ffffffff84a53640 0000000000000000
[    0.722761] Call Trace:
[    0.722761]  [<ffffffff83f34004>] dump_stack+0x4d/0x63
[    0.722761]  [<ffffffff83d57dc9>] ___might_sleep+0x13a/0x13c
[    0.722761]  [<ffffffff83d57e6a>] __might_sleep+0x9f/0xa6
[    0.722761]  [<ffffffff84502788>] down_read+0x20/0x31
[    0.722761]  [<ffffffff83cc5d9b>] __blocking_notifier_call_chain+0x35/0x63
[    0.722761]  [<ffffffff83cc5ddd>] blocking_notifier_call_chain+0x14/0x16
[    0.800374] usb 1-1: new full-speed USB device number 2 using uhci_hcd
[    0.722761]  [<ffffffff83cefe97>] profile_task_exit+0x1a/0x1c
[    0.802309]  [<ffffffff83cac84e>] do_exit+0x39/0xe7f
[    0.802309]  [<ffffffff83ce5938>] ? vprintk_default+0x1d/0x1f
[    0.802309]  [<ffffffff83d7bb95>] ? printk+0x57/0x73
[    0.802309]  [<ffffffff83c46e25>] oops_end+0x80/0x85
[    0.802309]  [<ffffffff83c7b747>] pgtable_bad+0x8a/0x95
[    0.802309]  [<ffffffff83ca7f4a>] __do_page_fault+0x8c/0x352
[    0.802309]  [<ffffffff83eefba5>] ? file_has_perm+0xc4/0xe5
[    0.802309]  [<ffffffff83ca821c>] do_page_fault+0xc/0xe
[    0.802309]  [<ffffffff84507682>] page_fault+0x22/0x30
[    0.802309]  [<ffffffff83f4129e>] ? __clear_user+0x42/0x67
[    0.802309]  [<ffffffff83f4127f>] ? __clear_user+0x23/0x67
[    0.802309]  [<ffffffff83f4120c>] clear_user+0x2e/0x30
[    0.802309]  [<ffffffff83e9e7a1>] load_elf_binary+0xa7f/0x18f7
[    0.802309]  [<ffffffff83de2088>] search_binary_handler+0x86/0x19c
[    0.802309]  [<ffffffff83de389e>] do_execveat_common.isra.26+0x909/0xf98
[    0.802309]  [<ffffffff844febe0>] ? rest_init+0x87/0x87
[    0.802309]  [<ffffffff83de40be>] do_execve+0x23/0x25
[    0.802309]  [<ffffffff83c002e3>] run_init_process+0x2b/0x2d
[    0.802309]  [<ffffffff844fec4d>] kernel_init+0x6d/0xda
[    0.802309]  [<ffffffff84505b2f>] ret_from_fork+0x3f/0x70
[    0.802309]  [<ffffffff844febe0>] ? rest_init+0x87/0x87
[    0.830559] Kernel panic - not syncing: Attempted to kill init!  exitcode=0x00000009
[    0.830559]
[    0.831305] Kernel Offset: 0x2c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[    0.831305] ---[ end Kernel panic - not syncing: Attempted to kill init!  exitcode=0x00000009

The crash part of this problem may be solved with the following patch
(thanks to Hugh for the hint). There is still another problem, though -
with this patch applied, the qemu session aborts with "VCPU Shutdown
request", whatever that means.

Cc: lepton <ytht.net@gmail.com>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit b33c3c64c4786cd724ccde6fa97c87ada49f6a73 linux-4.4.y)
Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com>
---
 arch/x86/mm/kaiser.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
index 8d1019d176e2..2d5ac54dbcee 100644
--- a/arch/x86/mm/kaiser.c
+++ b/arch/x86/mm/kaiser.c
@@ -428,7 +428,8 @@ pgd_t kaiser_set_shadow_pgd(pgd_t *pgdp, pgd_t pgd)
 			 * get out to userspace running on the kernel CR3,
 			 * userspace will crash instead of running.
 			 */
-			pgd.pgd |= _PAGE_NX;
+			if (__supported_pte_mask & _PAGE_NX)
+				pgd.pgd |= _PAGE_NX;
 		}
 	} else if (!pgd.pgd) {
 		/*
-- 
2.14.1

[PATCH 3.16-stable 2/2] kaiser: Set _PAGE_NX only if supported

[Juerg Haefliger]

From: Lepton Wu <ytht.net@gmail.com>

This finally resolve crash if loaded under qemu + haxm. Haitao Shan pointed
out that the reason of that crash is that NX bit get set for page tables.
It seems we missed checking if _PAGE_NX is supported in kaiser_add_user_map

Link: https://www.spinics.net/lists/kernel/msg2689835.html

Reviewed-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Lepton Wu <ytht.net@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(backported from Greg K-H's 4.4 stable-queue)
Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com>
---
 arch/x86/mm/kaiser.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
index 2d5ac54dbcee..7cb57d14ddc0 100644
--- a/arch/x86/mm/kaiser.c
+++ b/arch/x86/mm/kaiser.c
@@ -195,6 +195,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size,
 	 * requires that not to be #defined to 0): so mask it off here.
 	 */
 	flags &= ~_PAGE_GLOBAL;
+	if (!(__supported_pte_mask & _PAGE_NX))
+		flags &= ~_PAGE_NX;
 
 	for (; address < end_addr; address += PAGE_SIZE) {
 		target_address = get_pa_from_mapping(address);
-- 
2.14.1

Re: [PATCH 3.16-stable 1/2] kaiser: Set _PAGE_NX only if supported

[Ben Hutchings]

[-- Attachment #1: Type: text/plain, Size: 7481 bytes --]

On Tue, 2018-01-16 at 15:19 +0100, Juerg Haefliger wrote:
> From: Guenter Roeck <groeck@chromium.org>
> 
> This resolves a crash if loaded under qemu + haxm under windows.
> See https://www.spinics.net/lists/kernel/msg2689835.html for details.
> Here is a boot log (the log is from chromeos-4.4, but Tao Wu says that
> the same log is also seen with vanilla v4.4.110-rc1).

Thanks, I've queued up these two patches for both 3.2 and 3.16.

Ben.

> [    0.712750] Freeing unused kernel memory: 552K
> [    0.721821] init: Corrupted page table at address 57b029b332e0
> [    0.722761] PGD 80000000bb238067 PUD bc36a067 PMD bc369067 PTE 45d2067
> [    0.722761] Bad pagetable: 000b [#1] PREEMPT SMP
> [    0.722761] Modules linked in:
> [    0.722761] CPU: 1 PID: 1 Comm: init Not tainted 4.4.96 #31
> [    0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014
> [    0.722761] task: ffff8800bc290000 ti: ffff8800bc28c000 task.ti: ffff8800bc28c000
> [    0.722761] RIP: 0010:[<ffffffff83f4129e>]  [<ffffffff83f4129e>] __clear_user+0x42/0x67
> [    0.722761] RSP: 0000:ffff8800bc28fcf8  EFLAGS: 00010202
> [    0.722761] RAX: 0000000000000000 RBX: 00000000000001a4 RCX: 00000000000001a4
> [    0.722761] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000057b029b332e0
> [    0.722761] RBP: ffff8800bc28fd08 R08: ffff8800bc290000 R09: ffff8800bb2f4000
> [    0.722761] R10: ffff8800bc290000 R11: ffff8800bb2f4000 R12: 000057b029b332e0
> [    0.722761] R13: 0000000000000000 R14: 000057b029b33340 R15: ffff8800bb1e2a00
> [    0.722761] FS:  0000000000000000(0000) GS:ffff8800bfb00000(0000) knlGS:0000000000000000
> [    0.722761] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [    0.722761] CR2: 000057b029b332e0 CR3: 00000000bb2f8000 CR4: 00000000000006e0
> [    0.722761] Stack:
> [    0.722761]  000057b029b332e0 ffff8800bb95fa80 ffff8800bc28fd18 ffffffff83f4120c
> [    0.722761]  ffff8800bc28fe18 ffffffff83e9e7a1 ffff8800bc28fd68 0000000000000000
> [    0.722761]  ffff8800bc290000 ffff8800bc290000 ffff8800bc290000 ffff8800bc290000
> [    0.722761] Call Trace:
> [    0.722761]  [<ffffffff83f4120c>] clear_user+0x2e/0x30
> [    0.722761]  [<ffffffff83e9e7a1>] load_elf_binary+0xa7f/0x18f7
> [    0.722761]  [<ffffffff83de2088>] search_binary_handler+0x86/0x19c
> [    0.722761]  [<ffffffff83de389e>] do_execveat_common.isra.26+0x909/0xf98
> [    0.722761]  [<ffffffff844febe0>] ? rest_init+0x87/0x87
> [    0.722761]  [<ffffffff83de40be>] do_execve+0x23/0x25
> [    0.722761]  [<ffffffff83c002e3>] run_init_process+0x2b/0x2d
> [    0.722761]  [<ffffffff844fec4d>] kernel_init+0x6d/0xda
> [    0.722761]  [<ffffffff84505b2f>] ret_from_fork+0x3f/0x70
> [    0.722761]  [<ffffffff844febe0>] ? rest_init+0x87/0x87
> [    0.722761] Code: 86 84 be 12 00 00 00 e8 87 0d e8 ff 66 66 90 48 89 d8 48 c1
> eb 03 4c 89 e7 83 e0 07 48 89 d9 be 08 00 00 00 31 d2 48 85 c9 74 0a <48> 89 17
> 48 01 f7 ff c9 75 f6 48 89 c1 85 c9 74 09 88 17 48 ff
> [    0.722761] RIP  [<ffffffff83f4129e>] __clear_user+0x42/0x67
> [    0.722761]  RSP <ffff8800bc28fcf8>
> [    0.722761] ---[ end trace def703879b4ff090 ]---
> [    0.722761] BUG: sleeping function called from invalid context at /mnt/host/source/src/third_party/kernel/v4.4/kernel/locking/rwsem.c:21
> [    0.722761] in_atomic(): 0, irqs_disabled(): 1, pid: 1, name: init
> [    0.722761] CPU: 1 PID: 1 Comm: init Tainted: G      D         4.4.96 #31
> [    0.722761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014
> [    0.722761]  0000000000000086 dcb5d76098c89836 ffff8800bc28fa30 ffffffff83f34004
> [    0.722761]  ffffffff84839dc2 0000000000000015 ffff8800bc28fa40 ffffffff83d57dc9
> [    0.722761]  ffff8800bc28fa68 ffffffff83d57e6a ffffffff84a53640 0000000000000000
> [    0.722761] Call Trace:
> [    0.722761]  [<ffffffff83f34004>] dump_stack+0x4d/0x63
> [    0.722761]  [<ffffffff83d57dc9>] ___might_sleep+0x13a/0x13c
> [    0.722761]  [<ffffffff83d57e6a>] __might_sleep+0x9f/0xa6
> [    0.722761]  [<ffffffff84502788>] down_read+0x20/0x31
> [    0.722761]  [<ffffffff83cc5d9b>] __blocking_notifier_call_chain+0x35/0x63
> [    0.722761]  [<ffffffff83cc5ddd>] blocking_notifier_call_chain+0x14/0x16
> [    0.800374] usb 1-1: new full-speed USB device number 2 using uhci_hcd
> [    0.722761]  [<ffffffff83cefe97>] profile_task_exit+0x1a/0x1c
> [    0.802309]  [<ffffffff83cac84e>] do_exit+0x39/0xe7f
> [    0.802309]  [<ffffffff83ce5938>] ? vprintk_default+0x1d/0x1f
> [    0.802309]  [<ffffffff83d7bb95>] ? printk+0x57/0x73
> [    0.802309]  [<ffffffff83c46e25>] oops_end+0x80/0x85
> [    0.802309]  [<ffffffff83c7b747>] pgtable_bad+0x8a/0x95
> [    0.802309]  [<ffffffff83ca7f4a>] __do_page_fault+0x8c/0x352
> [    0.802309]  [<ffffffff83eefba5>] ? file_has_perm+0xc4/0xe5
> [    0.802309]  [<ffffffff83ca821c>] do_page_fault+0xc/0xe
> [    0.802309]  [<ffffffff84507682>] page_fault+0x22/0x30
> [    0.802309]  [<ffffffff83f4129e>] ? __clear_user+0x42/0x67
> [    0.802309]  [<ffffffff83f4127f>] ? __clear_user+0x23/0x67
> [    0.802309]  [<ffffffff83f4120c>] clear_user+0x2e/0x30
> [    0.802309]  [<ffffffff83e9e7a1>] load_elf_binary+0xa7f/0x18f7
> [    0.802309]  [<ffffffff83de2088>] search_binary_handler+0x86/0x19c
> [    0.802309]  [<ffffffff83de389e>] do_execveat_common.isra.26+0x909/0xf98
> [    0.802309]  [<ffffffff844febe0>] ? rest_init+0x87/0x87
> [    0.802309]  [<ffffffff83de40be>] do_execve+0x23/0x25
> [    0.802309]  [<ffffffff83c002e3>] run_init_process+0x2b/0x2d
> [    0.802309]  [<ffffffff844fec4d>] kernel_init+0x6d/0xda
> [    0.802309]  [<ffffffff84505b2f>] ret_from_fork+0x3f/0x70
> [    0.802309]  [<ffffffff844febe0>] ? rest_init+0x87/0x87
> [    0.830559] Kernel panic - not syncing: Attempted to kill init!  exitcode=0x00000009
> [    0.830559]
> [    0.831305] Kernel Offset: 0x2c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
> [    0.831305] ---[ end Kernel panic - not syncing: Attempted to kill init!  exitcode=0x00000009
> 
> The crash part of this problem may be solved with the following patch
> (thanks to Hugh for the hint). There is still another problem, though -
> with this patch applied, the qemu session aborts with "VCPU Shutdown
> request", whatever that means.
> 
> Cc: lepton <ytht.net@gmail.com>
> Signed-off-by: Guenter Roeck <groeck@chromium.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> (cherry picked from commit b33c3c64c4786cd724ccde6fa97c87ada49f6a73 linux-4.4.y)
> Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com>
> ---
>  arch/x86/mm/kaiser.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c
> index 8d1019d176e2..2d5ac54dbcee 100644
> --- a/arch/x86/mm/kaiser.c
> +++ b/arch/x86/mm/kaiser.c
> @@ -428,7 +428,8 @@ pgd_t kaiser_set_shadow_pgd(pgd_t *pgdp, pgd_t pgd)
>  			 * get out to userspace running on the kernel CR3,
>  			 * userspace will crash instead of running.
>  			 */
> -			pgd.pgd |= _PAGE_NX;
> +			if (__supported_pte_mask & _PAGE_NX)
> +				pgd.pgd |= _PAGE_NX;
>  		}
>  	} else if (!pgd.pgd) {
>  		/*
-- 
Ben Hutchings
Beware of programmers who carry screwdrivers. - Leonard Brandwein


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]