From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F7E7C2BA12 for ; Wed, 1 Apr 2020 13:00:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2C36220776 for ; Wed, 1 Apr 2020 13:00:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585746033; bh=aKcChnMzoou54YyNYcC3aIadzStZalwDLAZ1iiS7gAM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=dxTJhvptPN9rJzIHgaA1MsOnSNl8JJFPJQdvw58DDpI2YfV2coXPfA+wA2y8kGUtb bqsUi7tGV3NNgqJiyPZULQ/6vWaWSiOHHpwACPfPIhvbt10g728yj5zTYDtTf8Q2RO iYhTTxSo+nH0adSqi5DG5T3ALJgr7TPV5l2++rCY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732370AbgDANAc (ORCPT ); Wed, 1 Apr 2020 09:00:32 -0400 Received: from mail.kernel.org ([198.145.29.99]:51810 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732566AbgDANAb (ORCPT ); Wed, 1 Apr 2020 09:00:31 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DACE1206E9; Wed, 1 Apr 2020 13:00:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585746030; bh=aKcChnMzoou54YyNYcC3aIadzStZalwDLAZ1iiS7gAM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=FIxUCd0/qNNDucEpzNY7bOK3MWK8205feDqT3/vgM+qcDpX2w4WEJzqYzRSFhOucR ME2ar5Xj0S7yKzbLqOOdgdeVGcrFDxYU9IDK/pIDE321tJZWZ2c5SEPvktLbCNU79t YnUCpnaTFD+PYbYhfnd/st9Vtcn1zPcephJSn/8s= Date: Wed, 1 Apr 2020 15:00:28 +0200 From: Greg KH To: Zhuang Yanying Cc: pbonzini@redhat.com, tv@lio96.de, stable@vger.kernel.org, LinFeng Subject: Re: [PATCH 1/2] KVM: fix overflow of zero page refcount with ksm running Message-ID: <20200401130028.GC2262255@kroah.com> References: <1585745456-24340-1-git-send-email-ann.zhuangyanying@huawei.com> <1585745456-24340-2-git-send-email-ann.zhuangyanying@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1585745456-24340-2-git-send-email-ann.zhuangyanying@huawei.com> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org On Wed, Apr 01, 2020 at 08:50:55PM +0800, Zhuang Yanying wrote: > We are testing Virtual Machine with KSM on v5.4-rc2 kernel, > and found the zero_page refcount overflow. > The cause of refcount overflow is increased in try_async_pf > (get_user_page) without being decreased in mmu_set_spte() > while handling ept violation. > In kvm_release_pfn_clean(), only unreserved page will call > put_page. However, zero page is reserved. > So, as well as creating and destroy vm, the refcount of > zero page will continue to increase until it overflows. > > step1: > echo 10000 > /sys/kernel/mm/ksm/pages_to_scan > echo 1 > /sys/kernel/mm/ksm/run > echo 1 > /sys/kernel/mm/ksm/use_zero_pages > > step2: > just create several normal qemu kvm vms. > And destroy it after 10s. > Repeat this action all the time. > > After a long period of time, all domains hang because > of the refcount of zero page overflow. > > Qemu print error log as follow: > error: kvm run failed Bad address > EAX=00006cdc EBX=00000008 ECX=80202001 EDX=078bfbfd > ESI=ffffffff EDI=00000000 EBP=00000008 ESP=00006cc4 > EIP=000efd75 EFL=00010002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 > ES =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA] > CS =0008 00000000 ffffffff 00c09b00 DPL=0 CS32 [-RA] > SS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA] > DS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA] > FS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA] > GS =0010 00000000 ffffffff 00c09300 DPL=0 DS [-WA] > LDT=0000 00000000 0000ffff 00008200 DPL=0 LDT > TR =0000 00000000 0000ffff 00008b00 DPL=0 TSS32-busy > GDT= 000f7070 00000037 > IDT= 000f70ae 00000000 > CR0=00000011 CR2=00000000 CR3=00000000 CR4=00000000 > DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 > DR6=00000000ffff0ff0 DR7=0000000000000400 > EFER=0000000000000000 > Code=00 01 00 00 00 e9 e8 00 00 00 c7 05 4c 55 0f 00 01 00 00 00 <8b> 35 00 00 01 00 8b 3d 04 00 01 00 b8 d8 d3 00 00 c1 e0 08 0c ea a3 00 00 01 00 c7 05 04 > > Meanwhile, a kernel warning is departed. > > [40914.836375] WARNING: CPU: 3 PID: 82067 at ./include/linux/mm.h:987 try_get_page+0x1f/0x30 > [40914.836412] CPU: 3 PID: 82067 Comm: CPU 0/KVM Kdump: loaded Tainted: G OE 5.2.0-rc2 #5 > [40914.836415] RIP: 0010:try_get_page+0x1f/0x30 > [40914.836417] Code: 40 00 c3 0f 1f 84 00 00 00 00 00 48 8b 47 08 a8 01 75 11 8b 47 34 85 c0 7e 10 f0 ff 47 34 b8 01 00 00 00 c3 48 8d 78 ff eb e9 <0f> 0b 31 c0 c3 66 90 66 2e 0f 1f 84 00 0 > 0 00 00 00 48 8b 47 08 a8 > [40914.836418] RSP: 0018:ffffb4144e523988 EFLAGS: 00010286 > [40914.836419] RAX: 0000000080000000 RBX: 0000000000000326 RCX: 0000000000000000 > [40914.836420] RDX: 0000000000000000 RSI: 00004ffdeba10000 RDI: ffffdf07093f6440 > [40914.836421] RBP: ffffdf07093f6440 R08: 800000424fd91225 R09: 0000000000000000 > [40914.836421] R10: ffff9eb41bfeebb8 R11: 0000000000000000 R12: ffffdf06bbd1e8a8 > [40914.836422] R13: 0000000000000080 R14: 800000424fd91225 R15: ffffdf07093f6440 > [40914.836423] FS: 00007fb60ffff700(0000) GS:ffff9eb4802c0000(0000) knlGS:0000000000000000 > [40914.836425] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [40914.836426] CR2: 0000000000000000 CR3: 0000002f220e6002 CR4: 00000000003626e0 > [40914.836427] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > [40914.836427] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > [40914.836428] Call Trace: > [40914.836433] follow_page_pte+0x302/0x47b > [40914.836437] __get_user_pages+0xf1/0x7d0 > [40914.836441] ? irq_work_queue+0x9/0x70 > [40914.836443] get_user_pages_unlocked+0x13f/0x1e0 > [40914.836469] __gfn_to_pfn_memslot+0x10e/0x400 [kvm] > [40914.836486] try_async_pf+0x87/0x240 [kvm] > [40914.836503] tdp_page_fault+0x139/0x270 [kvm] > [40914.836523] kvm_mmu_page_fault+0x76/0x5e0 [kvm] > [40914.836588] vcpu_enter_guest+0xb45/0x1570 [kvm] > [40914.836632] kvm_arch_vcpu_ioctl_run+0x35d/0x580 [kvm] > [40914.836645] kvm_vcpu_ioctl+0x26e/0x5d0 [kvm] > [40914.836650] do_vfs_ioctl+0xa9/0x620 > [40914.836653] ksys_ioctl+0x60/0x90 > [40914.836654] __x64_sys_ioctl+0x16/0x20 > [40914.836658] do_syscall_64+0x5b/0x180 > [40914.836664] entry_SYSCALL_64_after_hwframe+0x44/0xa9 > [40914.836666] RIP: 0033:0x7fb61cb6bfc7 > > Signed-off-by: LinFeng > Signed-off-by: Zhuang Yanying > --- > virt/kvm/kvm_main.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c > index 7e80f62f034c..7f7c22a687c0 100644 > --- a/virt/kvm/kvm_main.c > +++ b/virt/kvm/kvm_main.c > @@ -133,7 +133,8 @@ static bool largepages_enabled = true; > bool kvm_is_reserved_pfn(kvm_pfn_t pfn) > { > if (pfn_valid(pfn)) > - return PageReserved(pfn_to_page(pfn)); > + return PageReserved(pfn_to_page(pfn)) && > + !is_zero_pfn(pfn); > > return true; > } > -- > 2.23.0 > > This is not the correct way to submit patches for inclusion in the stable kernel tree. Please read: https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html for how to do this properly.