• Hari Bathini's avatar
    powerpc/fadump: handle crash memory ranges array index overflow · 1bd6a1c4
    Hari Bathini authored
    Crash memory ranges is an array of memory ranges of the crashing kernel
    to be exported as a dump via /proc/vmcore file. The size of the array
    is set based on INIT_MEMBLOCK_REGIONS, which works alright in most cases
    where memblock memory regions count is less than INIT_MEMBLOCK_REGIONS
    value. But this count can grow beyond INIT_MEMBLOCK_REGIONS value since
    commit 142b45a7 ("memblock: Add array resizing support").
    
    On large memory systems with a few DLPAR operations, the memblock memory
    regions count could be larger than INIT_MEMBLOCK_REGIONS value. On such
    systems, registering fadump results in crash or other system failures
    like below:
    
      task: c00007f39a290010 ti: c00000000b738000 task.ti: c00000000b738000
      NIP: c000000000047df4 LR: c0000000000f9e58 CTR: c00000000010f180
      REGS: c00000000b73b570 TRAP: 0300   Tainted: G          L   X  (4.4.140+)
      MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE>  CR: 22004484  XER: 20000000
      CFAR: c000000000008500 DAR: 000007a450000000 DSISR: 40000000 SOFTE: 0
      ...
      NIP [c000000000047df4] smp_send_reschedule+0x24/0x80
      LR [c0000000000f9e58] resched_curr+0x138/0x160
      Call Trace:
        resched_curr+0x138/0x160 (unreliable)
        check_preempt_curr+0xc8/0xf0
        ttwu_do_wakeup+0x38/0x150
        try_to_wake_up+0x224/0x4d0
        __wake_up_common+0x94/0x100
        ep_poll_callback+0xac/0x1c0
        __wake_up_common+0x94/0x100
        __wake_up_sync_key+0x70/0xa0
        sock_def_readable+0x58/0xa0
        unix_stream_sendmsg+0x2dc/0x4c0
        sock_sendmsg+0x68/0xa0
        ___sys_sendmsg+0x2cc/0x2e0
        __sys_sendmsg+0x5c/0xc0
        SyS_socketcall+0x36c/0x3f0
        system_call+0x3c/0x100
    
    as array index overflow is not checked for while setting up crash memory
    ranges causing memory corruption. To resolve this issue, dynamically
    allocate memory for crash memory ranges and resize it incrementally,
    in units of pagesize, on hitting array size limit.
    
    Fixes: 2df173d9 ("fadump: Initialize elfcore header and add PT_LOAD program headers.")
    Cc: stable@vger.kernel.org # v3.4+
    Signed-off-by: default avatarHari Bathini <hbathini@linux.ibm.com>
    Reviewed-by: default avatarMahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
    [mpe: Just use PAGE_SIZE directly, fixup variable placement]
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    1bd6a1c4
fadump.h 6.1 KB