• Baoquan He's avatar
    x86/mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds() · d9efa9db
    Baoquan He authored
    commit fc5f9d5f upstream.
    
    Jeff Moyer reported that on his system with two memory regions 0~64G and
    1T~1T+192G, and kernel option "memmap=192G!1024G" added, enabling KASLR
    will make the system hang intermittently during boot. While adding 'nokaslr'
    won't.
    
    The back trace is:
    
     Oops: 0000 [#1] SMP
    
     RIP: memcpy_erms()
     [ .... ]
     Call Trace:
      pmem_rw_page()
      bdev_read_page()
      do_mpage_readpage()
      mpage_readpages()
      blkdev_readpages()
      __do_page_cache_readahead()
      force_page_cache_readahead()
      page_cache_sync_readahead()
      generic_file_read_iter()
      blkdev_read_iter()
      __vfs_read()
      vfs_read()
      SyS_read()
      entry_SYSCALL_64_fastpath()
    
    This crash happens because the for loop count calculation in sync_global_pgds()
    is not correct. When a mapping area crosses PGD entries, we should
    calculate the starting address of region which next PGD covers and assign
    it to next for loop count, but not add PGDIR_SIZE directly. The old
    code works right only if the mapping area is an exact multiple of PGDIR_SIZE,
    otherwize the end region could be skipped so that it can't be synchronized
    to all other processes from kernel PGD init_mm.pgd.
    
    In Jeff's system, emulated pmem area [1024G, 1216G) is smaller than
    PGDIR_SIZE. While 'nokaslr' works because PAGE_OFFSET is 1T aligned, it
    makes this area be mapped inside one PGD entry. With KASLR enabled,
    this area could cross two PGD entries, then the next PGD entry won't
    be synced to all other processes. That is why we saw empty PGD.
    
    Fix it.
    Reported-by: default avatarJeff Moyer <jmoyer@redhat.com>
    Signed-off-by: default avatarBaoquan He <bhe@redhat.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Brian Gerst <brgerst@gmail.com>
    Cc: Dan Williams <dan.j.williams@intel.com>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: Dave Young <dyoung@redhat.com>
    Cc: Denys Vlasenko <dvlasenk@redhat.com>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Jinbum Park <jinb.park7@gmail.com>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Garnier <thgarnie@google.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Yasuaki Ishimatsu <yasu.isimatu@gmail.com>
    Cc: Yinghai Lu <yinghai@kernel.org>
    Link: http://lkml.kernel.org/r/1493864747-8506-1-git-send-email-bhe@redhat.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
    Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    d9efa9db
init_64.c 32 KB