Messages in this thread Patch in this message | | | From | "Yang, Bin" <> | Subject | Re: [PATCH] pstore: fix incorrect persistent ram buffer mapping | Date | Thu, 13 Sep 2018 01:21:16 +0000 |
| |
On Wed, 2018-09-12 at 10:44 -0700, Kees Cook wrote: > On Tue, Sep 11, 2018 at 8:36 PM, Bin Yang <bin.yang@intel.com> wrote: > > persistent_ram_vmap() returns the page start vaddr. > > persistent_ram_iomap() supports non-page-aligned mapping. > > Oh, yes, good catch. This should probably be explicitly mentioned in > comments for these functions. > > > persistent_ram_buffer_map() always adds offset-in-page to the vaddr > > returned from these two functions, which causes incorrect mapping of > > non-page-aligned persistent ram buffer. > > How did you find this problem, and/or how was the problem manifesting?
By default, ftrace_size is 4096 and max_ftrace_cnt is nr_cpu_ids. The zone_sz in ramoops_init_przs() is 4096/nr_cpu_ids which might not be page aligned. If the offset-in-page > 2048, the vaddr will be in next page. If the next page is not mapped, it will cause kernel panic.
I just wanted to enable this driver on my board and did not change the default value of ftrace_size. It resulted kernel panic as below:
[ 0.074231] BUG: unable to handle kernel paging request at ffffa19e0081b000 [ 0.074498] IP: persistent_ram_new+0x1f8/0x39f [ 0.074651] PGD 272eb7067 P4D 272eb7067 PUD 272eb8067 PMD 2721da067 PTE 0 [ 0.074886] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 0.075000] Modules linked in: [ 0.075000] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G U 4.14.67-94.pk414-sos #4 [ 0.075000] task: ffff96ae32f76040 task.stack: ffff96ae32f78000 [ 0.075000] RIP: 0010:persistent_ram_new+0x1f8/0x39f [ 0.075000] RSP: 0000:ffff96ae32f7bc00 EFLAGS: 00010246 [ 0.075000] RAX: ffffa19e0081a800 RBX: 0000000000040e43 RCX: ffffffffb38a7380 [ 0.075000] RDX: 0000000080000001 RSI: 0000000000000100 RDI: 00000000ffffffff [ 0.075000] RBP: ffff96ae32f7bc40 R08: ffff96ae32e7b0b0 R09: 0000000000000000 [ 0.075000] R10: 0000000000000000 R11: ffff96ae321dd900 R12: 00000000000003f4 [ 0.075000] R13: ffff96ae321ddf00 R14: ffffa19e0081b000 R15: 0000000000000000 [ 0.075000] FS: 0000000000000000(0000) GS:ffff96ae3fc00000(0000) knlGS:0000000000000000 [ 0.075000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.075000] CR2: ffffa19e0081b000 CR3: 0000000038814000 CR4: 00000000003406f0 [ 0.075000] Call Trace: [ 0.075000] ramoops_init_przs.part.10.constprop.15+0x105/0x260 [ 0.075000] ramoops_probe+0x232/0x3a0 [ 0.075000] platform_drv_probe+0x3e/0xa0 [ 0.075000] driver_probe_device+0x2cd/0x400 [ 0.075000] __driver_attach+0xe4/0x110 [ 0.075000] ? driver_probe_device+0x400/0x400 [ 0.075000] bus_for_each_dev+0x70/0xa0 [ 0.075000] driver_attach+0x1e/0x20 [ 0.075000] bus_add_driver+0x159/0x230 [ 0.075000] ? do_early_param+0x95/0x95 [ 0.075000] driver_register+0x70/0xc0 [ 0.075000] ? init_pstore_fs+0x4d/0x4d [ 0.075000] __platform_driver_register+0x36/0x40 [ 0.075000] ramoops_init+0x12f/0x131 [ 0.075000] do_one_initcall+0x4d/0x12c [ 0.075000] ? do_early_param+0x95/0x95 [ 0.075000] kernel_init_freeable+0x19b/0x222 [ 0.075000] ? rest_init+0xbb/0xbb [ 0.075000] kernel_init+0xe/0xfc [ 0.075000] ret_from_fork+0x3a/0x50 [ 0.075000] Code: 4c 89 f2 49 c7 45 60 00 00 00 00 49 8d 7d 58 e8 af f6 ff ff 85 c0 89 c3 0f 8f 96 02 00 00 0f 85 ab 02 00 00 4d 8b 75 18 8b 5d cc <41> 8b 16 81 f3 44 42 47 43 39 d3 0f [ 0.075000] RIP: persistent_ram_new+0x1f8/0x39f RSP: ffff96ae32f7bc00 [ 0.075000] CR2: ffffa19e0081b000 [ 0.075000] ---[ end trace a92ad58b000ab3fe ]--- [ 0.075000] Kernel panic - not syncing: Fatal exception [ 0.075000] reboot: panic mode set: p,w [ 0.075000] Rebooting in 10 seconds..
> > > Signed-off-by: Bin Yang <bin.yang@intel.com> > > --- > > fs/pstore/ram_core.c | 6 +++--- > > 1 file changed, 3 insertions(+), 3 deletions(-) > > > > diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c > > index 951a14e..7c05fdd 100644 > > --- a/fs/pstore/ram_core.c > > +++ b/fs/pstore/ram_core.c > > @@ -429,7 +429,7 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, > > vaddr = vmap(pages, page_count, VM_MAP, prot); > > kfree(pages); > > > > - return vaddr; > > + return vaddr + offset_in_page(start); > > } > > > > static void *persistent_ram_iomap(phys_addr_t start, size_t size, > > @@ -468,7 +468,7 @@ static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size, > > return -ENOMEM; > > } > > > > - prz->buffer = prz->vaddr + offset_in_page(start); > > + prz->buffer = prz->vaddr; > > prz->buffer_size = size - sizeof(struct persistent_ram_buffer); > > > > return 0; > > @@ -515,7 +515,7 @@ void persistent_ram_free(struct persistent_ram_zone *prz) > > > > if (prz->vaddr) { > > if (pfn_valid(prz->paddr >> PAGE_SHIFT)) { > > - vunmap(prz->vaddr); > > + vunmap(prz->vaddr - offset_in_page(prz->paddr)); > > } else { > > iounmap(prz->vaddr); > > release_mem_region(prz->paddr, prz->size); > > -- > > 2.7.4 > > > > Regardless, yes, this patch looks correct. Thanks! I'll add it to my tree.
thanks
> > -Kees >
| |