| Message ID | 20241219121828.2120780-1-gal@nvidia.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | percpu: Remove intermediate variable in PERCPU_PTR() | expand |
On Thu, Dec 19, 2024 at 1:18 PM Gal Pressman <gal@nvidia.com> wrote: > > The intermediate variable in the PERCPU_PTR() macro results in a kernel > panic on boot [1] due to a compiler bug seen when compiling the kernel > (+ KASAN) with gcc 11.3.1, but not when compiling with latest gcc > (v14.2)/clang(v18.1). > > To solve it, remove the intermediate variable (which is not needed) and > keep the casting that resolves the address space checks. > > [1] > Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] SMP KASAN > KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] > CPU: 0 UID: 0 PID: 547 Comm: iptables Not tainted 6.13.0-rc1_external_tested-master #1 > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 > RIP: 0010:nf_ct_netns_do_get+0x139/0x540 > Code: 03 00 00 48 81 c4 88 00 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f c3 4d 8d 75 08 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 27 03 00 00 41 8b 45 08 83 c0 > RSP: 0018:ffff888116df75e8 EFLAGS: 00010207 > RAX: dffffc0000000000 RBX: 1ffff11022dbeebe RCX: ffffffff839a2382 > RDX: 0000000000000003 RSI: 0000000000000008 RDI: ffff88842ec46d10 > RBP: 0000000000000002 R08: 0000000000000000 R09: fffffbfff0b0860c > R10: ffff888116df75e8 R11: 0000000000000001 R12: ffffffff879d6a80 > R13: 0000000000000016 R14: 000000000000001e R15: ffff888116df7908 > FS: 00007fba01646740(0000) GS:ffff88842ec00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 000055bd901800d8 CR3: 00000001205f0003 CR4: 0000000000172eb0 > Call Trace: > <TASK> > ? die_addr+0x3d/0xa0 > ? exc_general_protection+0x144/0x220 > ? asm_exc_general_protection+0x22/0x30 > ? __mutex_lock+0x2c2/0x1d70 > ? nf_ct_netns_do_get+0x139/0x540 > ? nf_ct_netns_do_get+0xb5/0x540 > ? net_generic+0x1f0/0x1f0 > ? __create_object+0x5e/0x80 > xt_check_target+0x1f0/0x930 > ? textify_hooks.constprop.0+0x110/0x110 > ? pcpu_alloc_noprof+0x7cd/0xcf0 > ? xt_find_target+0x148/0x1e0 > find_check_entry.constprop.0+0x6c0/0x920 > ? get_info+0x380/0x380 > ? __virt_addr_valid+0x1df/0x3b0 > ? kasan_quarantine_put+0xe3/0x200 > ? kfree+0x13e/0x3d0 > ? translate_table+0xaf5/0x1750 > translate_table+0xbd8/0x1750 > ? ipt_unregister_table_exit+0x30/0x30 > ? __might_fault+0xbb/0x170 > do_ipt_set_ctl+0x408/0x1340 > ? nf_sockopt_find.constprop.0+0x17b/0x1f0 > ? lock_downgrade+0x680/0x680 > ? lockdep_hardirqs_on_prepare+0x284/0x400 > ? ipt_register_table+0x440/0x440 > ? bit_wait_timeout+0x160/0x160 > nf_setsockopt+0x6f/0xd0 > raw_setsockopt+0x7e/0x200 > ? raw_bind+0x590/0x590 > ? do_user_addr_fault+0x812/0xd20 > do_sock_setsockopt+0x1e2/0x3f0 > ? move_addr_to_user+0x90/0x90 > ? lock_downgrade+0x680/0x680 > __sys_setsockopt+0x9e/0x100 > __x64_sys_setsockopt+0xb9/0x150 > ? do_syscall_64+0x33/0x140 > do_syscall_64+0x6d/0x140 > entry_SYSCALL_64_after_hwframe+0x4b/0x53 > RIP: 0033:0x7fba015134ce > Code: 0f 1f 40 00 48 8b 15 59 69 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b1 0f 1f 00 f3 0f 1e fa 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 21 > RSP: 002b:00007ffd9de6f388 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 > RAX: ffffffffffffffda RBX: 000055bd9017f490 RCX: 00007fba015134ce > RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004 > RBP: 0000000000000500 R08: 0000000000000560 R09: 0000000000000052 > R10: 000055bd901800e0 R11: 0000000000000246 R12: 000055bd90180140 > R13: 000055bd901800e0 R14: 000055bd9017f498 R15: 000055bd9017ff10 > </TASK> > Modules linked in: xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc mlx4_ib mlx4_en mlx4_core rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi fuse ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_core > ---[ end trace 0000000000000000 ]--- > > Fixes: dabddd687c9e ("percpu: cast percpu pointer in PERCPU_PTR() via unsigned long") > Closes: https://lore.kernel.org/all/7590f546-4021-4602-9252-0d525de35b52@nvidia.com > Cc: Uros Bizjak <ubizjak@gmail.com> > Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Uros Bizjak <ubizjak@gmail.com> > --- > include/linux/percpu-defs.h | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/include/linux/percpu-defs.h b/include/linux/percpu-defs.h > index 35842d1e3879..573adb643d90 100644 > --- a/include/linux/percpu-defs.h > +++ b/include/linux/percpu-defs.h > @@ -222,8 +222,7 @@ do { \ > > #define PERCPU_PTR(__p) \ > ({ \ > - unsigned long __pcpu_ptr = (__force unsigned long)(__p); \ > - (typeof(*(__p)) __force __kernel *)(__pcpu_ptr); \ > + (typeof(*(__p)) __force __kernel *)((__force unsigned long)(__p)); \ > }) > > #ifdef CONFIG_SMP > -- > 2.40.1 >
On Thu, Dec 19, 2024 at 1:30 PM Uros Bizjak <ubizjak@gmail.com> wrote: > > On Thu, Dec 19, 2024 at 1:18 PM Gal Pressman <gal@nvidia.com> wrote: > > > > The intermediate variable in the PERCPU_PTR() macro results in a kernel > > panic on boot [1] due to a compiler bug seen when compiling the kernel > > (+ KASAN) with gcc 11.3.1, but not when compiling with latest gcc > > (v14.2)/clang(v18.1). > > > > To solve it, remove the intermediate variable (which is not needed) and > > keep the casting that resolves the address space checks. > > > > [1] > > Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] SMP KASAN > > KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] > > CPU: 0 UID: 0 PID: 547 Comm: iptables Not tainted 6.13.0-rc1_external_tested-master #1 > > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 > > RIP: 0010:nf_ct_netns_do_get+0x139/0x540 > > Code: 03 00 00 48 81 c4 88 00 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f c3 4d 8d 75 08 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 27 03 00 00 41 8b 45 08 83 c0 > > RSP: 0018:ffff888116df75e8 EFLAGS: 00010207 > > RAX: dffffc0000000000 RBX: 1ffff11022dbeebe RCX: ffffffff839a2382 > > RDX: 0000000000000003 RSI: 0000000000000008 RDI: ffff88842ec46d10 > > RBP: 0000000000000002 R08: 0000000000000000 R09: fffffbfff0b0860c > > R10: ffff888116df75e8 R11: 0000000000000001 R12: ffffffff879d6a80 > > R13: 0000000000000016 R14: 000000000000001e R15: ffff888116df7908 > > FS: 00007fba01646740(0000) GS:ffff88842ec00000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 000055bd901800d8 CR3: 00000001205f0003 CR4: 0000000000172eb0 > > Call Trace: > > <TASK> > > ? die_addr+0x3d/0xa0 > > ? exc_general_protection+0x144/0x220 > > ? asm_exc_general_protection+0x22/0x30 > > ? __mutex_lock+0x2c2/0x1d70 > > ? nf_ct_netns_do_get+0x139/0x540 > > ? nf_ct_netns_do_get+0xb5/0x540 > > ? net_generic+0x1f0/0x1f0 > > ? __create_object+0x5e/0x80 > > xt_check_target+0x1f0/0x930 > > ? textify_hooks.constprop.0+0x110/0x110 > > ? pcpu_alloc_noprof+0x7cd/0xcf0 > > ? xt_find_target+0x148/0x1e0 > > find_check_entry.constprop.0+0x6c0/0x920 > > ? get_info+0x380/0x380 > > ? __virt_addr_valid+0x1df/0x3b0 > > ? kasan_quarantine_put+0xe3/0x200 > > ? kfree+0x13e/0x3d0 > > ? translate_table+0xaf5/0x1750 > > translate_table+0xbd8/0x1750 > > ? ipt_unregister_table_exit+0x30/0x30 > > ? __might_fault+0xbb/0x170 > > do_ipt_set_ctl+0x408/0x1340 > > ? nf_sockopt_find.constprop.0+0x17b/0x1f0 > > ? lock_downgrade+0x680/0x680 > > ? lockdep_hardirqs_on_prepare+0x284/0x400 > > ? ipt_register_table+0x440/0x440 > > ? bit_wait_timeout+0x160/0x160 > > nf_setsockopt+0x6f/0xd0 > > raw_setsockopt+0x7e/0x200 > > ? raw_bind+0x590/0x590 > > ? do_user_addr_fault+0x812/0xd20 > > do_sock_setsockopt+0x1e2/0x3f0 > > ? move_addr_to_user+0x90/0x90 > > ? lock_downgrade+0x680/0x680 > > __sys_setsockopt+0x9e/0x100 > > __x64_sys_setsockopt+0xb9/0x150 > > ? do_syscall_64+0x33/0x140 > > do_syscall_64+0x6d/0x140 > > entry_SYSCALL_64_after_hwframe+0x4b/0x53 > > RIP: 0033:0x7fba015134ce > > Code: 0f 1f 40 00 48 8b 15 59 69 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b1 0f 1f 00 f3 0f 1e fa 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 21 > > RSP: 002b:00007ffd9de6f388 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 > > RAX: ffffffffffffffda RBX: 000055bd9017f490 RCX: 00007fba015134ce > > RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004 > > RBP: 0000000000000500 R08: 0000000000000560 R09: 0000000000000052 > > R10: 000055bd901800e0 R11: 0000000000000246 R12: 000055bd90180140 > > R13: 000055bd901800e0 R14: 000055bd9017f498 R15: 000055bd9017ff10 > > </TASK> > > Modules linked in: xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc mlx4_ib mlx4_en mlx4_core rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi fuse ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_core > > ---[ end trace 0000000000000000 ]--- > > > > Fixes: dabddd687c9e ("percpu: cast percpu pointer in PERCPU_PTR() via unsigned long") > > Closes: https://lore.kernel.org/all/7590f546-4021-4602-9252-0d525de35b52@nvidia.com > > Cc: Uros Bizjak <ubizjak@gmail.com> > > Signed-off-by: Gal Pressman <gal@nvidia.com> > > Reviewed-by: Uros Bizjak <ubizjak@gmail.com> > > > --- > > include/linux/percpu-defs.h | 3 +-- > > 1 file changed, 1 insertion(+), 2 deletions(-) > > > > diff --git a/include/linux/percpu-defs.h b/include/linux/percpu-defs.h > > index 35842d1e3879..573adb643d90 100644 > > --- a/include/linux/percpu-defs.h > > +++ b/include/linux/percpu-defs.h > > @@ -222,8 +222,7 @@ do { \ > > > > #define PERCPU_PTR(__p) \ > > ({ \ > > - unsigned long __pcpu_ptr = (__force unsigned long)(__p); \ > > - (typeof(*(__p)) __force __kernel *)(__pcpu_ptr); \ > > + (typeof(*(__p)) __force __kernel *)((__force unsigned long)(__p)); \ > > }) Actually, you can simplify the above a bit by writing it as: #define PERCPU_PTR(__p) \ ((typeof(*(__p)) __force __kernel *)(__force unsigned long)(__p)) \ Uros.
On Thu, Dec 19, 2024 at 5:02 PM Uros Bizjak <ubizjak@gmail.com> wrote: > > > The intermediate variable in the PERCPU_PTR() macro results in a kernel > > > panic on boot [1] due to a compiler bug seen when compiling the kernel > > > (+ KASAN) with gcc 11.3.1, but not when compiling with latest gcc > > > (v14.2)/clang(v18.1). > > > > > > To solve it, remove the intermediate variable (which is not needed) and > > > keep the casting that resolves the address space checks. [...] > > > include/linux/percpu-defs.h | 3 +-- > > > 1 file changed, 1 insertion(+), 2 deletions(-) > > > > > > diff --git a/include/linux/percpu-defs.h b/include/linux/percpu-defs.h > > > index 35842d1e3879..573adb643d90 100644 > > > --- a/include/linux/percpu-defs.h > > > +++ b/include/linux/percpu-defs.h > > > @@ -222,8 +222,7 @@ do { \ > > > > > > #define PERCPU_PTR(__p) \ > > > ({ \ > > > - unsigned long __pcpu_ptr = (__force unsigned long)(__p); \ > > > - (typeof(*(__p)) __force __kernel *)(__pcpu_ptr); \ > > > + (typeof(*(__p)) __force __kernel *)((__force unsigned long)(__p)); \ > > > }) > > Actually, you can simplify the above a bit by writing it as: > > #define PERCPU_PTR(__p) \ > ((typeof(*(__p)) __force __kernel *)(__force unsigned long)(__p)) \ Andrew, please find attached a substitute patch "[PATCH 4/6] percpu: Use TYPEOF_UNQUAL() in *_cpu_ptr() accessors" for your MM tree relative to the above hotfix. The whole patch series (+ hotfix) has been re-tested against the current mainline defconfig (+ KASAN), compiled once with gcc-11.4.1 and once with gcc-14.2.1. Uros.
On Thu, 19 Dec 2024 18:03:47 +0100 Uros Bizjak <ubizjak@gmail.com> wrote: > > Actually, you can simplify the above a bit by writing it as: > > > > #define PERCPU_PTR(__p) \ > > ((typeof(*(__p)) __force __kernel *)(__force unsigned long)(__p)) \ > > Andrew, please find attached a substitute patch "[PATCH 4/6] percpu: > Use TYPEOF_UNQUAL() in *_cpu_ptr() accessors" for your MM tree > relative to the above hotfix. The whole patch series (+ hotfix) has > been re-tested against the current mainline defconfig (+ KASAN), > compiled once with gcc-11.4.1 and once with gcc-14.2.1. Updated, thanks. > #define PERCPU_PTR(__p) \ > - ((typeof(*(__p)) __force __kernel *)(__force unsigned long)(__p)) \ > + ((TYPEOF_UNQUAL(*(__p)) __force __kernel *)(__force unsigned long)(__p)) \ > I removed that final " \".
diff --git a/include/linux/percpu-defs.h b/include/linux/percpu-defs.h index 35842d1e3879..573adb643d90 100644 --- a/include/linux/percpu-defs.h +++ b/include/linux/percpu-defs.h @@ -222,8 +222,7 @@ do { \ #define PERCPU_PTR(__p) \ ({ \ - unsigned long __pcpu_ptr = (__force unsigned long)(__p); \ - (typeof(*(__p)) __force __kernel *)(__pcpu_ptr); \ + (typeof(*(__p)) __force __kernel *)((__force unsigned long)(__p)); \ }) #ifdef CONFIG_SMP
The intermediate variable in the PERCPU_PTR() macro results in a kernel panic on boot [1] due to a compiler bug seen when compiling the kernel (+ KASAN) with gcc 11.3.1, but not when compiling with latest gcc (v14.2)/clang(v18.1). To solve it, remove the intermediate variable (which is not needed) and keep the casting that resolves the address space checks. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 0 UID: 0 PID: 547 Comm: iptables Not tainted 6.13.0-rc1_external_tested-master #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:nf_ct_netns_do_get+0x139/0x540 Code: 03 00 00 48 81 c4 88 00 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f c3 4d 8d 75 08 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 27 03 00 00 41 8b 45 08 83 c0 RSP: 0018:ffff888116df75e8 EFLAGS: 00010207 RAX: dffffc0000000000 RBX: 1ffff11022dbeebe RCX: ffffffff839a2382 RDX: 0000000000000003 RSI: 0000000000000008 RDI: ffff88842ec46d10 RBP: 0000000000000002 R08: 0000000000000000 R09: fffffbfff0b0860c R10: ffff888116df75e8 R11: 0000000000000001 R12: ffffffff879d6a80 R13: 0000000000000016 R14: 000000000000001e R15: ffff888116df7908 FS: 00007fba01646740(0000) GS:ffff88842ec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055bd901800d8 CR3: 00000001205f0003 CR4: 0000000000172eb0 Call Trace: <TASK> ? die_addr+0x3d/0xa0 ? exc_general_protection+0x144/0x220 ? asm_exc_general_protection+0x22/0x30 ? __mutex_lock+0x2c2/0x1d70 ? nf_ct_netns_do_get+0x139/0x540 ? nf_ct_netns_do_get+0xb5/0x540 ? net_generic+0x1f0/0x1f0 ? __create_object+0x5e/0x80 xt_check_target+0x1f0/0x930 ? textify_hooks.constprop.0+0x110/0x110 ? pcpu_alloc_noprof+0x7cd/0xcf0 ? xt_find_target+0x148/0x1e0 find_check_entry.constprop.0+0x6c0/0x920 ? get_info+0x380/0x380 ? __virt_addr_valid+0x1df/0x3b0 ? kasan_quarantine_put+0xe3/0x200 ? kfree+0x13e/0x3d0 ? translate_table+0xaf5/0x1750 translate_table+0xbd8/0x1750 ? ipt_unregister_table_exit+0x30/0x30 ? __might_fault+0xbb/0x170 do_ipt_set_ctl+0x408/0x1340 ? nf_sockopt_find.constprop.0+0x17b/0x1f0 ? lock_downgrade+0x680/0x680 ? lockdep_hardirqs_on_prepare+0x284/0x400 ? ipt_register_table+0x440/0x440 ? bit_wait_timeout+0x160/0x160 nf_setsockopt+0x6f/0xd0 raw_setsockopt+0x7e/0x200 ? raw_bind+0x590/0x590 ? do_user_addr_fault+0x812/0xd20 do_sock_setsockopt+0x1e2/0x3f0 ? move_addr_to_user+0x90/0x90 ? lock_downgrade+0x680/0x680 __sys_setsockopt+0x9e/0x100 __x64_sys_setsockopt+0xb9/0x150 ? do_syscall_64+0x33/0x140 do_syscall_64+0x6d/0x140 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7fba015134ce Code: 0f 1f 40 00 48 8b 15 59 69 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b1 0f 1f 00 f3 0f 1e fa 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 21 RSP: 002b:00007ffd9de6f388 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 000055bd9017f490 RCX: 00007fba015134ce RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004 RBP: 0000000000000500 R08: 0000000000000560 R09: 0000000000000052 R10: 000055bd901800e0 R11: 0000000000000246 R12: 000055bd90180140 R13: 000055bd901800e0 R14: 000055bd9017f498 R15: 000055bd9017ff10 </TASK> Modules linked in: xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc mlx4_ib mlx4_en mlx4_core rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi fuse ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_core ---[ end trace 0000000000000000 ]--- Fixes: dabddd687c9e ("percpu: cast percpu pointer in PERCPU_PTR() via unsigned long") Closes: https://lore.kernel.org/all/7590f546-4021-4602-9252-0d525de35b52@nvidia.com Cc: Uros Bizjak <ubizjak@gmail.com> Signed-off-by: Gal Pressman <gal@nvidia.com> --- include/linux/percpu-defs.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)