| Message ID | 20210319104437.6f30e80d@alex-virtual-machine (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v3] mm/gup: check page posion status for coredump. | expand |
On Fri, Mar 19, 2021 at 10:44:37AM +0800, Aili Yao wrote: > +++ b/mm/gup.c > @@ -1536,6 +1536,10 @@ struct page *get_dump_page(unsigned long addr) > FOLL_FORCE | FOLL_DUMP | FOLL_GET); > if (locked) > mmap_read_unlock(mm); > + > + if (ret == 1 && is_page_poisoned(page)) > + return NULL; > + > return (ret == 1) ? page : NULL; > } > #endif /* CONFIG_ELF_CORE */ > diff --git a/mm/internal.h b/mm/internal.h > index 25d2b2439..902d993 100644 > --- a/mm/internal.h > +++ b/mm/internal.h > @@ -97,6 +97,27 @@ static inline void set_page_refcounted(struct page *page) > set_page_count(page, 1); > } > > +/* > + * When kernel touch the user page, the user page may be have been marked > + * poison but still mapped in user space, if without this page, the kernel > + * can guarantee the data integrity and operation success, the kernel is > + * better to check the posion status and avoid touching it, be good not to > + * panic, coredump for process fatal signal is a sample case matching this > + * scenario. Or if kernel can't guarantee the data integrity, it's better > + * not to call this function, let kernel touch the poison page and get to > + * panic. > + */ > +static inline bool is_page_poisoned(struct page *page) > +{ > + if (page != NULL) { Why are you checking page for NULL here? How can it possibly be NULL? > + if (PageHWPoison(page)) > + return true; > + else if (PageHuge(page) && PageHWPoison(compound_head(page))) > + return true; > + } > + return 0; > +} > + > extern unsigned long highest_memmap_pfn; > > /* > -- > 1.8.3.1 > >
On Sat, 20 Mar 2021 00:35:16 +0000 Matthew Wilcox <willy@infradead.org> wrote: > On Fri, Mar 19, 2021 at 10:44:37AM +0800, Aili Yao wrote: > > +++ b/mm/gup.c > > @@ -1536,6 +1536,10 @@ struct page *get_dump_page(unsigned long addr) > > FOLL_FORCE | FOLL_DUMP | FOLL_GET); > > if (locked) > > mmap_read_unlock(mm); > > + > > + if (ret == 1 && is_page_poisoned(page)) > > + return NULL; > > + > > return (ret == 1) ? page : NULL; > > } > > #endif /* CONFIG_ELF_CORE */ > > diff --git a/mm/internal.h b/mm/internal.h > > index 25d2b2439..902d993 100644 > > --- a/mm/internal.h > > +++ b/mm/internal.h > > @@ -97,6 +97,27 @@ static inline void set_page_refcounted(struct page *page) > > set_page_count(page, 1); > > } > > > > +/* > > + * When kernel touch the user page, the user page may be have been marked > > + * poison but still mapped in user space, if without this page, the kernel > > + * can guarantee the data integrity and operation success, the kernel is > > + * better to check the posion status and avoid touching it, be good not to > > + * panic, coredump for process fatal signal is a sample case matching this > > + * scenario. Or if kernel can't guarantee the data integrity, it's better > > + * not to call this function, let kernel touch the poison page and get to > > + * panic. > > + */ > > +static inline bool is_page_poisoned(struct page *page) > > +{ > > + if (page != NULL) { > > Why are you checking page for NULL here? How can it possibly be NULL? For this get_dump_page() case, it can't be NULL, I thougt may other place will call this function and may not guarantee this, But yes, kernel is a more safer place and checking page NULL is not a common behavior. Better to remove it, Thanks you very much for pointing this! > > + if (PageHWPoison(page)) > > + return true; > > + else if (PageHuge(page) && PageHWPoison(compound_head(page))) > > + return true; > > + } > > + return 0; > > +} > > + > > extern unsigned long highest_memmap_pfn; > > > > /* > > -- > > 1.8.3.1 > > > >
diff --git a/mm/gup.c b/mm/gup.c index e4c224c..dcabe96 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -1536,6 +1536,10 @@ struct page *get_dump_page(unsigned long addr) FOLL_FORCE | FOLL_DUMP | FOLL_GET); if (locked) mmap_read_unlock(mm); + + if (ret == 1 && is_page_poisoned(page)) + return NULL; + return (ret == 1) ? page : NULL; } #endif /* CONFIG_ELF_CORE */ diff --git a/mm/internal.h b/mm/internal.h index 25d2b2439..902d993 100644 --- a/mm/internal.h +++ b/mm/internal.h @@ -97,6 +97,27 @@ static inline void set_page_refcounted(struct page *page) set_page_count(page, 1); } +/* + * When kernel touch the user page, the user page may be have been marked + * poison but still mapped in user space, if without this page, the kernel + * can guarantee the data integrity and operation success, the kernel is + * better to check the posion status and avoid touching it, be good not to + * panic, coredump for process fatal signal is a sample case matching this + * scenario. Or if kernel can't guarantee the data integrity, it's better + * not to call this function, let kernel touch the poison page and get to + * panic. + */ +static inline bool is_page_poisoned(struct page *page) +{ + if (page != NULL) { + if (PageHWPoison(page)) + return true; + else if (PageHuge(page) && PageHWPoison(compound_head(page))) + return true; + } + return 0; +} + extern unsigned long highest_memmap_pfn; /*
When we do coredump for user process signal, this may be an SIGBUS signal with BUS_MCEERR_AR or BUS_MCEERR_AO code, which means this signal is resulted from ECC memory fail like SRAR or SRAO, we expect the memory recovery work is finished correctly, then the get_dump_page() will not return the error page as its process pte is set invalid by memory_failure(). But memory_failure() may fail, and the process's related pte may not be correctly set invalid, for current code, we will return the poison page, get it dumped, and then lead to system panic as its in kernel code. So check the poison status in get_dump_page(), and if TRUE, return NULL. There maybe other scenario that is also better to check the posion status and not to panic, so make a wrapper for this check, Thanks to David's suggestion(<david@redhat.com>). Signed-off-by: Aili Yao <yaoaili@kingsoft.com> --- mm/gup.c | 4 ++++ mm/internal.h | 21 +++++++++++++++++++++ 2 files changed, 25 insertions(+)