diff mbox series

[v1] arch/x86/mm/hugetlbpage.c: pud_huge() returns 0 when using 2-level paging

Message ID 20221107021010.2449306-1-naoya.horiguchi@linux.dev
State New
Headers
Series [v1] arch/x86/mm/hugetlbpage.c: pud_huge() returns 0 when using 2-level paging |

Commit Message

Naoya Horiguchi Nov. 7, 2022, 2:10 a.m. UTC 
  From: Naoya Horiguchi <naoya.horiguchi@nec.com>

The following bug is reported to be triggered when starting X on x86-32
system with i915:

  [  225.777375] kernel BUG at mm/memory.c:2664!
  [  225.777391] invalid opcode: 0000 [#1] PREEMPT SMP
  [  225.777405] CPU: 0 PID: 2402 Comm: Xorg Not tainted 6.1.0-rc3-bdg+ #86
  [  225.777415] Hardware name:  /8I865G775-G, BIOS F1 08/29/2006
  [  225.777421] EIP: __apply_to_page_range+0x24d/0x31c
  [  225.777437] Code: ff ff 8b 55 e8 8b 45 cc e8 0a 11 ec ff 89 d8 83 c4 28 5b 5e 5f 5d c3 81 7d e0 a0 ef 96 c1 74 ad 8b 45 d0 e8 2d 83 49 00 eb a3 <0f> 0b 25 00 f0 ff ff 81 eb 00 00 00 40 01 c3 8b 45 ec 8b 00 e8 76
  [  225.777446] EAX: 00000001 EBX: c53a3b58 ECX: b5c00000 EDX: c258aa00
  [  225.777454] ESI: b5c00000 EDI: b5900000 EBP: c4b0fdb4 ESP: c4b0fd80
  [  225.777462] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 EFLAGS: 00010202
  [  225.777470] CR0: 80050033 CR2: b5900000 CR3: 053a3000 CR4: 000006d0
  [  225.777479] Call Trace:
  [  225.777486]  ? i915_memcpy_init_early+0x63/0x63 [i915]
  [  225.777684]  apply_to_page_range+0x21/0x27
  [  225.777694]  ? i915_memcpy_init_early+0x63/0x63 [i915]
  [  225.777870]  remap_io_mapping+0x49/0x75 [i915]
  [  225.778046]  ? i915_memcpy_init_early+0x63/0x63 [i915]
  [  225.778220]  ? mutex_unlock+0xb/0xd
  [  225.778231]  ? i915_vma_pin_fence+0x6d/0xf7 [i915]
  [  225.778420]  vm_fault_gtt+0x2a9/0x8f1 [i915]
  [  225.778644]  ? lock_is_held_type+0x56/0xe7
  [  225.778655]  ? lock_is_held_type+0x7a/0xe7
  [  225.778663]  ? 0xc1000000
  [  225.778670]  __do_fault+0x21/0x6a
  [  225.778679]  handle_mm_fault+0x708/0xb21
  [  225.778686]  ? mt_find+0x21e/0x5ae
  [  225.778696]  exc_page_fault+0x185/0x705
  [  225.778704]  ? doublefault_shim+0x127/0x127
  [  225.778715]  handle_exception+0x130/0x130
  [  225.778723] EIP: 0xb700468a

Recently pud_huge() got aware of non-present entry by commit 3a194f3f8ad0
("mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present
pud entry") to handle some special states of gigantic page.  However, it's
overlooked that pud_none() always returns false when running with 2-level
paging, and as a result pmd_huge() can return true pointlessly.

Introduce "#if CONFIG_PGTABLE_LEVELS > 2" to pud_huge() to deal with this.

Fixes: 3a194f3f8ad0 ("mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present pud entry")
Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
Cc: <stable@vger.kernel.org>
---
 arch/x86/mm/hugetlbpage.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Ville Syrjälä Nov. 7, 2022, 12:42 p.m. UTC | #1 
On Mon, Nov 07, 2022 at 11:10:10AM +0900, Naoya Horiguchi wrote:
> From: Naoya Horiguchi <naoya.horiguchi@nec.com>
> 
> The following bug is reported to be triggered when starting X on x86-32
> system with i915:
> 
>   [  225.777375] kernel BUG at mm/memory.c:2664!
>   [  225.777391] invalid opcode: 0000 [#1] PREEMPT SMP
>   [  225.777405] CPU: 0 PID: 2402 Comm: Xorg Not tainted 6.1.0-rc3-bdg+ #86
>   [  225.777415] Hardware name:  /8I865G775-G, BIOS F1 08/29/2006
>   [  225.777421] EIP: __apply_to_page_range+0x24d/0x31c
>   [  225.777437] Code: ff ff 8b 55 e8 8b 45 cc e8 0a 11 ec ff 89 d8 83 c4 28 5b 5e 5f 5d c3 81 7d e0 a0 ef 96 c1 74 ad 8b 45 d0 e8 2d 83 49 00 eb a3 <0f> 0b 25 00 f0 ff ff 81 eb 00 00 00 40 01 c3 8b 45 ec 8b 00 e8 76
>   [  225.777446] EAX: 00000001 EBX: c53a3b58 ECX: b5c00000 EDX: c258aa00
>   [  225.777454] ESI: b5c00000 EDI: b5900000 EBP: c4b0fdb4 ESP: c4b0fd80
>   [  225.777462] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 EFLAGS: 00010202
>   [  225.777470] CR0: 80050033 CR2: b5900000 CR3: 053a3000 CR4: 000006d0
>   [  225.777479] Call Trace:
>   [  225.777486]  ? i915_memcpy_init_early+0x63/0x63 [i915]
>   [  225.777684]  apply_to_page_range+0x21/0x27
>   [  225.777694]  ? i915_memcpy_init_early+0x63/0x63 [i915]
>   [  225.777870]  remap_io_mapping+0x49/0x75 [i915]
>   [  225.778046]  ? i915_memcpy_init_early+0x63/0x63 [i915]
>   [  225.778220]  ? mutex_unlock+0xb/0xd
>   [  225.778231]  ? i915_vma_pin_fence+0x6d/0xf7 [i915]
>   [  225.778420]  vm_fault_gtt+0x2a9/0x8f1 [i915]
>   [  225.778644]  ? lock_is_held_type+0x56/0xe7
>   [  225.778655]  ? lock_is_held_type+0x7a/0xe7
>   [  225.778663]  ? 0xc1000000
>   [  225.778670]  __do_fault+0x21/0x6a
>   [  225.778679]  handle_mm_fault+0x708/0xb21
>   [  225.778686]  ? mt_find+0x21e/0x5ae
>   [  225.778696]  exc_page_fault+0x185/0x705
>   [  225.778704]  ? doublefault_shim+0x127/0x127
>   [  225.778715]  handle_exception+0x130/0x130
>   [  225.778723] EIP: 0xb700468a
> 
> Recently pud_huge() got aware of non-present entry by commit 3a194f3f8ad0
> ("mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present
> pud entry") to handle some special states of gigantic page.  However, it's
> overlooked that pud_none() always returns false when running with 2-level
> paging, and as a result pmd_huge() can return true pointlessly.
> 
> Introduce "#if CONFIG_PGTABLE_LEVELS > 2" to pud_huge() to deal with this.
> 
> Fixes: 3a194f3f8ad0 ("mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present pud entry")
> Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
> Signed-off-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
> Cc: <stable@vger.kernel.org>

Works for me.
Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>

> ---
>  arch/x86/mm/hugetlbpage.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
> index 6b3033845c6d..5804bbae4f01 100644
> --- a/arch/x86/mm/hugetlbpage.c
> +++ b/arch/x86/mm/hugetlbpage.c
> @@ -37,8 +37,12 @@ int pmd_huge(pmd_t pmd)
>   */
>  int pud_huge(pud_t pud)
>  {
> +#if CONFIG_PGTABLE_LEVELS > 2
>  	return !pud_none(pud) &&
>  		(pud_val(pud) & (_PAGE_PRESENT|_PAGE_PSE)) != _PAGE_PRESENT;
> +#else
> +	return 0;
> +#endif
>  }
>  
>  #ifdef CONFIG_HUGETLB_PAGE
> -- 
> 2.25.1
HORIGUCHI NAOYA(堀口 直也) Nov. 8, 2022, midnight UTC | #2 
On Mon, Nov 07, 2022 at 02:42:18PM +0200, Ville Syrjälä wrote:
> On Mon, Nov 07, 2022 at 11:10:10AM +0900, Naoya Horiguchi wrote:
> > From: Naoya Horiguchi <naoya.horiguchi@nec.com>
> > 
> > The following bug is reported to be triggered when starting X on x86-32
> > system with i915:
> > 
> >   [  225.777375] kernel BUG at mm/memory.c:2664!
> >   [  225.777391] invalid opcode: 0000 [#1] PREEMPT SMP
> >   [  225.777405] CPU: 0 PID: 2402 Comm: Xorg Not tainted 6.1.0-rc3-bdg+ #86
> >   [  225.777415] Hardware name:  /8I865G775-G, BIOS F1 08/29/2006
> >   [  225.777421] EIP: __apply_to_page_range+0x24d/0x31c
> >   [  225.777437] Code: ff ff 8b 55 e8 8b 45 cc e8 0a 11 ec ff 89 d8 83 c4 28 5b 5e 5f 5d c3 81 7d e0 a0 ef 96 c1 74 ad 8b 45 d0 e8 2d 83 49 00 eb a3 <0f> 0b 25 00 f0 ff ff 81 eb 00 00 00 40 01 c3 8b 45 ec 8b 00 e8 76
> >   [  225.777446] EAX: 00000001 EBX: c53a3b58 ECX: b5c00000 EDX: c258aa00
> >   [  225.777454] ESI: b5c00000 EDI: b5900000 EBP: c4b0fdb4 ESP: c4b0fd80
> >   [  225.777462] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 EFLAGS: 00010202
> >   [  225.777470] CR0: 80050033 CR2: b5900000 CR3: 053a3000 CR4: 000006d0
> >   [  225.777479] Call Trace:
> >   [  225.777486]  ? i915_memcpy_init_early+0x63/0x63 [i915]
> >   [  225.777684]  apply_to_page_range+0x21/0x27
> >   [  225.777694]  ? i915_memcpy_init_early+0x63/0x63 [i915]
> >   [  225.777870]  remap_io_mapping+0x49/0x75 [i915]
> >   [  225.778046]  ? i915_memcpy_init_early+0x63/0x63 [i915]
> >   [  225.778220]  ? mutex_unlock+0xb/0xd
> >   [  225.778231]  ? i915_vma_pin_fence+0x6d/0xf7 [i915]
> >   [  225.778420]  vm_fault_gtt+0x2a9/0x8f1 [i915]
> >   [  225.778644]  ? lock_is_held_type+0x56/0xe7
> >   [  225.778655]  ? lock_is_held_type+0x7a/0xe7
> >   [  225.778663]  ? 0xc1000000
> >   [  225.778670]  __do_fault+0x21/0x6a
> >   [  225.778679]  handle_mm_fault+0x708/0xb21
> >   [  225.778686]  ? mt_find+0x21e/0x5ae
> >   [  225.778696]  exc_page_fault+0x185/0x705
> >   [  225.778704]  ? doublefault_shim+0x127/0x127
> >   [  225.778715]  handle_exception+0x130/0x130
> >   [  225.778723] EIP: 0xb700468a
> > 
> > Recently pud_huge() got aware of non-present entry by commit 3a194f3f8ad0
> > ("mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present
> > pud entry") to handle some special states of gigantic page.  However, it's
> > overlooked that pud_none() always returns false when running with 2-level
> > paging, and as a result pmd_huge() can return true pointlessly.

Sorry, I found a non-negligible typo here (s/pmd_huge/pud_huge/).
Andrew, could you fix this on mm-hotfixes-unstable?

> > 
> > Introduce "#if CONFIG_PGTABLE_LEVELS > 2" to pud_huge() to deal with this.
> > 
> > Fixes: 3a194f3f8ad0 ("mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present pud entry")
> > Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
> > Signed-off-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
> > Cc: <stable@vger.kernel.org>
> 
> Works for me.
> Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>

Thank you for confirmation.

- Naoya Horiguchi
Andrew Morton Nov. 8, 2022, 12:10 a.m. UTC | #3 
On Tue, 8 Nov 2022 00:00:15 +0000 HORIGUCHI NAOYA(堀口　直也) <naoya.horiguchi@nec.com> wrote:

> > > Recently pud_huge() got aware of non-present entry by commit 3a194f3f8ad0
> > > ("mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present
> > > pud entry") to handle some special states of gigantic page.  However, it's
> > > overlooked that pud_none() always returns false when running with 2-level
> > > paging, and as a result pmd_huge() can return true pointlessly.
> 
> Sorry, I found a non-negligible typo here (s/pmd_huge/pud_huge/).
> Andrew, could you fix this on mm-hotfixes-unstable?

Done, thanks.
Muchun Song Nov. 9, 2022, 3:14 a.m. UTC | #4 
> On Nov 7, 2022, at 10:10, Naoya Horiguchi <naoya.horiguchi@linux.dev> wrote:
> 
> From: Naoya Horiguchi <naoya.horiguchi@nec.com>
> 
> The following bug is reported to be triggered when starting X on x86-32
> system with i915:
> 
>  [  225.777375] kernel BUG at mm/memory.c:2664!
>  [  225.777391] invalid opcode: 0000 [#1] PREEMPT SMP
>  [  225.777405] CPU: 0 PID: 2402 Comm: Xorg Not tainted 6.1.0-rc3-bdg+ #86
>  [  225.777415] Hardware name:  /8I865G775-G, BIOS F1 08/29/2006
>  [  225.777421] EIP: __apply_to_page_range+0x24d/0x31c
>  [  225.777437] Code: ff ff 8b 55 e8 8b 45 cc e8 0a 11 ec ff 89 d8 83 c4 28 5b 5e 5f 5d c3 81 7d e0 a0 ef 96 c1 74 ad 8b 45 d0 e8 2d 83 49 00 eb a3 <0f> 0b 25 00 f0 ff ff 81 eb 00 00 00 40 01 c3 8b 45 ec 8b 00 e8 76
>  [  225.777446] EAX: 00000001 EBX: c53a3b58 ECX: b5c00000 EDX: c258aa00
>  [  225.777454] ESI: b5c00000 EDI: b5900000 EBP: c4b0fdb4 ESP: c4b0fd80
>  [  225.777462] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 EFLAGS: 00010202
>  [  225.777470] CR0: 80050033 CR2: b5900000 CR3: 053a3000 CR4: 000006d0
>  [  225.777479] Call Trace:
>  [  225.777486]  ? i915_memcpy_init_early+0x63/0x63 [i915]
>  [  225.777684]  apply_to_page_range+0x21/0x27
>  [  225.777694]  ? i915_memcpy_init_early+0x63/0x63 [i915]
>  [  225.777870]  remap_io_mapping+0x49/0x75 [i915]
>  [  225.778046]  ? i915_memcpy_init_early+0x63/0x63 [i915]
>  [  225.778220]  ? mutex_unlock+0xb/0xd
>  [  225.778231]  ? i915_vma_pin_fence+0x6d/0xf7 [i915]
>  [  225.778420]  vm_fault_gtt+0x2a9/0x8f1 [i915]
>  [  225.778644]  ? lock_is_held_type+0x56/0xe7
>  [  225.778655]  ? lock_is_held_type+0x7a/0xe7
>  [  225.778663]  ? 0xc1000000
>  [  225.778670]  __do_fault+0x21/0x6a
>  [  225.778679]  handle_mm_fault+0x708/0xb21
>  [  225.778686]  ? mt_find+0x21e/0x5ae
>  [  225.778696]  exc_page_fault+0x185/0x705
>  [  225.778704]  ? doublefault_shim+0x127/0x127
>  [  225.778715]  handle_exception+0x130/0x130
>  [  225.778723] EIP: 0xb700468a
> 
> Recently pud_huge() got aware of non-present entry by commit 3a194f3f8ad0
> ("mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present
> pud entry") to handle some special states of gigantic page.  However, it's
> overlooked that pud_none() always returns false when running with 2-level
> paging, and as a result pmd_huge() can return true pointlessly.
> 
> Introduce "#if CONFIG_PGTABLE_LEVELS > 2" to pud_huge() to deal with this.
> 
> Fixes: 3a194f3f8ad0 ("mm/hugetlb: make pud_huge() and follow_huge_pud() aware of non-present pud entry")
> Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
> Signed-off-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
> Cc: <stable@vger.kernel.org>

Reviewed-by: Muchun Song <songmuchun@bytedance.com>

Thanks.
diff mbox series

Patch

diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
index 6b3033845c6d..5804bbae4f01 100644
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
@@ -37,8 +37,12 @@  int pmd_huge(pmd_t pmd)
  */
 int pud_huge(pud_t pud)
 {
+#if CONFIG_PGTABLE_LEVELS > 2
 	return !pud_none(pud) &&
 		(pud_val(pud) & (_PAGE_PRESENT|_PAGE_PSE)) != _PAGE_PRESENT;
+#else
+	return 0;
+#endif
 }
 
 #ifdef CONFIG_HUGETLB_PAGE