|
| 1 | +writeback: fix dereferencing NULL mapping->host on writeback_page_template |
| 2 | + |
| 3 | +jira LE-4623 |
| 4 | +Rebuild_History Non-Buildable kernel-4.18.0-553.81.1.el8_10 |
| 5 | +commit-author Rafael Aquini <aquini@redhat.com> |
| 6 | +commit 54abe19e00cfcc5a72773d15cd00ed19ab763439 |
| 7 | +Empty-Commit: Cherry-Pick Conflicts during history rebuild. |
| 8 | +Will be included in final tarball splat. Ref for failed cherry-pick at: |
| 9 | +ciq/ciq_backports/kernel-4.18.0-553.81.1.el8_10/54abe19e.failed |
| 10 | + |
| 11 | +When commit 19343b5bdd16 ("mm/page-writeback: introduce tracepoint for |
| 12 | +wait_on_page_writeback()") repurposed the writeback_dirty_page trace event |
| 13 | +as a template to create its new wait_on_page_writeback trace event, it |
| 14 | +ended up opening a window to NULL pointer dereference crashes due to the |
| 15 | +(infrequent) occurrence of a race where an access to a page in the |
| 16 | +swap-cache happens concurrently with the moment this page is being written |
| 17 | +to disk and the tracepoint is enabled: |
| 18 | + |
| 19 | + BUG: kernel NULL pointer dereference, address: 0000000000000040 |
| 20 | + #PF: supervisor read access in kernel mode |
| 21 | + #PF: error_code(0x0000) - not-present page |
| 22 | + PGD 800000010ec0a067 P4D 800000010ec0a067 PUD 102353067 PMD 0 |
| 23 | + Oops: 0000 [#1] PREEMPT SMP PTI |
| 24 | + CPU: 1 PID: 1320 Comm: shmem-worker Kdump: loaded Not tainted 6.4.0-rc5+ #13 |
| 25 | + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230301gitf80f052277c8-1.fc37 03/01/2023 |
| 26 | + RIP: 0010:trace_event_raw_event_writeback_folio_template+0x76/0xf0 |
| 27 | + Code: 4d 85 e4 74 5c 49 8b 3c 24 e8 06 98 ee ff 48 89 c7 e8 9e 8b ee ff ba 20 00 00 00 48 89 ef 48 89 c6 e8 fe d4 1a 00 49 8b 04 24 <48> 8b 40 40 48 89 43 28 49 8b 45 20 48 89 e7 48 89 43 30 e8 a2 4d |
| 28 | + RSP: 0000:ffffaad580b6fb60 EFLAGS: 00010246 |
| 29 | + RAX: 0000000000000000 RBX: ffff90e38035c01c RCX: 0000000000000000 |
| 30 | + RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff90e38035c044 |
| 31 | + RBP: ffff90e38035c024 R08: 0000000000000002 R09: 0000000000000006 |
| 32 | + R10: ffff90e38035c02e R11: 0000000000000020 R12: ffff90e380bac000 |
| 33 | + R13: ffffe3a7456d9200 R14: 0000000000001b81 R15: ffffe3a7456d9200 |
| 34 | + FS: 00007f2e4e8a15c0(0000) GS:ffff90e3fbc80000(0000) knlGS:0000000000000000 |
| 35 | + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| 36 | + CR2: 0000000000000040 CR3: 00000001150c6003 CR4: 0000000000170ee0 |
| 37 | + Call Trace: |
| 38 | + <TASK> |
| 39 | + ? __die+0x20/0x70 |
| 40 | + ? page_fault_oops+0x76/0x170 |
| 41 | + ? kernelmode_fixup_or_oops+0x84/0x110 |
| 42 | + ? exc_page_fault+0x65/0x150 |
| 43 | + ? asm_exc_page_fault+0x22/0x30 |
| 44 | + ? trace_event_raw_event_writeback_folio_template+0x76/0xf0 |
| 45 | + folio_wait_writeback+0x6b/0x80 |
| 46 | + shmem_swapin_folio+0x24a/0x500 |
| 47 | + ? filemap_get_entry+0xe3/0x140 |
| 48 | + shmem_get_folio_gfp+0x36e/0x7c0 |
| 49 | + ? find_busiest_group+0x43/0x1a0 |
| 50 | + shmem_fault+0x76/0x2a0 |
| 51 | + ? __update_load_avg_cfs_rq+0x281/0x2f0 |
| 52 | + __do_fault+0x33/0x130 |
| 53 | + do_read_fault+0x118/0x160 |
| 54 | + do_pte_missing+0x1ed/0x2a0 |
| 55 | + __handle_mm_fault+0x566/0x630 |
| 56 | + handle_mm_fault+0x91/0x210 |
| 57 | + do_user_addr_fault+0x22c/0x740 |
| 58 | + exc_page_fault+0x65/0x150 |
| 59 | + asm_exc_page_fault+0x22/0x30 |
| 60 | + |
| 61 | +This problem arises from the fact that the repurposed writeback_dirty_page |
| 62 | +trace event code was written assuming that every pointer to mapping |
| 63 | +(struct address_space) would come from a file-mapped page-cache object, |
| 64 | +thus mapping->host would always be populated, and that was a valid case |
| 65 | +before commit 19343b5bdd16. The swap-cache address space |
| 66 | +(swapper_spaces), however, doesn't populate its ->host (struct inode) |
| 67 | +pointer, thus leading to the crashes in the corner-case aforementioned. |
| 68 | + |
| 69 | +commit 19343b5bdd16 ended up breaking the assignment of __entry->name and |
| 70 | +__entry->ino for the wait_on_page_writeback tracepoint -- both dependent |
| 71 | +on mapping->host carrying a pointer to a valid inode. The assignment of |
| 72 | +__entry->name was fixed by commit 68f23b89067f ("memcg: fix a crash in |
| 73 | +wb_workfn when a device disappears"), and this commit fixes the remaining |
| 74 | +case, for __entry->ino. |
| 75 | + |
| 76 | +Link: https://lkml.kernel.org/r/20230606233613.1290819-1-aquini@redhat.com |
| 77 | +Fixes: 19343b5bdd16 ("mm/page-writeback: introduce tracepoint for wait_on_page_writeback()") |
| 78 | + Signed-off-by: Rafael Aquini <aquini@redhat.com> |
| 79 | + Reviewed-by: Yafang Shao <laoar.shao@gmail.com> |
| 80 | + Cc: Aristeu Rozanski <aris@redhat.com> |
| 81 | + Cc: <stable@vger.kernel.org> |
| 82 | + Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| 83 | +(cherry picked from commit 54abe19e00cfcc5a72773d15cd00ed19ab763439) |
| 84 | + Signed-off-by: Jonathan Maple <jmaple@ciq.com> |
| 85 | + |
| 86 | +# Conflicts: |
| 87 | +# include/trace/events/writeback.h |
| 88 | +diff --cc include/trace/events/writeback.h |
| 89 | +index 42c25182279a,54e353c9f919..000000000000 |
| 90 | +--- a/include/trace/events/writeback.h |
| 91 | ++++ b/include/trace/events/writeback.h |
| 92 | +@@@ -68,8 -68,8 +68,13 @@@ DECLARE_EVENT_CLASS(writeback_page_temp |
| 93 | + strscpy_pad(__entry->name, |
| 94 | + bdi_dev_name(mapping ? inode_to_bdi(mapping->host) : |
| 95 | + NULL), 32); |
| 96 | +++<<<<<<< HEAD |
| 97 | + + __entry->ino = mapping ? mapping->host->i_ino : 0; |
| 98 | + + __entry->index = page->index; |
| 99 | +++======= |
| 100 | ++ __entry->ino = (mapping && mapping->host) ? mapping->host->i_ino : 0; |
| 101 | ++ __entry->index = folio->index; |
| 102 | +++>>>>>>> 54abe19e00cf (writeback: fix dereferencing NULL mapping->host on writeback_page_template) |
| 103 | + ), |
| 104 | + |
| 105 | + TP_printk("bdi %s: ino=%lu index=%lu", |
| 106 | +* Unmerged path include/trace/events/writeback.h |
0 commit comments