From patchwork Thu Sep 28 11:27:28 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 114412 Delivered-To: patch@linaro.org Received: by 10.140.106.117 with SMTP id d108csp622171qgf; Thu, 28 Sep 2017 04:29:18 -0700 (PDT) X-Google-Smtp-Source: AOwi7QC5PyB14Pi9/J1kd8ujsODi2NxILjhEvUCmM9MsaMBlb96GT9IrkCF41AhyDY1VOt4ywdGW X-Received: by 10.98.211.193 with SMTP id z62mr4157344pfk.118.1506598158498; Thu, 28 Sep 2017 04:29:18 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1506598158; cv=none; d=google.com; s=arc-20160816; b=K3e9U7CW54t8bXCSqH59EuTwYqOblQWBzEAsUOR4cwvQgIZtNP6iUW+Oolid4Qm93D KZWpUcPO8yElWyY3rlolSqNNRsItbUnSivI107h/8eJBTVrtn1xE3YFXBOhONuj9hMY1 eJuqRb0QfTDiR0uavNg4PhNemeacpJCdy9PN/R4v/0hdctlIE9TzIfs9/sDwLT/Opi6P ZKZnUF3RWm4EBWc4u0BTwW1jsfRDcgk1rJ5p62T3FsM0G/ZJZ4J4Bq+nA6Sgp1qLO9OM vF5UKCYH8tgHOd60QhmIdRfpngvGguKTcFV8+iMzos+YUK9CUdV9DHWrWSPCgo+Vwhhv 9nXg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:content-disposition :mime-version:message-id:subject:cc:to:from:date :arc-authentication-results; bh=vUMGtJFjlhgsjKD3lSjbZBts0oDwW4OKqyr7xvnulGs=; b=ffH0Gi8dQIT01vY9dgfbTru5W3TNDo6UqE2j+umbVIFitxLFX1kcKHq+SQdLcL98P0 a1QqR+xYF2GCzdALZ33xmgaLRm1AkslRKPTGoUbyYyIF0IX8c4qExkqSBxNDpNB+IlZK W+b4wVTuIzM+RExI7V8TLndWotPOPthAeCbRNH6RpiEmJlqd/3yGIA2Su4bjH/jsANFR Hj2r9FxqIvfIfgTkFFrhMrN52wZggpxQXFyveSNcsJ3KJk/2MiT8bOFwjG7BFGLdCgQv HauNZ+TMu3NqBIujss+BygT9SUIjFHfQlZ8acTs+LEFPHxaNWd6Tqr0aHDjmgbKpyT49 52Vg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id k5si1202793pgs.821.2017.09.28.04.29.18; Thu, 28 Sep 2017 04:29:18 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752816AbdI1L3P (ORCPT + 26 others); Thu, 28 Sep 2017 07:29:15 -0400 Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70]:55462 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751082AbdI1L3C (ORCPT ); Thu, 28 Sep 2017 07:29:02 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id D5B6E1596; Thu, 28 Sep 2017 04:29:01 -0700 (PDT) Received: from leverpostej (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 151FD3F53D; Thu, 28 Sep 2017 04:28:59 -0700 (PDT) Date: Thu, 28 Sep 2017 12:27:28 +0100 From: Mark Rutland To: linux-kernel@vger.kernel.org, linux-mm@kvack.org, netdev@vger.kernel.org, syzkaller@googlegroups.com Cc: Daniel Borkmann , "David S. Miller" , Alexei Starovoitov , Tejun Heo , Christoph Lameter Subject: EBPF-triggered WARNING at mm/percpu.c:1361 in v4-14-rc2 Message-ID: <20170928112727.GA11310@leverpostej> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi, While fuzzing v4.14-rc2 with Syzkaller, I found it was possible to trigger the warning at mm/percpu.c:1361, on both arm64 and x86_64. This appears to require increasing RLIMIT_MEMLOCK, so to the best of my knowledge this cannot be triggered by an unprivileged user. I've included example splats for both x86_64 and arm64, along with a C reproducer, inline below. It looks like dev_map_alloc() requests a percpu alloction of 32776 bytes, which is larger than the maximum supported allocation size of 32768 bytes. I wonder if it would make more sense to pr_warn() for sizes that are too large, so that callers don't have to roll their own checks against PCPU_MIN_UNIT_SIZE? e.g. something like: ---- ---- Thanks, Mark. Example splat(x86_64) ---- [ 138.144185] illegal size (32776) or align (8) for percpu allocation [ 138.150452] ------------[ cut here ]------------ [ 138.155074] WARNING: CPU: 1 PID: 2223 at mm/percpu.c:1361 pcpu_alloc+0x7c/0x5f0 [ 138.162369] Modules linked in: [ 138.165423] CPU: 1 PID: 2223 Comm: repro Not tainted 4.14.0-rc2 #3 [ 138.171593] Hardware name: LENOVO 7484A3G/LENOVO, BIOS 5CKT54AUS 09/07/2009 [ 138.178543] task: ffff881b73069980 task.stack: ffffa36f40f90000 [ 138.184455] RIP: 0010:pcpu_alloc+0x7c/0x5f0 [ 138.188633] RSP: 0018:ffffa36f40f93e00 EFLAGS: 00010286 [ 138.193853] RAX: 0000000000000037 RBX: 0000000000000000 RCX: 0000000000000000 [ 138.200974] RDX: ffff881b7ec94a40 RSI: ffff881b7ec8cbb8 RDI: ffff881b7ec8cbb8 [ 138.208097] RBP: ffffa36f40f93e68 R08: 0000000000000001 R09: 00000000000002c4 [ 138.215219] R10: 0000562a577047f0 R11: ffffffffa10ad7cd R12: ffff881b73216cc0 [ 138.222343] R13: 0000000000000014 R14: 00007ffebeed0900 R15: ffffffffffffffea [ 138.229463] FS: 00007fef84a15700(0000) GS:ffff881b7ec80000(0000) knlGS:0000000000000000 [ 138.237538] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 138.243274] CR2: 00007fef84497ba0 CR3: 00000001b3235000 CR4: 00000000000406e0 [ 138.250397] Call Trace: [ 138.252844] __alloc_percpu+0x10/0x20 [ 138.256508] dev_map_alloc+0x122/0x1b0 [ 138.260255] SyS_bpf+0x8f9/0x10b0 [ 138.263570] ? security_task_setrlimit+0x3e/0x60 [ 138.268184] ? do_prlimit+0xa6/0x1f0 [ 138.271760] entry_SYSCALL_64_fastpath+0x13/0x94 [ 138.276372] RIP: 0033:0x7fef84546259 [ 138.279946] RSP: 002b:00007ffebeed09b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000141 [ 138.287503] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fef84546259 [ 138.294627] RDX: 0000000000000014 RSI: 00007ffebeed09d0 RDI: 0000000000000000 [ 138.301749] RBP: 0000562a57704780 R08: 00007fef84810cb0 R09: 00007ffebeed0ae8 [ 138.308874] R10: 0000562a577047f0 R11: 0000000000000206 R12: 0000562a577045d0 [ 138.315997] R13: 00007ffebeed0ae0 R14: 0000000000000000 R15: 0000000000000000 [ 138.323122] Code: fe 00 10 00 00 77 10 48 8b 4d b8 48 89 c8 48 83 e8 01 48 85 c1 74 1e 48 8b 55 b8 48 8b 75 c0 48 c7 c7 90 5e be a0 e8 40 88 f3 ff <0f> ff 45 31 ed e9 5e 02 00 00 4c 8b 6d c0 49 89 cc 49 c1 ec 02 [ 138.341953] ---[ end trace b6e380365bfb8a36 ]--- ---- Example splat (arm64) ---- [ 17.287365] illegal size (32776) or align (8) for percpu allocation [ 17.295347] ------------[ cut here ]------------ [ 17.297191] WARNING: CPU: 1 PID: 1440 at mm/percpu.c:1361 pcpu_alloc+0x120/0x9f0 [ 17.307723] Kernel panic - not syncing: panic_on_warn set ... [ 17.307723] [ 17.311755] CPU: 1 PID: 1440 Comm: repro Not tainted 4.14.0-rc2-00001-gd7ad33d #115 [ 17.320675] Hardware name: linux,dummy-virt (DT) [ 17.323858] Call trace: [ 17.325246] [] dump_backtrace+0x0/0x558 [ 17.332538] [] show_stack+0x20/0x30 [ 17.340391] [] dump_stack+0x128/0x1a0 [ 17.342081] [] panic+0x250/0x518 [ 17.344096] [] __warn+0x2a4/0x310 [ 17.345654] [] report_bug+0x1d4/0x290 [ 17.348652] [] bug_handler.part.1+0x40/0xf8 [ 17.356873] [] bug_handler+0x4c/0x88 [ 17.360543] [] brk_handler+0x1c4/0x360 [ 17.365076] [] do_debug_exception+0x118/0x398 [ 17.368297] Exception stack(0xffff80001c82b930 to 0xffff80001c82ba70) [ 17.372981] b920: 0000000000000037 0000000000000000 [ 17.380137] b940: bec1e481d6136f00 dfff200000000000 1fffe40001cbd30c dfff200000000000 [ 17.384902] b960: dfff200000000000 0000000000000000 ffff80001ce6c050 1ffff000039cd809 [ 17.392527] b980: ffff80001ce6c048 ffff80001ce6c068 1ffff000039cd80c 1ffff000039cd80e [ 17.396935] b9a0: 1ffff000039cd80d ffff20000e1485a0 0000000000000000 0000000000000000 [ 17.404665] b9c0: ffff20000da58140 0000000000000000 00000000014000c0 0000000000000008 [ 17.407064] b9e0: 0000000000000004 000000000000800b 1ffff000039057b9 ffff80001c82bdcc [ 17.415067] ba00: 0000000000000000 1ffff000039c0b14 1ffff000039c0b12 ffff80001c82ba70 [ 17.419137] ba20: ffff20000850c880 ffff80001c82ba70 ffff20000850c880 0000000080000145 [ 17.426052] ba40: 0000000000000008 ffff20000ae60b88 0001000000000000 00000000f4f4f404 [ 17.437346] ba60: ffff80001c82ba70 ffff20000850c880 [ 17.445759] [] el1_dbg+0x18/0x74 [ 17.448272] [] pcpu_alloc+0x120/0x9f0 [ 17.456523] [] __alloc_percpu+0x30/0x40 [ 17.458412] [] dev_map_alloc+0x58c/0x8d8 [ 17.462917] [] SyS_bpf+0x86c/0x2d58 [ 17.468126] Exception stack(0xffff80001c82bec0 to 0xffff80001c82c000) [ 17.470108] bec0: 0000000000000000 0000ffffe78f4898 0000000000000014 0000000000000000 [ 17.474655] bee0: 0000000000000000 0000ffffe78f49f0 0000001000000000 0000001000000000 [ 17.482196] bf00: 0000000000000118 0003ffffffffffff 0101010101010101 0000001000000000 [ 17.486928] bf20: 0000ffffb6468030 0000000000000000 0000ffffb6468028 000000000000071c [ 17.498389] bf40: 0000ffffb63b8a00 0000aaaaba991028 0000000000000000 0000aaaaba9808f0 [ 17.502871] bf60: 0000000000000000 0000aaaaba980730 0000000000000000 0000000000000000 [ 17.505879] bf80: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 17.514090] bfa0: 0000000000000000 0000ffffe78f4870 0000aaaaba9808e0 0000ffffe78f4870 [ 17.520813] bfc0: 0000ffffb63b8a24 0000000080000000 0000000000000000 0000000000000118 [ 17.523888] bfe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 17.532537] [] el0_svc_naked+0x24/0x28 [ 17.540427] SMP: stopping secondary CPUs [ 17.566662] Kernel Offset: disabled [ 17.567498] CPU features: 0x002082 [ 17.568238] Memory Limit: none [ 17.568958] Rebooting in 86400 seconds.. ---- C reproducer ---- #include #include #include #include #include /* * Debian Stretch's headers are too old to contain a number of interesting * values, so manually define them to keep things legible... */ struct LOCALDEF_bpf_attr { uint32_t map_type; uint32_t key_size; uint32_t value_size; uint32_t max_entries; uint32_t map_flags; }; #define LOCALDEF_BPF_MAP_TYPE_DEVMAP 0xe int main(int argc, char *argv[]) { struct rlimit rlimit = { .rlim_cur = 8 << 20, .rlim_max = 8 << 20, }; setrlimit(RLIMIT_MEMLOCK, &rlimit); struct LOCALDEF_bpf_attr attr = { .map_type = LOCALDEF_BPF_MAP_TYPE_DEVMAP, .key_size = 4, .value_size = 4, .max_entries = 0x40001, .map_flags = 0, }; syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr)); return 0; } ---- diff --git a/mm/percpu.c b/mm/percpu.c index 59d44d6..f731c45 100644 --- a/mm/percpu.c +++ b/mm/percpu.c @@ -1355,8 +1355,13 @@ static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved, bits = size >> PCPU_MIN_ALLOC_SHIFT; bit_align = align >> PCPU_MIN_ALLOC_SHIFT; - if (unlikely(!size || size > PCPU_MIN_UNIT_SIZE || align > PAGE_SIZE || - !is_power_of_2(align))) { + if (unlikely(size > PCPU_MIN_UNIT_SIZE)) { + pr_warn("cannot allocate pcpu chunk of size %zu (max %zu)\n", + size, PCPU_MIN_UNIT_SIZE); + return NULL; + } + + if (unlikely(!size || align > PAGE_SIZE || !is_power_of_2(align))) { WARN(true, "illegal size (%zu) or align (%zu) for percpu allocation\n", size, align); return NULL;