Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1517915
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.4 26/69] GenWQE: Fix bad page access during abort of resource allocation |
| Date | 2016-11-09 11:50 +0100 |
| Message-ID | <sByC7-69v-71@gated-at.bofh.it> (permalink) |
| References | <sByC5-69v-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerald Schaefer <gerald.schaefer@de.ibm.com>
commit a7a7aeefbca2982586ba2c9fd7739b96416a6d1d upstream.
When interrupting an application which was allocating DMAable
memory, it was possible, that the DMA memory was deallocated
twice, leading to the error symptoms below.
Thanks to Gerald, who analyzed the problem and provided this
patch.
I agree with his analysis of the problem: ddcb_cmd_fixups() ->
genwqe_alloc_sync_sgl() (fails in f/lpage, but sgl->sgl != NULL
and f/lpage maybe also != NULL) -> ddcb_cmd_cleanup() ->
genwqe_free_sync_sgl() (double free, because sgl->sgl != NULL and
f/lpage maybe also != NULL)
In this scenario we would have exactly the kind of double free that
would explain the WARNING / Bad page state, and as expected it is
caused by broken error handling (cleanup).
Using the Ubuntu git source, tag Ubuntu-4.4.0-33.52, he was able to reproduce
the "Bad page state" issue, and with the patch on top he could not reproduce
it any more.
------------[ cut here ]------------
WARNING: at /build/linux-o03cxz/linux-4.4.0/arch/s390/include/asm/pci_dma.h:141
Modules linked in: qeth_l2 ghash_s390 prng aes_s390 des_s390 des_generic sha512_s390 sha256_s390 sha1_s390 sha_common genwqe_card qeth crc_itu_t qdio ccwgroup vmur dm_multipath dasd_eckd_mod dasd_mod
CPU: 2 PID: 3293 Comm: genwqe_gunzip Not tainted 4.4.0-33-generic #52-Ubuntu
task: 0000000032c7e270 ti: 00000000324e4000 task.ti: 00000000324e4000
Krnl PSW : 0404c00180000000 0000000000156346 (dma_update_cpu_trans+0x9e/0xa8)
R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 EA:3
Krnl GPRS: 00000000324e7bcd 0000000000c3c34a 0000000027628298 000000003215b400
0000000000000400 0000000000001fff 0000000000000400 0000000116853000
07000000324e7b1e 0000000000000001 0000000000000001 0000000000000001
0000000000001000 0000000116854000 0000000000156402 00000000324e7a38
Krnl Code: 000000000015633a: 95001000 cli 0(%r1),0
000000000015633e: a774ffc3 brc 7,1562c4
#0000000000156342: a7f40001 brc 15,156344
>0000000000156346: 92011000 mvi 0(%r1),1
000000000015634a: a7f4ffbd brc 15,1562c4
000000000015634e: 0707 bcr 0,%r7
0000000000156350: c00400000000 brcl 0,156350
0000000000156356: eb7ff0500024 stmg %r7,%r15,80(%r15)
Call Trace:
([<00000000001563e0>] dma_update_trans+0x90/0x228)
[<00000000001565dc>] s390_dma_unmap_pages+0x64/0x160
[<00000000001567c2>] s390_dma_free+0x62/0x98
[<000003ff801310ce>] __genwqe_free_consistent+0x56/0x70 [genwqe_card]
[<000003ff801316d0>] genwqe_free_sync_sgl+0xf8/0x160 [genwqe_card]
[<000003ff8012bd6e>] ddcb_cmd_cleanup+0x86/0xa8 [genwqe_card]
[<000003ff8012c1c0>] do_execute_ddcb+0x110/0x348 [genwqe_card]
[<000003ff8012c914>] genwqe_ioctl+0x51c/0xc20 [genwqe_card]
[<000000000032513a>] do_vfs_ioctl+0x3b2/0x518
[<0000000000325344>] SyS_ioctl+0xa4/0xb8
[<00000000007b86c6>] system_call+0xd6/0x264
[<000003ff9e8e520a>] 0x3ff9e8e520a
Last Breaking-Event-Address:
[<0000000000156342>] dma_update_cpu_trans+0x9a/0xa8
---[ end trace 35996336235145c8 ]---
BUG: Bad page state in process jbd2/dasdb1-8 pfn:3215b
page:000003d100c856c0 count:-1 mapcount:0 mapping: (null) index:0x0
flags: 0x3fffc0000000000()
page dumped because: nonzero _count
Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Frank Haverkamp <haver@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/genwqe/card_utils.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/misc/genwqe/card_utils.c
+++ b/drivers/misc/genwqe/card_utils.c
@@ -352,17 +352,27 @@ int genwqe_alloc_sync_sgl(struct genwqe_
if (copy_from_user(sgl->lpage, user_addr + user_size -
sgl->lpage_size, sgl->lpage_size)) {
rc = -EFAULT;
- goto err_out1;
+ goto err_out2;
}
}
return 0;
+ err_out2:
+ __genwqe_free_consistent(cd, PAGE_SIZE, sgl->lpage,
+ sgl->lpage_dma_addr);
+ sgl->lpage = NULL;
+ sgl->lpage_dma_addr = 0;
err_out1:
__genwqe_free_consistent(cd, PAGE_SIZE, sgl->fpage,
sgl->fpage_dma_addr);
+ sgl->fpage = NULL;
+ sgl->fpage_dma_addr = 0;
err_out:
__genwqe_free_consistent(cd, sgl->sgl_size, sgl->sgl,
sgl->sgl_dma_addr);
+ sgl->sgl = NULL;
+ sgl->sgl_dma_addr = 0;
+ sgl->sgl_size = 0;
return -ENOMEM;
}
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.4 00/69] 4.4.31-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 11:50 +0100 [PATCH 4.4 23/69] USB: serial: ftdi_sio: add support for Infineon TriBoard TC2X7 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 11:50 +0100 [PATCH 4.4 27/69] Fix potential infoleak in older kernels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 11:50 +0100 [PATCH 4.4 32/69] USB: serial: cp210x: fix tiocmget error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 11:50 +0100 [PATCH 4.4 04/69] h8300: fix syscall restarting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 11:50 +0100 [PATCH 4.4 01/69] i2c: xgene: Avoid dma_buffer overrun Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 11:50 +0100 [PATCH 4.4 19/69] ubifs: Fix regression in ubifs_readdir() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 11:50 +0100 [PATCH 4.4 29/69] hv: do not lose pending heartbeat vmbus packets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 11:50 +0100 [PATCH 4.4 31/69] tty: limit terminal size to 4M chars Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 11:50 +0100 [PATCH 4.4 11/69] ALSA: hda - Raise AZX_DCAPS_RIRB_DELAY handling into top drivers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 11:50 +0100 [PATCH 4.4 06/69] mm/list_lru.c: avoid error-path NULL pointer deref Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 11:50 +0100 [PATCH 4.4 20/69] mei: txe: dont clean an unprocessed interrupt cause. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 11:50 +0100 [PATCH 4.4 22/69] USB: serial: fix potential NULL-dereference at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 11:50 +0100 [PATCH 4.4 18/69] ubifs: Abort readdir upon error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 11:50 +0100 [PATCH 4.4 26/69] GenWQE: Fix bad page access during abort of resource allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 11:50 +0100 [PATCH 4.4 08/69] KEYS: Fix short sprintf buffer in /proc/keys show function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:00 +0100 [PATCH 4.4 02/69] i2c: core: fix NULL pointer dereference under race condition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:00 +0100 [PATCH 4.4 07/69] mm: memcontrol: do not recurse in direct reclaim Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:00 +0100 [PATCH 4.4 67/69] kvm: x86: Check memopp before dereference (CVE-2016-8630) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:10 +0100 [PATCH 4.4 60/69] cgroup: avoid false positive gcc-6 warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:10 +0100 [PATCH 4.4 37/69] parisc: Ensure consistent state when switching to kernel stack at syscall entry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:10 +0100 [PATCH 4.4 46/69] scsi: scsi_debug: Fix memory leak if LBP enabled and module is unloaded Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:10 +0100 [PATCH 4.4 39/69] virtio: console: Unlock vqs while freeing buffers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:10 +0100 [PATCH 4.4 47/69] scsi: arcmsr: Send SYNCHRONIZE_CACHE command to firmware Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:10 +0100 [PATCH 4.4 65/69] usb: dwc3: Fix size used in dma_free_coherent() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:10 +0100 [PATCH 4.4 54/69] perf build: Fix traceevent plugins build race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:10 +0100 [PATCH 4.4 38/69] virtio_ring: Make interrupt suppression spec compliant Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:10 +0100 [PATCH 4.4 57/69] ARM: 8584/1: floppy: avoid gcc-6 warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:10 +0100 [PATCH 4.4 51/69] drm/radeon/si_dpm: workaround for SI kickers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:10 +0100 [PATCH 4.4 64/69] pwm: Unexport children before chip removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:10 +0100 [PATCH 4.4 36/69] ovl: fsync after copy-up Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:10 +0100 [PATCH 4.4 42/69] firewire: net: guard against rx buffer overflows Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:10 +0100 [PATCH 4.4 68/69] ubi: fastmap: Fix add_vol() return value test in ubi_attach_fastmap() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:40 +0100 [PATCH 4.4 44/69] mac80211: discard multicast and 4-addr A-MSDUs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:40 +0100 [PATCH 4.4 43/69] firewire: net: fix fragmented datagram_size off-by-one Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:40 +0100 [PATCH 4.4 45/69] scsi: megaraid_sas: Fix data integrity failure for JBOD (passthrough) devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:40 +0100 [PATCH 4.4 69/69] HID: usbhid: add ATEN CS962 to list of quirky devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:40 +0100 [PATCH 4.4 50/69] drm/radeon/si_dpm: Limit clocks on HD86xx part Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:50 +0100 [PATCH 4.4 58/69] mm/cma: silence warnings due to max() usage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:50 +0100 [PATCH 4.4 59/69] drm/exynos: fix error handling in exynos_drm_subdrv_open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:50 +0100 [PATCH 4.4 41/69] Input: i8042 - add XMG C504 to keyboard reset table Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:50 +0100 [PATCH 4.4 48/69] mmc: dw_mmc-pltfm: fix the potential NULL pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:50 +0100 [PATCH 4.4 63/69] UBI: fastmap: scrub PEB when bitflips are detected in a free PEB EC header Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:50 +0100 [PATCH 4.4 55/69] x86/xen: fix upper bound of pmd loop in xen_cleanhighmap() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:50 +0100 [PATCH 4.4 56/69] powerpc/ptrace: Fix out of bounds array access warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:50 +0100 [PATCH 4.4 40/69] dm mirror: fix read error on recovery after default leg failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:50 +0100 [PATCH 4.4 61/69] smc91x: avoid self-comparison warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-09 12:50 +0100 Re: [PATCH 4.4 00/69] 4.4.31-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-11-09 19:30 +0100 Re: [PATCH 4.4 00/69] 4.4.31-stable review Guenter Roeck <linux@roeck-us.net> - 2016-11-09 20:40 +0100
csiph-web