Skip to content
Permalink
Browse files
dyndbg: try to release unneeded memory (PANICS) 
try simplest possible test - a single call to free_reserved_page() to
drop a single page at tail of the start/stop___dyndbg_sites block.

Even this looks wrong; the 4 lines of "dyndbg: page: <HEX>" below
correspond to the __start (1st line) & __end (3rd line) of the
dyndbg_sites "section", 2nd line should be the page containing the
last site record in the "compressed" block, and 4th line should be the
penultimate page, but its value is less than that in line 1.

dyndbg:  60 44 2991 1770 mptcp.mptcp_established_options_rm_addr.895
dyndbg:  61 debug prints in module mptcp (in 44 functions)
dyndbg: page: ffffea0000101080 ffffffff84042468, ffffea00001014c0 ffffffff84053ce8, ffffea0000101500 ffffffff84054288 1770/2992
dyndbg: page: ffffea0000101080
dyndbg: page: ffffea00001014c0
dyndbg: page: ffffea0000101500
dyndbg: page: ffffea0000100f00
dyndbg: freeing page: 03ffe9fffe101500 4503599626862676

This survives the call, but panics later, while doing initcalls[5][].
If I run in kvm/gdb-remote, and set breakpoints, I can get to console
prompt, suggesting some race somewhere.

Ive left 3 bigger/looping attempts to call free_reserved_page(), in
case one of them is close enough to fix, or to help ID the latent
thinko.

==================================================================
BUG: KASAN: wild-memory-access in free_reserved_page+0x11/0x60
Write of size 8 at addr 03ffe9fffe101500 by task swapper/0/1

CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc5-lm1-00036-g9127dc99a6b6-dirty torvalds#584
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-3.fc34 04/01/2014
Call Trace:
 dump_stack+0xbb/0x107
 ? free_reserved_page+0x11/0x60
 __kasan_report.cold+0x112/0x114
 ? free_reserved_page+0x11/0x60
 kasan_report+0x38/0x50
 kasan_check_range+0xf5/0x1d0
 free_reserved_page+0x11/0x60
 dynamic_debug_init+0x526/0x6de
 ? check_chain_key+0x1e8/0x2a0
 ? init_error_injection+0x78/0x78
 ? lock_is_held_type+0xf5/0x130
 ? lock_is_held_type+0xf5/0x130
 ? init_error_injection+0x78/0x78
 do_one_initcall+0xbb/0x3a0
 ? perf_trace_initcall_level+0x230/0x230
 ? _raw_spin_unlock_irqrestore+0x4b/0x5d
 ? lock_is_held_type+0xf5/0x130
 kernel_init_freeable+0x2b7/0x37a
 ? console_on_rootfs+0x52/0x52
 ? _raw_spin_unlock_irq+0x24/0x40
 ? mark_held_locks+0x24/0x90
 ? rest_init+0x260/0x260
 kernel_init+0xd/0x130
 ret_from_fork+0x22/0x30
==================================================================
Disabling lock debugging due to kernel taint
general protection fault, probably for non-canonical address 0x3ffe9fffe101501: 0000 [#1] SMP KASAN PTI
CPU: 0 PID: 1 Comm: swapper/0 Tainted: G    B             5.13.0-rc5-lm1-00036-g9127dc99a6b6-dirty torvalds#584
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-3.fc34 04/01/2014
RIP: 0010:free_reserved_page+0x11/0x60
Code: 8e 6b ff ff ff e9 f0 2e 94 00 0f 0b 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 41 55 be 08 00 00 00 41 54 49 89 fc e8 1f f2 a3 ff <3e> 41 80 64 24 01 ef 4d 8d 6c 24 34 be 04 00 00 00 4c 89 ef e8 06
RSP: 0000:ffff8880062b7c50 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 03fffffffe101500 RCX: dffffc0000000000
RDX: 0000000000000007 RSI: 0000000000000004 RDI: ffffffff8257a3fb
RBP: ffff8880062b7d48 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff0749448 R11: 0000000000000000 R12: 03ffe9fffe101500
R13: 1ffff11000c56f99 R14: ffffea0000101500 R15: ffff8880062ac900
FS:  0000000000000000(0000) GS:ffff88805e600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff888005e01000 CR3: 000000000362a001 CR4: 0000000000370ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 dynamic_debug_init+0x526/0x6de
 ? check_chain_key+0x1e8/0x2a0
 ? init_error_injection+0x78/0x78
 ? lock_is_held_type+0xf5/0x130
 ? lock_is_held_type+0xf5/0x130
 ? init_error_injection+0x78/0x78
 do_one_initcall+0xbb/0x3a0
 ? perf_trace_initcall_level+0x230/0x230
 ? _raw_spin_unlock_irqrestore+0x4b/0x5d
 ? lock_is_held_type+0xf5/0x130
 kernel_init_freeable+0x2b7/0x37a
 ? console_on_rootfs+0x52/0x52
 ? _raw_spin_unlock_irq+0x24/0x40
 ? mark_held_locks+0x24/0x90
 ? rest_init+0x260/0x260
 kernel_init+0xd/0x130
 ret_from_fork+0x22/0x30
Modules linked in:
---[ end trace 01c6cf7d6a3cba04 ]---
RIP: 0010:free_reserved_page+0x11/0x60
Code: 8e 6b ff ff ff e9 f0 2e 94 00 0f 0b 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 41 55 be 08 00 00 00 41 54 49 89 fc e8 1f f2 a3 ff <3e> 41 80 64 24 01 ef 4d 8d 6c 24 34 be 04 00 00 00 4c 89 ef e8 06
RSP: 0000:ffff8880062b7c50 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 03fffffffe101500 RCX: dffffc0000000000
RDX: 0000000000000007 RSI: 0000000000000004 RDI: ffffffff8257a3fb
RBP: ffff8880062b7d48 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff0749448 R11: 0000000000000000 R12: 03ffe9fffe101500
R13: 1ffff11000c56f99 R14: ffffea0000101500 R15: ffff8880062ac900
FS:  0000000000000000(0000) GS:ffff88805e600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff888005e01000 CR3: 000000000362a001 CR4: 0000000000370ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---

page-drop
  • Loading branch information
@jimc
jimc committed Jun 15, 2021
1 parent d29f2fb commit 0197e279a82c8d6beef130ba3f09187b82ed967f
Showing 1 changed file with 47 additions and 1 deletion.
48 lib/dynamic_debug.c
View file
@@ -1314,7 +1314,8 @@ static int __init dynamic_debug_init_control(void)
return 0;
}

static int __init dynamic_debug_init(void)
static int __init __attribute__((optimize(0)))
dynamic_debug_init(void)
{
struct _ddebug *iter, *iter_mod_start;
struct _ddebug_site *site, *site_mod_start;
@@ -1324,6 +1325,9 @@ static int __init dynamic_debug_init(void)
int ret = 0;
int i, site_ct = 0, modct = 0, mod_index = 0;
unsigned int site_base;
// volatile
struct page *pg;
unsigned long pfn, addr;

if (&__start___dyndbg == &__stop___dyndbg) {
if (IS_ENABLED(CONFIG_DYNAMIC_DEBUG)) {
@@ -1366,6 +1370,48 @@ static int __init dynamic_debug_init(void)
if (ret)
goto out_err;

vpr_info("page: %px %px, %px %px, %px %px %d/%d\n",
virt_to_page(__start___dyndbg_sites), __start___dyndbg_sites,
virt_to_page(site), site,
virt_to_page(__stop___dyndbg_sites), __stop___dyndbg_sites,
site_base, i);

pg = virt_to_page(__start___dyndbg_sites);
vpr_info("start page: %px\n", pg);

pg = virt_to_page(site);
vpr_info("site page: %px\n", pg);

pg = virt_to_page(__stop___dyndbg_sites);
vpr_info("stop page: %px\n", pg);

pg = virt_to_page(__stop___dyndbg_sites - PAGE_SIZE);
vpr_info("dropping page: %px\n", pg);

// this doesnt crash immediately, finally does in initcalls level=5
free_reserved_page(pg);
/*
// no looping
for (addr = site; addr < __stop___dyndbg_sites; addr += PAGE_SIZE) {
pg = pfn_to_page(addr >> PAGE_SHIFT);
vpr_info("freeing page: %px\n", pg);
free_reserved_page(pg);
}
// this panicd
for (pfn = PFN_UP((long)site);
pfn < PFN_DOWN((long)__stop___dyndbg_sites); pfn++) {
struct page *page = pfn_to_page(pfn);
vpr_info("freeing page: %px %ld\n", page, pfn);
free_reserved_page(page);
}
// no looping
for (pg = virt_to_page(__stop___dyndbg_sites - PAGE_SIZE);
pg > virt_to_page(site);
pg = virt_to_page(site - PAGE_SIZE)) {
vpr_info("freeing page: %px\n", pg);
free_reserved_page(pg);
}
*/
ddebug_init_success = 1;
vpr_info("%d prdebugs in %d modules, %d KiB in ddebug tables, %d KiB in __dyndbg section, %d KiB in __dyndbg_sites section\n",
i, modct, (int)((modct * sizeof(struct ddebug_table)) >> 10),

0 comments on commit 0197e27

Please sign in to comment.