Bug 249409
| Summary: | Mapping guest pages can crash Dom0 | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Markus Armbruster <armbru> | ||||||
| Component: | kernel-xen | Assignee: | Chris Lalancette <clalance> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Martin Jenner <mjenner> | ||||||
| Severity: | high | Docs Contact: | |||||||
| Priority: | medium | ||||||||
| Version: | 5.0 | CC: | dzickus, xen-maint, yunfeng.zhao | ||||||
| Target Milestone: | --- | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | RHBA-2007-0959 | Doc Type: | Bug Fix | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2007-11-07 19:56:40 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Bug Depends On: | 248947 | ||||||||
| Bug Blocks: | 254208 | ||||||||
| Attachments: |
|
||||||||
|
Description
Markus Armbruster
2007-07-24 14:31:15 UTC
Created attachment 159853 [details]
Simple test program to map and read arbitrary mfns
Drop into tools/xenfb, compile with
$ gcc -g -O0 -Wall -D__XEN_TOOLS__ -D_LARGEFILE_SOURCE
-D_LARGEFILE64_SOURCE -I../../tools/libxc -I../../tools/xenstore
-I../../linux-2.6-xen-sparse/include -o crash249409 crash249409.c
../libxc/libxenctrl.a ../xenstore/libxenstore.a
Then this crashes a freshly booted dom0 not running any guests:
# ./crash249409 1 3435973664
The crash happens on access of the mapped page.
Serial console:
mm.c:1923:d0 Unknown domain '1'
----------- [cut here ] --------- [please bite here ] ---------
Kernel BUG at mm/memory.c:2290
invalid opcode: 0000 [1] SMP
last sysfs file: /devices/pci0000:00/0000:00:08.0/irq
CPU 0
Modules linked in: netloop netbk blktap blkbk ipt_MASQUERADE iptable_nat ip_nat
xt_state ip_conntrack nfnetlink ipt_REJECT xt_tcpudp iptable_filter ip_tables
x_tables bridge autofs4 hidp rfcomm l2cap bluetooth sunrpc ipv6 dm_multipath
video sbs backlight i2c_ec button battery asus_acpi ac parport_pc lp parport
snd_hda_intel snd_hda_codec snd_seq_dummy snd_seq_oss snd_seq_midi_event sg
snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss snd_pcm forcedeth ide_cd
serio_raw snd_timer pcspkr snd k8_edac edac_mc shpchp floppy cdrom soundcore
8250_pnp 8250 serial_core k8temp hwmon snd_page_alloc i2c_nforce2 i2c_core
dm_snapshot dm_zero dm_mirror dm_mod sata_nv libata sd_mod scsi_mod ext3 jbd
ehci_hcd ohci_hcd uhci_hcd
Pid: 4401, comm: crash249409 Not tainted 2.6.18-34.el5xen #1
RIP: e030:[<ffffffff80208b30>] [<ffffffff80208b30>]
__handle_mm_fault+0x379/0xf46
RSP: e02b:ffff8800ce7b9de8 EFLAGS: 00010202
RAX: ffffffff80514840 RBX: 0000000000000560 RCX: 00003ffffffff000
RDX: 00000000ce399560 RSI: 0000000000000067 RDI: ffff8800ea4320c0
RBP: ffff8800ea4320c0 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: ffff8800ce399560 R14: 00002aaaaaaac000 R15: ffff8800ce378138
FS: 00002aaaaaac3670(0000) GS:ffffffff80599000(0000) knlGS:0000000000000000
CS: e033 DS: 0000 ES: 0000
Process crash249409 (pid: 4401, threadinfo ffff8800ce7b8000, task
ffff8800ea4ab7a0)
Stack: 00000000fffffff2 0000000080275de1 ffff8800ea4320c0 ffff8800cefc7aa8
0000000000001000 00002aaaaaaac000 ffff8800ea4320c0 ffffffff80261889
ffff8800ea432128 ffffffff80221ee8
Call Trace:
[<ffffffff80261889>] _spin_lock_irqsave+0x9/0x14
[<ffffffff80221ee8>] __up_read+0x19/0x7f
[<ffffffff802641db>] do_page_fault+0xe48/0x11dc
[<ffffffff8030b071>] file_has_perm+0x94/0xa3
[<ffffffff8025d823>] error_exit+0x0/0x6e
Code: 0f 0b 68 ee 50 47 80 c2 f2 08 49 8b 87 90 00 00 00 48 c7 44
RIP [<ffffffff80208b30>] __handle_mm_fault+0x379/0xf46
RSP <ffff8800ce7b9de8>
<0>Kernel panic - not syncing: Fatal exception
Created attachment 172412 [details] Patch to fix this crash This patch is the same one that is attached to BZ 253583, but I'm going to use this BZ to track the kernel changes. While this patch does prevent the crash, Markus correctly points out that with this patch, an invalid xc_map_foreign_batch will map pages of zeros, instead of cleanly failing. What should really happen is a failure of mapping, instead of the successful mapping. Nevertheless, I believe we need this patch, and we should open another BZ to track the appropriate failure scenario. Chris Lalancette in 2.6.18-44.el5 You can download this test kernel from http://people.redhat.com/dzickus/el5 *** Bug 253479 has been marked as a duplicate of this bug. *** An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2007-0959.html |