Re: kernel BUG at mm/highmem.c:417! invalid opcode: 0000 EIP: zero_user_segments

[Matthew Wilcox]

On Tue, Nov 24, 2020 at 06:16:28PM +0100, Sebastian Andrzej Siewior wrote:
> On 2020-11-24 18:52:44 [+0530], Naresh Kamboju wrote:
> > While running LTP test case access01 the following kernel BUG
> > noticed on linux next 20201124 tag kernel on i386.
> > 
> > git short log:
> > ----------------
> > git log --oneline next-20201120..next-20201124 -- mm/highmem.c
> > d9927d46febf Merge branch 'akpm-current/current'
> > 72d22a0d0e86 mm: support THPs in zero_user_segments
> > 2a656cad337e mm/highmem: Take kmap_high_get() properly into account
> > 
> > Please find these easy steps to reproduce the kernel build and boot.
> 
> This BUG_ON() is in zero_user_segments() which ash been added in commit
>    72d22a0d0e86 mm: support THPs in zero_user_segments
> 
> > [   50.852189] kernel BUG at mm/highmem.c:417!
> 
> I managed to capture one invocation with:
> zero_user_segments(0xd4367a90,
>                  0x1000, 0x1000,
>                  0x0, 0x50)
> page_compound() -> 1
> page_size() -> 4096

Thanks for debugging this!  I didn't realise start1 was allowed to be
less than start2.  Try this ... (systemd is sabotaging my efforts to
test an i386 kernel)

diff --git a/mm/highmem.c b/mm/highmem.c
index 3e1087f2b735..6306a535dd9c 100644
--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -369,46 +369,39 @@ void zero_user_segments(struct page *page, unsigned 
start1, unsigned end1,
        BUG_ON(end1 > page_size(page) || end2 > page_size(page));
 
        for (i = 0; i < compound_nr(page); i++) {
-               void *kaddr;
-               unsigned this_end;
+               void *kaddr = NULL;
 
-               if (end1 == 0 && start2 >= PAGE_SIZE) {
-                       start2 -= PAGE_SIZE;
-                       end2 -= PAGE_SIZE;
-                       continue;
-               }
+               if (start1 < PAGE_SIZE || start2 < PAGE_SIZE)
+                       kaddr = kmap_atomic(page + i);
 
                if (start1 >= PAGE_SIZE) {
                        start1 -= PAGE_SIZE;
                        end1 -= PAGE_SIZE;
-                       if (start2) {
-                               start2 -= PAGE_SIZE;
-                               end2 -= PAGE_SIZE;
-                       }
-                       continue;
-               }
-
-               kaddr = kmap_atomic(page + i);
+               } else {
+                       unsigned this_end = min_t(unsigned, end1, PAGE_SIZE);
 
-               this_end = min_t(unsigned, end1, PAGE_SIZE);
-               if (end1 > start1)
-                       memset(kaddr + start1, 0, this_end - start1);
-               end1 -= this_end;
-               start1 = 0;
+                       if (end1 > start1)
+                               memset(kaddr + start1, 0, this_end - start1);
+                       end1 -= this_end;
+                       start1 = 0;
+               }
 
                if (start2 >= PAGE_SIZE) {
                        start2 -= PAGE_SIZE;
                        end2 -= PAGE_SIZE;
                } else {
-                       this_end = min_t(unsigned, end2, PAGE_SIZE);
+                       unsigned this_end = min_t(unsigned, end2, PAGE_SIZE);
+
                        if (end2 > start2)
                                memset(kaddr + start2, 0, this_end - start2);
                        end2 -= this_end;
                        start2 = 0;
                }
 
-               kunmap_atomic(kaddr);
-               flush_dcache_page(page + i);
+               if (kaddr) {
+                       kunmap_atomic(kaddr);
+                       flush_dcache_page(page + i);
+               }
 
                if (!end1 && !end2)
                        break;