On Mon, Dec 18, 2017 at 10:13:02AM +0100, Michal Hocko wrote:
> On Fri 15-12-17 16:49:28, Andrei Vagin wrote:
> > Hi Michal,
> >
> > We run CRIU tests for linux-next and the 4.15.0-rc3-next-20171215 kernel
> > doesn't boot:
> >
> > [ 3.492549] Freeing unused kernel memory: 1640K
> > [ 3.494547] Write protecting the kernel read-only data: 18432k
> > [ 3.498781] Freeing unused kernel memory: 2016K
> > [ 3.503330] Freeing unused kernel memory: 512K
> > [ 3.505232] rodata_test: all tests were successful
> > [ 3.515355] 1 (init): Uhuuh, elf segement at 00000000928fda3e requested but the memory is mapped already
>
> Hmm, this interesting. What does the test actualy do? Could you add some
> instrumentation to see what is actually mapped there? Something like
There is nothing mapped there. It returns -95 (ENOSUPP)
The kernel is booted with this patch:
+ int ttype = type & ~MAP_FIXED_SAFE;
if (total_size) {
total_size = ELF_PAGEALIGN(total_size);
- map_addr = vm_mmap(filep, addr, total_size, prot, type,
off);
+ map_addr = vm_mmap(filep, addr, total_size, prot, ttype, off);
if (!BAD_ADDR(map_addr))
vm_munmap(map_addr+size, total_size-size);
} else
- map_addr = vm_mmap(filep, addr, size, prot, type, off);
+ map_addr = vm_mmap(filep, addr, size, prot, ttype, off);
>
> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> index 0e50230ce53d..1b68ddc34043 100644
> --- a/fs/binfmt_elf.c
> +++ b/fs/binfmt_elf.c
> @@ -372,10 +372,28 @@ static unsigned long elf_map(struct file *filep, unsigned long addr,
> } else
> map_addr = vm_mmap(filep, addr, size, prot, type, off);
>
> - if ((type & MAP_FIXED_SAFE) && BAD_ADDR(map_addr))
> + if ((type & MAP_FIXED_SAFE) && BAD_ADDR(map_addr)) {
> + struct vm_area_struct *vma;
> +
> pr_info("%d (%s): Uhuuh, elf segment at %p requested but the memory is mapped already\n",
> task_pid_nr(current), current->comm,
> (void *)addr);
> + vma = find_vma(current->mm, map_addr);
> + if (vma && vma->vm_start < addr) {
> + pr_info("requested [%lx, %lx] mapped [%lx, %lx] %lx ", addr, addr + total_size,
> + vma->vm_start, vma->vm_end, vma->vm_flags);
> + if (!vma->vm_file) {
> + pr_cont("anon\n");
> + } else {
> + char path[512];
> + char *p = file_path(vma->vm_file, path, sizeof(path));
> + if (IS_ERR(p))
> + p = "?";
> + pr_cont("\"%s\"\n", kbasename(p));
> + }
> + dump_stack();
> + }
> + }
>
> return(map_addr);
> }
>
> > [ 3.519533] Starting init: /sbin/init exists but couldn't execute it (error -95)
> > [ 3.528993] Starting init: /bin/sh exists but couldn't execute it (error -14)
> > [ 3.532127] Kernel panic - not syncing: No working init found. Try passing init= option to kernel. See Linux Documentation/admin-guide/init.rst for guidance.
> > [ 3.538328] CPU: 0 PID: 1 Comm: init Not tainted 4.15.0-rc3-next-20171215-00001-g6d6aea478fce #11
> > [ 3.542201] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc26 04/01/2014
> > [ 3.546081] Call Trace:
> > [ 3.547221] dump_stack+0x5c/0x79
> > [ 3.548768] ? rest_init+0x30/0xb0
> > [ 3.550320] panic+0xe4/0x232
> > [ 3.551669] ? rest_init+0xb0/0xb0
> > [ 3.553110] kernel_init+0xeb/0x100
> > [ 3.554701] ret_from_fork+0x1f/0x30
> > [ 3.558964] Kernel Offset: 0x2000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
> > [ 3.564160] ---[ end Kernel panic - not syncing: No working init found. Try passing init= option to kernel. See Linux Documentation/admin-guide/init.rst for guidance.
> >
> > If I revert this patch, it boots normally.
> >
> > Thanks,
> > Andrei
> >
> > On Wed, Dec 13, 2017 at 10:25:50AM +0100, Michal Hocko wrote:
> > > From: Michal Hocko <mhocko@xxxxxxxx>
> > >
> > > Both load_elf_interp and load_elf_binary rely on elf_map to map segments
> > > on a controlled address and they use MAP_FIXED to enforce that. This is
> > > however dangerous thing prone to silent data corruption which can be
> > > even exploitable. Let's take CVE-2017-1000253 as an example. At the time
> > > (before eab09532d400 ("binfmt_elf: use ELF_ET_DYN_BASE only for PIE"))
> > > ELF_ET_DYN_BASE was at TASK_SIZE / 3 * 2 which is not that far away from
> > > the stack top on 32b (legacy) memory layout (only 1GB away). Therefore
> > > we could end up mapping over the existing stack with some luck.
> > >
> > > The issue has been fixed since then (a87938b2e246 ("fs/binfmt_elf.c:
> > > fix bug in loading of PIE binaries")), ELF_ET_DYN_BASE moved moved much
> > > further from the stack (eab09532d400 and later by c715b72c1ba4 ("mm:
> > > revert x86_64 and arm64 ELF_ET_DYN_BASE base changes")) and excessive
> > > stack consumption early during execve fully stopped by da029c11e6b1
> > > ("exec: Limit arg stack to at most 75% of _STK_LIM"). So we should be
> > > safe and any attack should be impractical. On the other hand this is
> > > just too subtle assumption so it can break quite easily and hard to
> > > spot.
> > >
> > > I believe that the MAP_FIXED usage in load_elf_binary (et. al) is still
> > > fundamentally dangerous. Moreover it shouldn't be even needed. We are
> > > at the early process stage and so there shouldn't be unrelated mappings
> > > (except for stack and loader) existing so mmap for a given address
> > > should succeed even without MAP_FIXED. Something is terribly wrong if
> > > this is not the case and we should rather fail than silently corrupt the
> > > underlying mapping.
> > >
> > > Address this issue by changing MAP_FIXED to the newly added
> > > MAP_FIXED_SAFE. This will mean that mmap will fail if there is an
> > > existing mapping clashing with the requested one without clobbering it.
> > >
> > > Cc: Abdul Haleem <abdhalee@xxxxxxxxxxxxxxxxxx>
> > > Cc: Joel Stanley <joel@xxxxxxxxx>
> > > Acked-by: Kees Cook <keescook@xxxxxxxxxxxx>
> > > Reviewed-by: Khalid Aziz <khalid.aziz@xxxxxxxxxx>
> > > Signed-off-by: Michal Hocko <mhocko@xxxxxxxx>
> > > ---
> > > arch/metag/kernel/process.c | 6 +++++-
> > > fs/binfmt_elf.c | 12 ++++++++----
> > > 2 files changed, 13 insertions(+), 5 deletions(-)
> > >
> > > diff --git a/arch/metag/kernel/process.c b/arch/metag/kernel/process.c
> > > index 0909834c83a7..867c8d0a5fb4 100644
> > > --- a/arch/metag/kernel/process.c
> > > +++ b/arch/metag/kernel/process.c
> > > @@ -399,7 +399,7 @@ unsigned long __metag_elf_map(struct file *filep, unsigned long addr,
> > > tcm_tag = tcm_lookup_tag(addr);
> > >
> > > if (tcm_tag != TCM_INVALID_TAG)
> > > - type &= ~MAP_FIXED;
> > > + type &= ~(MAP_FIXED | MAP_FIXED_SAFE);
> > >
> > > /*
> > > * total_size is the size of the ELF (interpreter) image.
> > > @@ -417,6 +417,10 @@ unsigned long __metag_elf_map(struct file *filep, unsigned long addr,
> > > } else
> > > map_addr = vm_mmap(filep, addr, size, prot, type, off);
> > >
> > > + if ((type & MAP_FIXED_SAFE) && BAD_ADDR(map_addr))
> > > + pr_info("%d (%s): Uhuuh, elf segement at %p requested but the memory is mapped already\n",
> > > + task_pid_nr(current), tsk->comm, (void*)addr);
> > > +
> > > if (!BAD_ADDR(map_addr) && tcm_tag != TCM_INVALID_TAG) {
> > > struct tcm_allocation *tcm;
> > > unsigned long tcm_addr;
> > > diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> > > index 73b01e474fdc..5916d45f64a7 100644
> > > --- a/fs/binfmt_elf.c
> > > +++ b/fs/binfmt_elf.c
> > > @@ -372,6 +372,10 @@ static unsigned long elf_map(struct file *filep, unsigned long addr,
> > > } else
> > > map_addr = vm_mmap(filep, addr, size, prot, type, off);
> > >
> > > + if ((type & MAP_FIXED_SAFE) && BAD_ADDR(map_addr))
> > > + pr_info("%d (%s): Uhuuh, elf segement at %p requested but the memory is mapped already\n",
> > > + task_pid_nr(current), current->comm, (void*)addr);
> > > +
> > > return(map_addr);
> > > }
> > >
> > > @@ -569,7 +573,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
> > > elf_prot |= PROT_EXEC;
> > > vaddr = eppnt->p_vaddr;
> > > if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
> > > - elf_type |= MAP_FIXED;
> > > + elf_type |= MAP_FIXED_SAFE;
> > > else if (no_base && interp_elf_ex->e_type == ET_DYN)
> > > load_addr = -vaddr;
> > >
> > > @@ -930,7 +934,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
> > > * the ET_DYN load_addr calculations, proceed normally.
> > > */
> > > if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
> > > - elf_flags |= MAP_FIXED;
> > > + elf_flags |= MAP_FIXED_SAFE;
> > > } else if (loc->elf_ex.e_type == ET_DYN) {
> > > /*
> > > * This logic is run once for the first LOAD Program
> > > @@ -966,7 +970,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
> > > load_bias = ELF_ET_DYN_BASE;
> > > if (current->flags & PF_RANDOMIZE)
> > > load_bias += arch_mmap_rnd();
> > > - elf_flags |= MAP_FIXED;
> > > + elf_flags |= MAP_FIXED_SAFE;
> > > } else
> > > load_bias = 0;
> > >
> > > @@ -1223,7 +1227,7 @@ static int load_elf_library(struct file *file)
> > > (eppnt->p_filesz +
> > > ELF_PAGEOFFSET(eppnt->p_vaddr)),
> > > PROT_READ | PROT_WRITE | PROT_EXEC,
> > > - MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
> > > + MAP_FIXED_SAFE | MAP_PRIVATE | MAP_DENYWRITE,
> > > (eppnt->p_offset -
> > > ELF_PAGEOFFSET(eppnt->p_vaddr)));
> > > if (error != ELF_PAGESTART(eppnt->p_vaddr))
>
>
> > [ 0.000000] Linux version 4.15.0-rc3-next-20171215-00001-g6d6aea478fce (avagin@laptop) (gcc version 7.2.1 20170915 (Red Hat 7.2.1-2) (GCC)) #11 SMP Fri Dec 15 16:39:11 PST 2017
> > [ 0.000000] Command line: root=/dev/vda2 ro debug console=ttyS0,115200 LANG=en_US.UTF-8 slub_debug=FZP raid=noautodetect selinux=0
> > [ 0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
> > [ 0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
> > [ 0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
> > [ 0.000000] x86/fpu: Supporting XSAVE feature 0x008: 'MPX bounds registers'
> > [ 0.000000] x86/fpu: Supporting XSAVE feature 0x010: 'MPX CSR'
> > [ 0.000000] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256
> > [ 0.000000] x86/fpu: xstate_offset[3]: 832, xstate_sizes[3]: 64
> > [ 0.000000] x86/fpu: xstate_offset[4]: 896, xstate_sizes[4]: 64
> > [ 0.000000] x86/fpu: Enabled xstate features 0x1f, context size is 960 bytes, using 'compacted' format.
> > [ 0.000000] e820: BIOS-provided physical RAM map:
> > [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
> > [ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
> > [ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
> > [ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x000000007ffd8fff] usable
> > [ 0.000000] BIOS-e820: [mem 0x000000007ffd9000-0x000000007fffffff] reserved
> > [ 0.000000] BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved
> > [ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
> > [ 0.000000] NX (Execute Disable) protection: active
> > [ 0.000000] random: fast init done
> > [ 0.000000] SMBIOS 2.8 present.
> > [ 0.000000] DMI: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc26 04/01/2014
> > [ 0.000000] Hypervisor detected: KVM
> > [ 0.000000] e820: update [mem 0x00000000-0x00000fff] usable ==> reserved
> > [ 0.000000] e820: remove [mem 0x000a0000-0x000fffff] usable
> > [ 0.000000] e820: last_pfn = 0x7ffd9 max_arch_pfn = 0x400000000
> > [ 0.000000] MTRR default type: write-back
> > [ 0.000000] MTRR fixed ranges enabled:
> > [ 0.000000] 00000-9FFFF write-back
> > [ 0.000000] A0000-BFFFF uncachable
> > [ 0.000000] C0000-FFFFF write-protect
> > [ 0.000000] MTRR variable ranges enabled:
> > [ 0.000000] 0 base 0080000000 mask FF80000000 uncachable
> > [ 0.000000] 1 disabled
> > [ 0.000000] 2 disabled
> > [ 0.000000] 3 disabled
> > [ 0.000000] 4 disabled
> > [ 0.000000] 5 disabled
> > [ 0.000000] 6 disabled
> > [ 0.000000] 7 disabled
> > [ 0.000000] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT
> > [ 0.000000] found SMP MP-table at [mem 0x000f6bd0-0x000f6bdf] mapped at [ (ptrval)]
> > [ 0.000000] Base memory trampoline at [ (ptrval)] 99000 size 24576
> > [ 0.000000] Using GB pages for direct mapping
> > [ 0.000000] BRK [0x2c984000, 0x2c984fff] PGTABLE
> > [ 0.000000] BRK [0x2c985000, 0x2c985fff] PGTABLE
> > [ 0.000000] BRK [0x2c986000, 0x2c986fff] PGTABLE
> > [ 0.000000] BRK [0x2c987000, 0x2c987fff] PGTABLE
> > [ 0.000000] BRK [0x2c988000, 0x2c988fff] PGTABLE
> > [ 0.000000] BRK [0x2c989000, 0x2c989fff] PGTABLE
> > [ 0.000000] ACPI: Early table checksum verification disabled
> > [ 0.000000] ACPI: RSDP 0x00000000000F69C0 000014 (v00 BOCHS )
> > [ 0.000000] ACPI: RSDT 0x000000007FFE12FF 00002C (v01 BOCHS BXPCRSDT 00000001 BXPC 00000001)
> > [ 0.000000] ACPI: FACP 0x000000007FFE120B 000074 (v01 BOCHS BXPCFACP 00000001 BXPC 00000001)
> > [ 0.000000] ACPI: DSDT 0x000000007FFE0040 0011CB (v01 BOCHS BXPCDSDT 00000001 BXPC 00000001)
> > [ 0.000000] ACPI: FACS 0x000000007FFE0000 000040
> > [ 0.000000] ACPI: APIC 0x000000007FFE127F 000080 (v01 BOCHS BXPCAPIC 00000001 BXPC 00000001)
> > [ 0.000000] ACPI: Local APIC address 0xfee00000
> > [ 0.000000] No NUMA configuration found
> > [ 0.000000] Faking a node at [mem 0x0000000000000000-0x000000007ffd8fff]
> > [ 0.000000] NODE_DATA(0) allocated [mem 0x7ffc2000-0x7ffd8fff]
> > [ 0.000000] kvm-clock: cpu 0, msr 0:7ffc0001, primary cpu clock
> > [ 0.000000] kvm-clock: Using msrs 4b564d01 and 4b564d00
> > [ 0.000000] kvm-clock: using sched offset of 1076013277 cycles
> > [ 0.000000] clocksource: kvm-clock: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns
> > [ 0.000000] Zone ranges:
> > [ 0.000000] DMA [mem 0x0000000000001000-0x0000000000ffffff]
> > [ 0.000000] DMA32 [mem 0x0000000001000000-0x000000007ffd8fff]
> > [ 0.000000] Normal empty
> > [ 0.000000] Device empty
> > [ 0.000000] Movable zone start for each node
> > [ 0.000000] Early memory node ranges
> > [ 0.000000] node 0: [mem 0x0000000000001000-0x000000000009efff]
> > [ 0.000000] node 0: [mem 0x0000000000100000-0x000000007ffd8fff]
> > [ 0.000000] Initmem setup node 0 [mem 0x0000000000001000-0x000000007ffd8fff]
> > [ 0.000000] On node 0 totalpages: 524151
> > [ 0.000000] DMA zone: 64 pages used for memmap
> > [ 0.000000] DMA zone: 21 pages reserved
> > [ 0.000000] DMA zone: 3998 pages, LIFO batch:0
> > [ 0.000000] DMA32 zone: 8128 pages used for memmap
> > [ 0.000000] DMA32 zone: 520153 pages, LIFO batch:31
> > [ 0.000000] Reserved but unavailable: 98 pages
> > [ 0.000000] ACPI: PM-Timer IO Port: 0x608
> > [ 0.000000] ACPI: Local APIC address 0xfee00000
> > [ 0.000000] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1])
> > [ 0.000000] IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23
> > [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl)
> > [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level)
> > [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
> > [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level)
> > [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level)
> > [ 0.000000] ACPI: IRQ0 used by override.
> > [ 0.000000] ACPI: IRQ5 used by override.
> > [ 0.000000] ACPI: IRQ9 used by override.
> > [ 0.000000] ACPI: IRQ10 used by override.
> > [ 0.000000] ACPI: IRQ11 used by override.
> > [ 0.000000] Using ACPI (MADT) for SMP configuration information
> > [ 0.000000] smpboot: Allowing 2 CPUs, 0 hotplug CPUs
> > [ 0.000000] PM: Registered nosave memory: [mem 0x00000000-0x00000fff]
> > [ 0.000000] PM: Registered nosave memory: [mem 0x0009f000-0x0009ffff]
> > [ 0.000000] PM: Registered nosave memory: [mem 0x000a0000-0x000effff]
> > [ 0.000000] PM: Registered nosave memory: [mem 0x000f0000-0x000fffff]
> > [ 0.000000] e820: [mem 0x80000000-0xfeffbfff] available for PCI devices
> > [ 0.000000] Booting paravirtualized kernel on KVM
> > [ 0.000000] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1910969940391419 ns
> > [ 0.000000] setup_percpu: NR_CPUS:64 nr_cpumask_bits:64 nr_cpu_ids:2 nr_node_ids:1
> > [ 0.000000] percpu: Embedded 44 pages/cpu @ (ptrval) s142296 r8192 d29736 u1048576
> > [ 0.000000] pcpu-alloc: s142296 r8192 d29736 u1048576 alloc=1*2097152
> > [ 0.000000] pcpu-alloc: [0] 0 1
> > [ 0.000000] KVM setup async PF for cpu 0
> > [ 0.000000] kvm-stealtime: cpu 0, msr 7fc122c0
> > [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 515938
> > [ 0.000000] Policy zone: DMA32
> > [ 0.000000] Kernel command line: root=/dev/vda2 ro debug console=ttyS0,115200 LANG=en_US.UTF-8 slub_debug=FZP raid=noautodetect selinux=0
> > [ 0.000000] Memory: 2037056K/2096604K available (12300K kernel code, 1554K rwdata, 3584K rodata, 1640K init, 912K bss, 59548K reserved, 0K cma-reserved)
> > [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
> > [ 0.000000] ftrace: allocating 36554 entries in 143 pages
> > [ 0.001000] Hierarchical RCU implementation.
> > [ 0.001000] RCU restricting CPUs from NR_CPUS=64 to nr_cpu_ids=2.
> > [ 0.001000] RCU: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
> > [ 0.001000] NR_IRQS: 4352, nr_irqs: 440, preallocated irqs: 16
> > [ 0.001000] Offload RCU callbacks from CPUs: (none).
> > [ 0.001000] Console: colour dummy device 80x25
> > [ 0.001000] console [ttyS0] enabled
> > [ 0.001000] ACPI: Core revision 20171110
> > [ 0.001000] ACPI: 1 ACPI AML tables successfully acquired and loaded
> > [ 0.001009] APIC: Switch to symmetric I/O mode setup
> > [ 0.001571] x2apic enabled
> > [ 0.002003] Switched APIC routing to physical x2apic.
> > [ 0.003538] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1
> > [ 0.004000] tsc: Detected 2496.000 MHz processor
> > [ 0.004014] Calibrating delay loop (skipped) preset value.. 4992.00 BogoMIPS (lpj=2496000)
> > [ 0.005014] pid_max: default: 32768 minimum: 301
> > [ 0.006057] Security Framework initialized
> > [ 0.006548] Yama: becoming mindful.
> > [ 0.007019] SELinux: Disabled at boot.
> > [ 0.008206] Dentry cache hash table entries: 262144 (order: 9, 2097152 bytes)
> > [ 0.009164] Inode-cache hash table entries: 131072 (order: 8, 1048576 bytes)
> > [ 0.009816] Mount-cache hash table entries: 4096 (order: 3, 32768 bytes)
> > [ 0.010009] Mountpoint-cache hash table entries: 4096 (order: 3, 32768 bytes)
> > [ 0.011322] mce: CPU supports 10 MCE banks
> > [ 0.011740] Last level iTLB entries: 4KB 0, 2MB 0, 4MB 0
> > [ 0.012002] Last level dTLB entries: 4KB 0, 2MB 0, 4MB 0, 1GB 0
> > [ 0.012610] Freeing SMP alternatives memory: 36K
> > [ 0.013467] TSC deadline timer enabled
> > [ 0.013820] smpboot: CPU0: Intel Core Processor (Skylake) (family: 0x6, model: 0x5e, stepping: 0x3)
> > [ 0.014000] Performance Events: unsupported p6 CPU model 94 no PMU driver, software events only.
> > [ 0.014041] Hierarchical SRCU implementation.
> > [ 0.015133] NMI watchdog: Perf event create on CPU 0 failed with -2
> > [ 0.015725] NMI watchdog: Perf NMI watchdog permanently disabled
> > [ 0.016077] smp: Bringing up secondary CPUs ...
> > [ 0.016654] x86: Booting SMP configuration:
> > [ 0.017005] .... node #0, CPUs: #1
> > [ 0.001000] kvm-clock: cpu 1, msr 0:7ffc0041, secondary cpu clock
> > [ 0.019051] KVM setup async PF for cpu 1
> > [ 0.019599] kvm-stealtime: cpu 1, msr 7fd122c0
> > [ 0.020009] smp: Brought up 1 node, 2 CPUs
> > [ 0.020531] smpboot: Max logical packages: 2
> > [ 0.021009] smpboot: Total of 2 processors activated (9984.00 BogoMIPS)
> > [ 0.023160] devtmpfs: initialized
> > [ 0.023513] x86/mm: Memory block size: 128MB
> > [ 0.024811] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446275000 ns
> > [ 0.025015] futex hash table entries: 512 (order: 3, 32768 bytes)
> > [ 0.026185] RTC time: 0:42:06, date: 12/16/17
> > [ 0.026790] NET: Registered protocol family 16
> > [ 0.027204] audit: initializing netlink subsys (disabled)
> > [ 0.027914] audit: type=2000 audit(1513384927.133:1): state=initialized audit_enabled=0 res=1
> > [ 0.028185] cpuidle: using governor menu
> > [ 0.029118] ACPI: bus type PCI registered
> > [ 0.029872] PCI: Using configuration type 1 for base access
> > [ 0.034355] HugeTLB registered 1.00 GiB page size, pre-allocated 0 pages
> > [ 0.035011] HugeTLB registered 2.00 MiB page size, pre-allocated 0 pages
> > [ 0.036066] cryptd: max_cpu_qlen set to 1000
> > [ 0.036579] ACPI: Added _OSI(Module Device)
> > [ 0.037007] ACPI: Added _OSI(Processor Device)
> > [ 0.037426] ACPI: Added _OSI(3.0 _SCP Extensions)
> > [ 0.037857] ACPI: Added _OSI(Processor Aggregator Device)
> > [ 0.041356] ACPI: Interpreter enabled
> > [ 0.041764] ACPI: (supports S0 S5)
> > [ 0.042005] ACPI: Using IOAPIC for interrupt routing
> > [ 0.042655] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
> > [ 0.043625] ACPI: Enabled 2 GPEs in block 00 to 0F
> > [ 0.059248] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff])
> > [ 0.059953] acpi PNP0A03:00: _OSC: OS supports [ASPM ClockPM Segments MSI]
> > [ 0.060045] acpi PNP0A03:00: _OSC failed (AE_NOT_FOUND); disabling ASPM
> > [ 0.061180] PCI host bridge to bus 0000:00
> > [ 0.061874] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window]
> > [ 0.062013] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window]
> > [ 0.063016] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window]
> > [ 0.064015] pci_bus 0000:00: root bus resource [mem 0x80000000-0xfebfffff window]
> > [ 0.065014] pci_bus 0000:00: root bus resource [bus 00-ff]
> > [ 0.065753] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000
> > [ 0.066487] pci 0000:00:01.0: [8086:7000] type 00 class 0x060100
> > [ 0.067537] pci 0000:00:01.1: [8086:7010] type 00 class 0x010180
> > [ 0.071700] pci 0000:00:01.1: reg 0x20: [io 0xc100-0xc10f]
> > [ 0.074032] pci 0000:00:01.1: legacy IDE quirk: reg 0x10: [io 0x01f0-0x01f7]
> > [ 0.074908] pci 0000:00:01.1: legacy IDE quirk: reg 0x14: [io 0x03f6]
> > [ 0.075011] pci 0000:00:01.1: legacy IDE quirk: reg 0x18: [io 0x0170-0x0177]
> > [ 0.076010] pci 0000:00:01.1: legacy IDE quirk: reg 0x1c: [io 0x0376]
> > [ 0.077121] pci 0000:00:01.3: [8086:7113] type 00 class 0x068000
> > [ 0.078148] pci 0000:00:01.3: quirk: [io 0x0600-0x063f] claimed by PIIX4 ACPI
> > [ 0.079014] pci 0000:00:01.3: quirk: [io 0x0700-0x070f] claimed by PIIX4 SMB
> > [ 0.080224] pci 0000:00:03.0: [1af4:1000] type 00 class 0x020000
> > [ 0.082007] pci 0000:00:03.0: reg 0x10: [io 0xc040-0xc05f]
> > [ 0.083814] pci 0000:00:03.0: reg 0x14: [mem 0xfebc0000-0xfebc0fff]
> > [ 0.089891] pci 0000:00:03.0: reg 0x30: [mem 0xfeb80000-0xfebbffff pref]
> > [ 0.090545] pci 0000:00:05.0: [1af4:1003] type 00 class 0x078000
> > [ 0.092708] pci 0000:00:05.0: reg 0x10: [io 0xc060-0xc07f]
> > [ 0.094009] pci 0000:00:05.0: reg 0x14: [mem 0xfebc1000-0xfebc1fff]
> > [ 0.102484] pci 0000:00:06.0: [8086:2934] type 00 class 0x0c0300
> > [ 0.108028] pci 0000:00:06.0: reg 0x20: [io 0xc080-0xc09f]
> > [ 0.110738] pci 0000:00:06.1: [8086:2935] type 00 class 0x0c0300
> > [ 0.114388] pci 0000:00:06.1: reg 0x20: [io 0xc0a0-0xc0bf]
> > [ 0.117339] pci 0000:00:06.2: [8086:2936] type 00 class 0x0c0300
> > [ 0.122770] pci 0000:00:06.2: reg 0x20: [io 0xc0c0-0xc0df]
> > [ 0.124738] pci 0000:00:06.7: [8086:293a] type 00 class 0x0c0320
> > [ 0.125825] pci 0000:00:06.7: reg 0x10: [mem 0xfebc2000-0xfebc2fff]
> > [ 0.130347] pci 0000:00:07.0: [1af4:1001] type 00 class 0x010000
> > [ 0.133007] pci 0000:00:07.0: reg 0x10: [io 0xc000-0xc03f]
> > [ 0.134793] pci 0000:00:07.0: reg 0x14: [mem 0xfebc3000-0xfebc3fff]
> > [ 0.141808] pci 0000:00:08.0: [1af4:1002] type 00 class 0x00ff00
> > [ 0.142914] pci 0000:00:08.0: reg 0x10: [io 0xc0e0-0xc0ff]
> > [ 0.148977] ACPI: PCI Interrupt Link [LNKA] (IRQs 5 *10 11)
> > [ 0.149455] ACPI: PCI Interrupt Link [LNKB] (IRQs 5 *10 11)
> > [ 0.150390] ACPI: PCI Interrupt Link [LNKC] (IRQs 5 10 *11)
> > [ 0.151382] ACPI: PCI Interrupt Link [LNKD] (IRQs 5 10 *11)
> > [ 0.152380] ACPI: PCI Interrupt Link [LNKS] (IRQs *9)
> > [ 0.154508] vgaarb: loaded
> > [ 0.155271] SCSI subsystem initialized
> > [ 0.155887] EDAC MC: Ver: 3.0.0
> > [ 0.156255] PCI: Using ACPI for IRQ routing
> > [ 0.156566] PCI: pci_cache_line_size set to 64 bytes
> > [ 0.157161] e820: reserve RAM buffer [mem 0x0009fc00-0x0009ffff]
> > [ 0.157914] e820: reserve RAM buffer [mem 0x7ffd9000-0x7fffffff]
> > [ 0.158253] NetLabel: Initializing
> > [ 0.158765] NetLabel: domain hash size = 128
> > [ 0.159005] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO
> > [ 0.159775] NetLabel: unlabeled traffic allowed by default
> > [ 0.160073] clocksource: Switched to clocksource kvm-clock
> > [ 0.186764] VFS: Disk quotas dquot_6.6.0
> > [ 0.187277] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes)
> > [ 0.188251] FS-Cache: Loaded
> > [ 0.188725] pnp: PnP ACPI init
> > [ 0.189271] pnp 00:00: Plug and Play ACPI device, IDs PNP0b00 (active)
> > [ 0.190231] pnp 00:01: Plug and Play ACPI device, IDs PNP0303 (active)
> > [ 0.191229] pnp 00:02: Plug and Play ACPI device, IDs PNP0f13 (active)
> > [ 0.192096] pnp 00:03: [dma 2]
> > [ 0.192514] pnp 00:03: Plug and Play ACPI device, IDs PNP0700 (active)
> > [ 0.193631] pnp 00:04: Plug and Play ACPI device, IDs PNP0501 (active)
> > [ 0.195416] pnp: PnP ACPI: found 5 devices
> > [ 0.206055] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
> > [ 0.207127] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window]
> > [ 0.207832] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window]
> > [ 0.208594] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window]
> > [ 0.209469] pci_bus 0000:00: resource 7 [mem 0x80000000-0xfebfffff window]
> > [ 0.210493] NET: Registered protocol family 2
> > [ 0.211244] tcp_listen_portaddr_hash hash table entries: 1024 (order: 2, 16384 bytes)
> > [ 0.212283] TCP established hash table entries: 16384 (order: 5, 131072 bytes)
> > [ 0.213285] TCP bind hash table entries: 16384 (order: 6, 262144 bytes)
> > [ 0.214306] TCP: Hash tables configured (established 16384 bind 16384)
> > [ 0.215065] UDP hash table entries: 1024 (order: 3, 32768 bytes)
> > [ 0.215797] UDP-Lite hash table entries: 1024 (order: 3, 32768 bytes)
> > [ 0.217934] NET: Registered protocol family 1
> > [ 0.219126] RPC: Registered named UNIX socket transport module.
> > [ 0.219676] RPC: Registered udp transport module.
> > [ 0.220130] RPC: Registered tcp transport module.
> > [ 0.220552] RPC: Registered tcp NFSv4.1 backchannel transport module.
> > [ 0.221153] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
> > [ 0.221701] pci 0000:00:01.0: PIIX3: Enabling Passive Release
> > [ 0.222319] pci 0000:00:01.0: Activating ISA DMA hang workarounds
> > [ 0.444214] ACPI: PCI Interrupt Link [LNKB] enabled at IRQ 10
> > [ 0.880141] ACPI: PCI Interrupt Link [LNKC] enabled at IRQ 11
> > [ 1.311493] ACPI: PCI Interrupt Link [LNKD] enabled at IRQ 11
> > [ 1.748829] ACPI: PCI Interrupt Link [LNKA] enabled at IRQ 10
> > [ 1.962124] PCI: CLS 0 bytes, default 64
> > [ 1.964749] Initialise system trusted keyrings
> > [ 1.965289] workingset: timestamp_bits=37 max_order=19 bucket_order=0
> > [ 1.969600] zbud: loaded
> > [ 1.971287] SGI XFS with security attributes, no debug enabled
> > [ 2.106071] NET: Registered protocol family 38
> > [ 2.106556] Key type asymmetric registered
> > [ 2.106931] Asymmetric key parser 'x509' registered
> > [ 2.107514] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 248)
> > [ 2.108327] io scheduler noop registered
> > [ 2.108813] io scheduler deadline registered
> > [ 2.109608] io scheduler cfq registered (default)
> > [ 2.110258] io scheduler mq-deadline registered
> > [ 2.110796] io scheduler kyber registered
> > [ 2.111688] intel_idle: Please enable MWAIT in BIOS SETUP
> > [ 2.112310] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0
> > [ 2.113037] ACPI: Power Button [PWRF]
> > [ 2.331642] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
> > [ 2.554093] virtio-pci 0000:00:05.0: virtio_pci: leaving for legacy driver
> > [ 2.775938] virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver
> > [ 2.975053] tsc: Refined TSC clocksource calibration: 2495.981 MHz
> > [ 2.975641] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x23fa6529869, max_idle_ns: 440795218057 ns
> > [ 3.029409] virtio-pci 0000:00:08.0: virtio_pci: leaving for legacy driver
> > [ 3.032925] Serial: 8250/16550 driver, 32 ports, IRQ sharing enabled
> > [ 3.056849] 00:04: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
> > [ 3.064748] Non-volatile memory driver v1.3
> > [ 3.065925] ppdev: user-space parallel port driver
> > [ 3.071816] loop: module loaded
> > [ 3.075337] vda: vda1 vda2 vda3
> > [ 3.076659] Rounding down aligned max_sectors from 4294967295 to 4294967288
> > [ 3.077996] Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
> > [ 3.079790] libphy: Fixed MDIO Bus: probed
> > [ 3.080257] tun: Universal TUN/TAP device driver, 1.6
> > [ 3.082222] i8042: PNP: PS/2 Controller [PNP0303:KBD,PNP0f13:MOU] at 0x60,0x64 irq 1,12
> > [ 3.083675] serio: i8042 KBD port at 0x60,0x64 irq 1
> > [ 3.084160] serio: i8042 AUX port at 0x60,0x64 irq 12
> > [ 3.084816] mousedev: PS/2 mouse device common for all mice
> > [ 3.086603] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input1
> > [ 3.089192] rtc_cmos 00:00: RTC can wake from S4
> > [ 3.090116] rtc_cmos 00:00: rtc core: registered rtc_cmos as rtc0
> > [ 3.092829] rtc_cmos 00:00: alarms up to one day, y3k, 114 bytes nvram
> > [ 3.093937] IR NEC protocol handler initialized
> > [ 3.094408] IR RC5(x/sz) protocol handler initialized
> > [ 3.094901] IR RC6 protocol handler initialized
> > [ 3.095510] IR JVC protocol handler initialized
> > [ 3.095952] IR Sony protocol handler initialized
> > [ 3.096399] IR SANYO protocol handler initialized
> > [ 3.096862] IR Sharp protocol handler initialized
> > [ 3.097342] IR MCE Keyboard/mouse protocol handler initialized
> > [ 3.097919] IR XMP protocol handler initialized
> > [ 3.098530] device-mapper: uevent: version 1.0.3
> > [ 3.099209] device-mapper: ioctl: 4.37.0-ioctl (2017-09-20) initialised: dm-devel@xxxxxxxxxx
> > [ 3.100398] device-mapper: multipath round-robin: version 1.2.0 loaded
> > [ 3.101883] drop_monitor: Initializing network drop monitor service
> > [ 3.102553] Netfilter messages via NETLINK v0.30.
> > [ 3.103090] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
> > [ 3.103738] ctnetlink v0.93: registering with nfnetlink.
> > [ 3.104494] ip_tables: (C) 2000-2006 Netfilter Core Team
> > [ 3.105734] Initializing XFRM netlink socket
> > [ 3.106885] NET: Registered protocol family 10
> > [ 3.109341] Segment Routing with IPv6
> > [ 3.109976] mip6: Mobile IPv6
> > [ 3.111987] ip6_tables: (C) 2000-2006 Netfilter Core Team
> > [ 3.114230] NET: Registered protocol family 17
> > [ 3.115047] Bridge firewalling registered
> > [ 3.115824] Ebtables v2.0 registered
> > [ 3.117996] 8021q: 802.1Q VLAN Support v1.8
> > [ 3.119429] AVX2 version of gcm_enc/dec engaged.
> > [ 3.119886] AES CTR mode by8 optimization enabled
> > [ 3.128818] sched_clock: Marking stable (3128714579, 0)->(3404180881, -275466302)
> > [ 3.129945] registered taskstats version 1
> > [ 3.130427] Loading compiled-in X.509 certificates
> > [ 3.163216] Loaded X.509 cert 'Build time autogenerated kernel key: 38e0adea1af8bd8a23b02436d4acf2f8c7408d23'
> > [ 3.166359] zswap: loaded using pool lzo/zbud
> > [ 3.167943] Key type big_key registered
> > [ 3.168778] Magic number: 13:918:708
> > [ 3.169255] rtc_cmos 00:00: setting system clock to 2017-12-16 00:42:09 UTC (1513384929)
> > [ 3.170604] md: Skipping autodetection of RAID arrays. (raid=autodetect will force)
> > [ 3.171932] EXT4-fs (vda2): couldn't mount as ext3 due to feature incompatibilities
> > [ 3.173871] EXT4-fs (vda2): couldn't mount as ext2 due to feature incompatibilities
> > [ 3.175306] EXT4-fs (vda2): INFO: recovery required on readonly filesystem
> > [ 3.176212] EXT4-fs (vda2): write access will be enabled during recovery
> > [ 3.397187] EXT4-fs (vda2): orphan cleanup on readonly fs
> > [ 3.399412] EXT4-fs (vda2): 5 orphan inodes deleted
> > [ 3.402759] EXT4-fs (vda2): recovery complete
> > [ 3.466647] EXT4-fs (vda2): mounted filesystem with ordered data mode. Opts: (null)
> > [ 3.469401] VFS: Mounted root (ext4 filesystem) readonly on device 253:2.
> > [ 3.473719] devtmpfs: mounted
> > [ 3.492549] Freeing unused kernel memory: 1640K
> > [ 3.494547] Write protecting the kernel read-only data: 18432k
> > [ 3.498781] Freeing unused kernel memory: 2016K
> > [ 3.503330] Freeing unused kernel memory: 512K
> > [ 3.505232] rodata_test: all tests were successful
> > [ 3.515355] 1 (init): Uhuuh, elf segement at 00000000928fda3e requested but the memory is mapped already
> > [ 3.519533] Starting init: /sbin/init exists but couldn't execute it (error -95)
> > [ 3.528993] Starting init: /bin/sh exists but couldn't execute it (error -14)
> > [ 3.532127] Kernel panic - not syncing: No working init found. Try passing init= option to kernel. See Linux Documentation/admin-guide/init.rst for guidance.
> > [ 3.538328] CPU: 0 PID: 1 Comm: init Not tainted 4.15.0-rc3-next-20171215-00001-g6d6aea478fce #11
> > [ 3.542201] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc26 04/01/2014
> > [ 3.546081] Call Trace:
> > [ 3.547221] dump_stack+0x5c/0x79
> > [ 3.548768] ? rest_init+0x30/0xb0
> > [ 3.550320] panic+0xe4/0x232
> > [ 3.551669] ? rest_init+0xb0/0xb0
> > [ 3.553110] kernel_init+0xeb/0x100
> > [ 3.554701] ret_from_fork+0x1f/0x30
> > [ 3.558964] Kernel Offset: 0x2000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
> > [ 3.564160] ---[ end Kernel panic - not syncing: No working init found. Try passing init= option to kernel. See Linux Documentation/admin-guide/init.rst for guidance.
>
>
> --
> Michal Hocko
> SUSE Labs
