Revision 85bd839983778fcd0c1c043327b14a046e979b39 authored by Gu Zheng on 10 June 2015, 18:14:43 UTC, committed by Linus Torvalds on 10 June 2015, 23:43:43 UTC
Izumi found the following oops when hot re-adding a node: BUG: unable to handle kernel paging request at ffffc90008963690 IP: __wake_up_bit+0x20/0x70 Oops: 0000 [#1] SMP CPU: 68 PID: 1237 Comm: rs:main Q:Reg Not tainted 4.1.0-rc5 #80 Hardware name: FUJITSU PRIMEQUEST2800E/SB, BIOS PRIMEQUEST 2000 Series BIOS Version 1.87 04/28/2015 task: ffff880838df8000 ti: ffff880017b94000 task.ti: ffff880017b94000 RIP: 0010:[<ffffffff810dff80>] [<ffffffff810dff80>] __wake_up_bit+0x20/0x70 RSP: 0018:ffff880017b97be8 EFLAGS: 00010246 RAX: ffffc90008963690 RBX: 00000000003c0000 RCX: 000000000000a4c9 RDX: 0000000000000000 RSI: ffffea101bffd500 RDI: ffffc90008963648 RBP: ffff880017b97c08 R08: 0000000002000020 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a0797c73800 R13: ffffea101bffd500 R14: 0000000000000001 R15: 00000000003c0000 FS: 00007fcc7ffff700(0000) GS:ffff880874800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc90008963690 CR3: 0000000836761000 CR4: 00000000001407e0 Call Trace: unlock_page+0x6d/0x70 generic_write_end+0x53/0xb0 xfs_vm_write_end+0x29/0x80 [xfs] generic_perform_write+0x10a/0x1e0 xfs_file_buffered_aio_write+0x14d/0x3e0 [xfs] xfs_file_write_iter+0x79/0x120 [xfs] __vfs_write+0xd4/0x110 vfs_write+0xac/0x1c0 SyS_write+0x58/0xd0 system_call_fastpath+0x12/0x76 Code: 5d c3 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 48 83 ec 20 65 48 8b 04 25 28 00 00 00 48 89 45 f8 31 c0 48 8d 47 48 <48> 39 47 48 48 c7 45 e8 00 00 00 00 48 c7 45 f0 00 00 00 00 48 RIP [<ffffffff810dff80>] __wake_up_bit+0x20/0x70 RSP <ffff880017b97be8> CR2: ffffc90008963690 Reproduce method (re-add a node):: Hot-add nodeA --> remove nodeA --> hot-add nodeA (panic) This seems an use-after-free problem, and the root cause is zone->wait_table was not set to *NULL* after free it in try_offline_node. When hot re-add a node, we will reuse the pgdat of it, so does the zone struct, and when add pages to the target zone, it will init the zone first (including the wait_table) if the zone is not initialized. The judgement of zone initialized is based on zone->wait_table: static inline bool zone_is_initialized(struct zone *zone) { return !!zone->wait_table; } so if we do not set the zone->wait_table to *NULL* after free it, the memory hotplug routine will skip the init of new zone when hot re-add the node, and the wait_table still points to the freed memory, then we will access the invalid address when trying to wake up the waiting people after the i/o operation with the page is done, such as mentioned above. Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com> Reported-by: Taku Izumi <izumi.taku@jp.fujitsu.com> Reviewed by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Cc: Tang Chen <tangchen@cn.fujitsu.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 5879ae5
File | Mode | Size |
---|---|---|
88pm800.c | -rw-r--r-- | 14.7 KB |
88pm805.c | -rw-r--r-- | 6.4 KB |
88pm80x.c | -rw-r--r-- | 3.9 KB |
88pm860x-core.c | -rw-r--r-- | 33.6 KB |
88pm860x-i2c.c | -rw-r--r-- | 4.2 KB |
Kconfig | -rw-r--r-- | 44.2 KB |
Makefile | -rw-r--r-- | 7.1 KB |
aat2870-core.c | -rw-r--r-- | 12.2 KB |
ab3100-core.c | -rw-r--r-- | 21.7 KB |
ab3100-otp.c | -rw-r--r-- | 6.5 KB |
ab8500-core.c | -rw-r--r-- | 44.9 KB |
ab8500-debugfs.c | -rw-r--r-- | 69.9 KB |
ab8500-gpadc.c | -rw-r--r-- | 31.0 KB |
ab8500-sysctrl.c | -rw-r--r-- | 4.3 KB |
abx500-core.c | -rw-r--r-- | 3.9 KB |
adp5520.c | -rw-r--r-- | 8.4 KB |
arizona-core.c | -rw-r--r-- | 26.7 KB |
arizona-i2c.c | -rw-r--r-- | 2.5 KB |
arizona-irq.c | -rw-r--r-- | 9.4 KB |
arizona-spi.c | -rw-r--r-- | 2.4 KB |
arizona.h | -rw-r--r-- | 1.5 KB |
as3711.c | -rw-r--r-- | 6.1 KB |
as3722.c | -rw-r--r-- | 12.1 KB |
asic3.c | -rw-r--r-- | 26.7 KB |
atmel-hlcdc.c | -rw-r--r-- | 3.2 KB |
axp20x.c | -rw-r--r-- | 14.3 KB |
bcm590xx.c | -rw-r--r-- | 3.4 KB |
cros_ec.c | -rw-r--r-- | 4.5 KB |
cros_ec_i2c.c | -rw-r--r-- | 4.9 KB |
cros_ec_spi.c | -rw-r--r-- | 11.1 KB |
cs5535-mfd.c | -rw-r--r-- | 4.7 KB |
da903x.c | -rw-r--r-- | 13.1 KB |
da9052-core.c | -rw-r--r-- | 14.1 KB |
da9052-i2c.c | -rw-r--r-- | 5.0 KB |
da9052-irq.c | -rw-r--r-- | 6.0 KB |
da9052-spi.c | -rw-r--r-- | 2.5 KB |
da9055-core.c | -rw-r--r-- | 9.7 KB |
da9055-i2c.c | -rw-r--r-- | 2.6 KB |
da9063-core.c | -rw-r--r-- | 4.5 KB |
da9063-i2c.c | -rw-r--r-- | 7.1 KB |
da9063-irq.c | -rw-r--r-- | 4.6 KB |
da9150-core.c | -rw-r--r-- | 9.4 KB |
davinci_voicecodec.c | -rw-r--r-- | 4.0 KB |
db8500-prcmu.c | -rw-r--r-- | 82.3 KB |
dbx500-prcmu-regs.h | -rw-r--r-- | 8.0 KB |
dln2.c | -rw-r--r-- | 18.1 KB |
dm355evm_msp.c | -rw-r--r-- | 10.8 KB |
ezx-pcap.c | -rw-r--r-- | 12.5 KB |
hi6421-pmic-core.c | -rw-r--r-- | 3.1 KB |
htc-egpio.c | -rw-r--r-- | 10.8 KB |
htc-i2cpld.c | -rw-r--r-- | 17.4 KB |
htc-pasic3.c | -rw-r--r-- | 5.0 KB |
intel_msic.c | -rw-r--r-- | 11.3 KB |
intel_quark_i2c_gpio.c | -rw-r--r-- | 7.1 KB |
intel_soc_pmic_core.c | -rw-r--r-- | 4.4 KB |
intel_soc_pmic_core.h | -rw-r--r-- | 1023 bytes |
intel_soc_pmic_crc.c | -rw-r--r-- | 3.9 KB |
ipaq-micro.c | -rw-r--r-- | 11.9 KB |
janz-cmodio.c | -rw-r--r-- | 7.0 KB |
jz4740-adc.c | -rw-r--r-- | 7.7 KB |
kempld-core.c | -rw-r--r-- | 20.2 KB |
lm3533-core.c | -rw-r--r-- | 14.1 KB |
lm3533-ctrlbank.c | -rw-r--r-- | 3.7 KB |
lp3943.c | -rw-r--r-- | 4.3 KB |
lp8788-irq.c | -rw-r--r-- | 4.4 KB |
lp8788.c | -rw-r--r-- | 5.3 KB |
lpc_ich.c | -rw-r--r-- | 29.7 KB |
lpc_sch.c | -rw-r--r-- | 5.2 KB |
max14577.c | -rw-r--r-- | 16.5 KB |
max77686.c | -rw-r--r-- | 11.6 KB |
max77693.c | -rw-r--r-- | 11.2 KB |
max77843.c | -rw-r--r-- | 6.0 KB |
max8907.c | -rw-r--r-- | 9.1 KB |
max8925-core.c | -rw-r--r-- | 23.3 KB |
max8925-i2c.c | -rw-r--r-- | 6.4 KB |
max8997-irq.c | -rw-r--r-- | 10.9 KB |
max8997.c | -rw-r--r-- | 13.6 KB |
max8998-irq.c | -rw-r--r-- | 6.5 KB |
max8998.c | -rw-r--r-- | 10.3 KB |
mc13xxx-core.c | -rw-r--r-- | 12.8 KB |
mc13xxx-i2c.c | -rw-r--r-- | 2.8 KB |
mc13xxx-spi.c | -rw-r--r-- | 5.0 KB |
mc13xxx.h | -rw-r--r-- | 1.2 KB |
mcp-core.c | -rw-r--r-- | 5.6 KB |
mcp-sa11x0.c | -rw-r--r-- | 7.0 KB |
menelaus.c | -rw-r--r-- | 30.1 KB |
menf21bmc.c | -rw-r--r-- | 3.3 KB |
mfd-core.c | -rw-r--r-- | 8.1 KB |
mt6397-core.c | -rw-r--r-- | 5.4 KB |
omap-usb-host.c | -rw-r--r-- | 23.4 KB |
omap-usb-tll.c | -rw-r--r-- | 13.1 KB |
omap-usb.h | -rw-r--r-- | 203 bytes |
palmas.c | -rw-r--r-- | 17.8 KB |
pcf50633-adc.c | -rw-r--r-- | 5.9 KB |
pcf50633-core.c | -rw-r--r-- | 7.8 KB |
pcf50633-gpio.c | -rw-r--r-- | 2.7 KB |
pcf50633-irq.c | -rw-r--r-- | 7.6 KB |
pm8921-core.c | -rw-r--r-- | 10.0 KB |
qcom-spmi-pmic.c | -rw-r--r-- | 4.5 KB |
qcom_rpm.c | -rw-r--r-- | 21.1 KB |
rc5t583-irq.c | -rw-r--r-- | 11.5 KB |
rc5t583.c | -rw-r--r-- | 8.7 KB |
rdc321x-southbridge.c | -rw-r--r-- | 3.1 KB |
retu-mfd.c | -rw-r--r-- | 7.4 KB |
rk808.c | -rw-r--r-- | 6.7 KB |
rn5t618.c | -rw-r--r-- | 3.2 KB |
rt5033.c | -rw-r--r-- | 3.6 KB |
rtl8411.c | -rw-r--r-- | 14.0 KB |
rts5209.c | -rw-r--r-- | 7.7 KB |
rts5227.c | -rw-r--r-- | 8.7 KB |
rts5229.c | -rw-r--r-- | 7.8 KB |
rts5249.c | -rw-r--r-- | 16.9 KB |
rtsx_pcr.c | -rw-r--r-- | 32.8 KB |
rtsx_pcr.h | -rw-r--r-- | 3.1 KB |
rtsx_usb.c | -rw-r--r-- | 18.8 KB |
sec-core.c | -rw-r--r-- | 11.2 KB |
sec-irq.c | -rw-r--r-- | 10.7 KB |
si476x-cmd.c | -rw-r--r-- | 46.1 KB |
si476x-i2c.c | -rw-r--r-- | 22.0 KB |
si476x-prop.c | -rw-r--r-- | 5.8 KB |
sky81452.c | -rw-r--r-- | 2.9 KB |
sm501.c | -rw-r--r-- | 40.4 KB |
smsc-ece1099.c | -rw-r--r-- | 2.6 KB |
ssbi.c | -rw-r--r-- | 7.9 KB |
sta2x11-mfd.c | -rw-r--r-- | 16.6 KB |
stmpe-i2c.c | -rw-r--r-- | 3.6 KB |
stmpe-spi.c | -rw-r--r-- | 3.2 KB |
stmpe.c | -rw-r--r-- | 30.8 KB |
stmpe.h | -rw-r--r-- | 8.7 KB |
stw481x.c | -rw-r--r-- | 6.7 KB |
sun6i-prcm.c | -rw-r--r-- | 4.1 KB |
syscon.c | -rw-r--r-- | 5.3 KB |
t7l66xb.c | -rw-r--r-- | 11.0 KB |
tc3589x.c | -rw-r--r-- | 11.9 KB |
tc6387xb.c | -rw-r--r-- | 5.5 KB |
tc6393xb.c | -rw-r--r-- | 21.8 KB |
ti_am335x_tscadc.c | -rw-r--r-- | 9.5 KB |
timberdale.c | -rw-r--r-- | 21.8 KB |
timberdale.h | -rw-r--r-- | 3.4 KB |
tmio_core.c | -rw-r--r-- | 1.4 KB |
tps6105x.c | -rw-r--r-- | 5.5 KB |
tps65010.c | -rw-r--r-- | 28.3 KB |
tps6507x.c | -rw-r--r-- | 3.3 KB |
tps65090.c | -rw-r--r-- | 7.3 KB |
tps65217.c | -rw-r--r-- | 6.6 KB |
tps65218.c | -rw-r--r-- | 6.9 KB |
tps6586x.c | -rw-r--r-- | 15.6 KB |
tps65910.c | -rw-r--r-- | 13.4 KB |
tps65911-comparator.c | -rw-r--r-- | 4.5 KB |
tps65912-core.c | -rw-r--r-- | 4.0 KB |
tps65912-i2c.c | -rw-r--r-- | 3.1 KB |
tps65912-irq.c | -rw-r--r-- | 6.1 KB |
tps65912-spi.c | -rw-r--r-- | 3.2 KB |
tps80031.c | -rw-r--r-- | 16.3 KB |
twl-core.c | -rw-r--r-- | 32.6 KB |
twl-core.h | -rw-r--r-- | 323 bytes |
twl4030-audio.c | -rw-r--r-- | 7.2 KB |
twl4030-irq.c | -rw-r--r-- | 20.2 KB |
twl4030-power.c | -rw-r--r-- | 25.1 KB |
twl6030-irq.c | -rw-r--r-- | 13.8 KB |
twl6040.c | -rw-r--r-- | 20.2 KB |
ucb1400_core.c | -rw-r--r-- | 3.7 KB |
ucb1x00-assabet.c | -rw-r--r-- | 2.9 KB |
ucb1x00-core.c | -rw-r--r-- | 19.8 KB |
ucb1x00-ts.c | -rw-r--r-- | 10.8 KB |
vexpress-sysreg.c | -rw-r--r-- | 6.2 KB |
viperboard.c | -rw-r--r-- | 3.3 KB |
vx855.c | -rw-r--r-- | 3.8 KB |
wl1273-core.c | -rw-r--r-- | 6.5 KB |
wm5102-tables.c | -rw-r--r-- | 85.9 KB |
wm5110-tables.c | -rw-r--r-- | 124.2 KB |
wm831x-auxadc.c | -rw-r--r-- | 6.6 KB |
wm831x-core.c | -rw-r--r-- | 42.3 KB |
wm831x-i2c.c | -rw-r--r-- | 2.6 KB |
wm831x-irq.c | -rw-r--r-- | 15.4 KB |
wm831x-otp.c | -rw-r--r-- | 2.1 KB |
wm831x-spi.c | -rw-r--r-- | 2.8 KB |
wm8350-core.c | -rw-r--r-- | 11.3 KB |
wm8350-gpio.c | -rw-r--r-- | 6.1 KB |
wm8350-i2c.c | -rw-r--r-- | 2.2 KB |
wm8350-irq.c | -rw-r--r-- | 14.2 KB |
wm8350-regmap.c | -rw-r--r-- | 15.1 KB |
wm8400-core.c | -rw-r--r-- | 5.2 KB |
wm8994-core.c | -rw-r--r-- | 16.1 KB |
wm8994-irq.c | -rw-r--r-- | 6.2 KB |
wm8994-regmap.c | -rw-r--r-- | 56.4 KB |
wm8994.h | -rw-r--r-- | 717 bytes |
wm8997-tables.c | -rw-r--r-- | 67.8 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...