Revision 85bd839983778fcd0c1c043327b14a046e979b39 authored by Gu Zheng on 10 June 2015, 18:14:43 UTC, committed by Linus Torvalds on 10 June 2015, 23:43:43 UTC
Izumi found the following oops when hot re-adding a node: BUG: unable to handle kernel paging request at ffffc90008963690 IP: __wake_up_bit+0x20/0x70 Oops: 0000 [#1] SMP CPU: 68 PID: 1237 Comm: rs:main Q:Reg Not tainted 4.1.0-rc5 #80 Hardware name: FUJITSU PRIMEQUEST2800E/SB, BIOS PRIMEQUEST 2000 Series BIOS Version 1.87 04/28/2015 task: ffff880838df8000 ti: ffff880017b94000 task.ti: ffff880017b94000 RIP: 0010:[<ffffffff810dff80>] [<ffffffff810dff80>] __wake_up_bit+0x20/0x70 RSP: 0018:ffff880017b97be8 EFLAGS: 00010246 RAX: ffffc90008963690 RBX: 00000000003c0000 RCX: 000000000000a4c9 RDX: 0000000000000000 RSI: ffffea101bffd500 RDI: ffffc90008963648 RBP: ffff880017b97c08 R08: 0000000002000020 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a0797c73800 R13: ffffea101bffd500 R14: 0000000000000001 R15: 00000000003c0000 FS: 00007fcc7ffff700(0000) GS:ffff880874800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc90008963690 CR3: 0000000836761000 CR4: 00000000001407e0 Call Trace: unlock_page+0x6d/0x70 generic_write_end+0x53/0xb0 xfs_vm_write_end+0x29/0x80 [xfs] generic_perform_write+0x10a/0x1e0 xfs_file_buffered_aio_write+0x14d/0x3e0 [xfs] xfs_file_write_iter+0x79/0x120 [xfs] __vfs_write+0xd4/0x110 vfs_write+0xac/0x1c0 SyS_write+0x58/0xd0 system_call_fastpath+0x12/0x76 Code: 5d c3 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 48 83 ec 20 65 48 8b 04 25 28 00 00 00 48 89 45 f8 31 c0 48 8d 47 48 <48> 39 47 48 48 c7 45 e8 00 00 00 00 48 c7 45 f0 00 00 00 00 48 RIP [<ffffffff810dff80>] __wake_up_bit+0x20/0x70 RSP <ffff880017b97be8> CR2: ffffc90008963690 Reproduce method (re-add a node):: Hot-add nodeA --> remove nodeA --> hot-add nodeA (panic) This seems an use-after-free problem, and the root cause is zone->wait_table was not set to *NULL* after free it in try_offline_node. When hot re-add a node, we will reuse the pgdat of it, so does the zone struct, and when add pages to the target zone, it will init the zone first (including the wait_table) if the zone is not initialized. The judgement of zone initialized is based on zone->wait_table: static inline bool zone_is_initialized(struct zone *zone) { return !!zone->wait_table; } so if we do not set the zone->wait_table to *NULL* after free it, the memory hotplug routine will skip the init of new zone when hot re-add the node, and the wait_table still points to the freed memory, then we will access the invalid address when trying to wake up the waiting people after the i/o operation with the page is done, such as mentioned above. Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com> Reported-by: Taku Izumi <izumi.taku@jp.fujitsu.com> Reviewed by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Cc: Tang Chen <tangchen@cn.fujitsu.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 5879ae5
File | Mode | Size |
---|---|---|
aacraid | ||
aic7xxx | ||
aic94xx | ||
arcmsr | ||
arm | ||
be2iscsi | ||
bfa | ||
bnx2fc | ||
bnx2i | ||
csiostor | ||
cxgbi | ||
device_handler | ||
dpt | ||
esas2r | ||
fcoe | ||
fnic | ||
ibmvscsi | ||
isci | ||
libfc | ||
libsas | ||
lpfc | ||
megaraid | ||
mpt2sas | ||
mpt3sas | ||
mvsas | ||
osd | ||
pcmcia | ||
pm8001 | ||
qla2xxx | ||
qla4xxx | ||
sym53c8xx_2 | ||
ufs | ||
.gitignore | -rw-r--r-- | 11 bytes |
3w-9xxx.c | -rw-r--r-- | 74.9 KB |
3w-9xxx.h | -rw-r--r-- | 25.7 KB |
3w-sas.c | -rw-r--r-- | 57.8 KB |
3w-sas.h | -rw-r--r-- | 13.6 KB |
3w-xxxx.c | -rw-r--r-- | 82.7 KB |
3w-xxxx.h | -rw-r--r-- | 16.4 KB |
53c700.c | -rw-r--r-- | 67.7 KB |
53c700.h | -rw-r--r-- | 16.3 KB |
53c700.scr | -rw-r--r-- | 10.6 KB |
53c700_d.h_shipped | -rw-r--r-- | 28.2 KB |
BusLogic.c | -rw-r--r-- | 127.5 KB |
BusLogic.h | -rw-r--r-- | 34.1 KB |
FlashPoint.c | -rw-r--r-- | 192.8 KB |
Kconfig | -rw-r--r-- | 61.6 KB |
Makefile | -rw-r--r-- | 7.6 KB |
NCR5380.c | -rw-r--r-- | 88.4 KB |
NCR5380.h | -rw-r--r-- | 13.8 KB |
NCR53c406a.c | -rw-r--r-- | 28.1 KB |
NCR_D700.c | -rw-r--r-- | 10.3 KB |
NCR_D700.h | -rw-r--r-- | 801 bytes |
NCR_Q720.c | -rw-r--r-- | 9.2 KB |
NCR_Q720.h | -rw-r--r-- | 597 bytes |
a100u2w.c | -rw-r--r-- | 36.0 KB |
a100u2w.h | -rw-r--r-- | 16.5 KB |
a2091.c | -rw-r--r-- | 6.5 KB |
a2091.h | -rw-r--r-- | 1.5 KB |
a3000.c | -rw-r--r-- | 7.0 KB |
a3000.h | -rw-r--r-- | 1.6 KB |
a4000t.c | -rw-r--r-- | 3.1 KB |
advansys.c | -rw-r--r-- | 360.4 KB |
aha152x.c | -rw-r--r-- | 82.7 KB |
aha152x.h | -rw-r--r-- | 9.9 KB |
aha1542.c | -rw-r--r-- | 28.6 KB |
aha1542.h | -rw-r--r-- | 3.3 KB |
aha1740.c | -rw-r--r-- | 18.9 KB |
aha1740.h | -rw-r--r-- | 4.8 KB |
am53c974.c | -rw-r--r-- | 13.6 KB |
atari_NCR5380.c | -rw-r--r-- | 89.0 KB |
atari_scsi.c | -rw-r--r-- | 31.9 KB |
atp870u.c | -rw-r--r-- | 84.1 KB |
atp870u.h | -rw-r--r-- | 1.5 KB |
bvme6000_scsi.c | -rw-r--r-- | 3.2 KB |
ch.c | -rw-r--r-- | 24.5 KB |
constants.c | -rw-r--r-- | 49.2 KB |
dc395x.c | -rw-r--r-- | 140.8 KB |
dc395x.h | -rw-r--r-- | 25.2 KB |
dmx3191d.c | -rw-r--r-- | 4.1 KB |
dpt_i2o.c | -rw-r--r-- | 92.5 KB |
dpti.h | -rw-r--r-- | 11.5 KB |
dtc.c | -rw-r--r-- | 12.3 KB |
dtc.h | -rw-r--r-- | 2.1 KB |
eata.c | -rw-r--r-- | 76.1 KB |
eata_generic.h | -rw-r--r-- | 14.6 KB |
eata_pio.c | -rw-r--r-- | 26.0 KB |
eata_pio.h | -rw-r--r-- | 2.1 KB |
esp_scsi.c | -rw-r--r-- | 66.7 KB |
esp_scsi.h | -rw-r--r-- | 22.0 KB |
fdomain.c | -rw-r--r-- | 55.8 KB |
fdomain.h | -rw-r--r-- | 1.1 KB |
g_NCR5380.c | -rw-r--r-- | 19.3 KB |
g_NCR5380.h | -rw-r--r-- | 2.7 KB |
g_NCR5380_mmio.c | -rw-r--r-- | 232 bytes |
gdth.c | -rw-r--r-- | 174.2 KB |
gdth.h | -rw-r--r-- | 46.0 KB |
gdth_ioctl.h | -rw-r--r-- | 14.5 KB |
gdth_proc.c | -rw-r--r-- | 22.4 KB |
gdth_proc.h | -rw-r--r-- | 640 bytes |
gvp11.c | -rw-r--r-- | 10.5 KB |
gvp11.h | -rw-r--r-- | 1.2 KB |
hosts.c | -rw-r--r-- | 15.7 KB |
hpsa.c | -rw-r--r-- | 218.2 KB |
hpsa.h | -rw-r--r-- | 16.7 KB |
hpsa_cmd.h | -rw-r--r-- | 25.7 KB |
hptiop.c | -rw-r--r-- | 45.0 KB |
hptiop.h | -rw-r--r-- | 9.6 KB |
imm.c | -rw-r--r-- | 28.6 KB |
imm.h | -rw-r--r-- | 4.9 KB |
in2000.c | -rw-r--r-- | 71.2 KB |
in2000.h | -rw-r--r-- | 13.5 KB |
initio.c | -rw-r--r-- | 81.3 KB |
initio.h | -rw-r--r-- | 29.3 KB |
ipr.c | -rw-r--r-- | 292.8 KB |
ipr.h | -rw-r--r-- | 50.5 KB |
ips.c | -rw-r--r-- | 232.4 KB |
ips.h | -rw-r--r-- | 41.8 KB |
iscsi_boot_sysfs.c | -rw-r--r-- | 16.3 KB |
iscsi_tcp.c | -rw-r--r-- | 27.8 KB |
iscsi_tcp.h | -rw-r--r-- | 1.9 KB |
jazz_esp.c | -rw-r--r-- | 5.4 KB |
lasi700.c | -rw-r--r-- | 4.7 KB |
libiscsi.c | -rw-r--r-- | 97.2 KB |
libiscsi_tcp.c | -rw-r--r-- | 32.5 KB |
mac53c94.c | -rw-r--r-- | 15.0 KB |
mac53c94.h | -rw-r--r-- | 4.9 KB |
mac_esp.c | -rw-r--r-- | 15.5 KB |
mac_scsi.c | -rw-r--r-- | 12.8 KB |
megaraid.c | -rw-r--r-- | 107.4 KB |
megaraid.h | -rw-r--r-- | 26.8 KB |
mesh.c | -rw-r--r-- | 52.6 KB |
mesh.h | -rw-r--r-- | 3.9 KB |
mvme147.c | -rw-r--r-- | 3.9 KB |
mvme147.h | -rw-r--r-- | 465 bytes |
mvme16x_scsi.c | -rw-r--r-- | 3.7 KB |
mvumi.c | -rw-r--r-- | 71.3 KB |
mvumi.h | -rw-r--r-- | 12.3 KB |
ncr53c8xx.c | -rw-r--r-- | 210.5 KB |
ncr53c8xx.h | -rw-r--r-- | 39.9 KB |
nsp32.c | -rw-r--r-- | 88.4 KB |
nsp32.h | -rw-r--r-- | 21.2 KB |
nsp32_debug.c | -rw-r--r-- | 7.3 KB |
nsp32_io.h | -rw-r--r-- | 5.9 KB |
osst.c | -rw-r--r-- | 182.9 KB |
osst.h | -rw-r--r-- | 24.2 KB |
osst_detect.h | -rw-r--r-- | 232 bytes |
osst_options.h | -rw-r--r-- | 4.1 KB |
pas16.c | -rw-r--r-- | 16.3 KB |
pas16.h | -rw-r--r-- | 4.1 KB |
pmcraid.c | -rw-r--r-- | 166.9 KB |
pmcraid.h | -rw-r--r-- | 37.0 KB |
ppa.c | -rw-r--r-- | 25.4 KB |
ppa.h | -rw-r--r-- | 5.0 KB |
ps3rom.c | -rw-r--r-- | 11.2 KB |
qla1280.c | -rw-r--r-- | 124.9 KB |
qla1280.h | -rw-r--r-- | 34.7 KB |
qlogicfas.c | -rw-r--r-- | 5.5 KB |
qlogicfas408.c | -rw-r--r-- | 14.6 KB |
qlogicfas408.h | -rw-r--r-- | 4.5 KB |
qlogicpti.c | -rw-r--r-- | 40.1 KB |
qlogicpti.h | -rw-r--r-- | 18.8 KB |
raid_class.c | -rw-r--r-- | 7.7 KB |
script_asm.pl | -rw-r--r-- | 28.5 KB |
scsi.c | -rw-r--r-- | 33.6 KB |
scsi.h | -rw-r--r-- | 1.1 KB |
scsi_debug.c | -rw-r--r-- | 159.8 KB |
scsi_devinfo.c | -rw-r--r-- | 29.3 KB |
scsi_error.c | -rw-r--r-- | 71.5 KB |
scsi_ioctl.c | -rw-r--r-- | 8.1 KB |
scsi_lib.c | -rw-r--r-- | 79.5 KB |
scsi_lib_dma.c | -rw-r--r-- | 1.1 KB |
scsi_logging.c | -rw-r--r-- | 12.4 KB |
scsi_logging.h | -rw-r--r-- | 3.5 KB |
scsi_module.c | -rw-r--r-- | 1.6 KB |
scsi_netlink.c | -rw-r--r-- | 3.5 KB |
scsi_pm.c | -rw-r--r-- | 7.7 KB |
scsi_priv.h | -rw-r--r-- | 6.1 KB |
scsi_proc.c | -rw-r--r-- | 11.1 KB |
scsi_sas_internal.h | -rw-r--r-- | 1.5 KB |
scsi_scan.c | -rw-r--r-- | 55.5 KB |
scsi_sysctl.c | -rw-r--r-- | 967 bytes |
scsi_sysfs.c | -rw-r--r-- | 32.7 KB |
scsi_trace.c | -rw-r--r-- | 6.6 KB |
scsi_transport_api.h | -rw-r--r-- | 145 bytes |
scsi_transport_fc.c | -rw-r--r-- | 120.5 KB |
scsi_transport_iscsi.c | -rw-r--r-- | 138.3 KB |
scsi_transport_sas.c | -rw-r--r-- | 51.9 KB |
scsi_transport_spi.c | -rw-r--r-- | 44.2 KB |
scsi_transport_srp.c | -rw-r--r-- | 25.7 KB |
scsi_typedefs.h | -rw-r--r-- | 37 bytes |
scsicam.c | -rw-r--r-- | 7.7 KB |
sd.c | -rw-r--r-- | 86.7 KB |
sd.h | -rw-r--r-- | 6.6 KB |
sd_dif.c | -rw-r--r-- | 5.3 KB |
ses.c | -rw-r--r-- | 19.2 KB |
sg.c | -rw-r--r-- | 72.4 KB |
sgiwd93.c | -rw-r--r-- | 8.1 KB |
sim710.c | -rw-r--r-- | 6.5 KB |
sni_53c710.c | -rw-r--r-- | 3.8 KB |
sr.c | -rw-r--r-- | 25.3 KB |
sr.h | -rw-r--r-- | 2.6 KB |
sr_ioctl.c | -rw-r--r-- | 14.9 KB |
sr_vendor.c | -rw-r--r-- | 8.3 KB |
st.c | -rw-r--r-- | 120.0 KB |
st.h | -rw-r--r-- | 6.3 KB |
st_options.h | -rw-r--r-- | 3.9 KB |
stex.c | -rw-r--r-- | 42.7 KB |
storvsc_drv.c | -rw-r--r-- | 48.3 KB |
sun3_scsi.c | -rw-r--r-- | 15.4 KB |
sun3_scsi.h | -rw-r--r-- | 3.0 KB |
sun3_scsi_vme.c | -rw-r--r-- | 46 bytes |
sun3x_esp.c | -rw-r--r-- | 7.2 KB |
sun_esp.c | -rw-r--r-- | 14.0 KB |
sym53c416.c | -rw-r--r-- | 25.5 KB |
sym53c416.h | -rw-r--r-- | 1.1 KB |
t128.c | -rw-r--r-- | 10.4 KB |
t128.h | -rw-r--r-- | 3.6 KB |
u14-34f.c | -rw-r--r-- | 65.4 KB |
ultrastor.c | -rw-r--r-- | 36.1 KB |
ultrastor.h | -rw-r--r-- | 2.0 KB |
virtio_scsi.c | -rw-r--r-- | 29.5 KB |
vmw_pvscsi.c | -rw-r--r-- | 42.1 KB |
vmw_pvscsi.h | -rw-r--r-- | 13.5 KB |
wd33c93.c | -rw-r--r-- | 65.3 KB |
wd33c93.h | -rw-r--r-- | 11.0 KB |
wd7000.c | -rw-r--r-- | 50.3 KB |
wd719x.c | -rw-r--r-- | 27.0 KB |
wd719x.h | -rw-r--r-- | 9.6 KB |
xen-scsifront.c | -rw-r--r-- | 28.5 KB |
zalon.c | -rw-r--r-- | 5.0 KB |
zorro7xx.c | -rw-r--r-- | 4.4 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...