Revision 85bd839983778fcd0c1c043327b14a046e979b39 authored by Gu Zheng on 10 June 2015, 18:14:43 UTC, committed by Linus Torvalds on 10 June 2015, 23:43:43 UTC
Izumi found the following oops when hot re-adding a node: BUG: unable to handle kernel paging request at ffffc90008963690 IP: __wake_up_bit+0x20/0x70 Oops: 0000 [#1] SMP CPU: 68 PID: 1237 Comm: rs:main Q:Reg Not tainted 4.1.0-rc5 #80 Hardware name: FUJITSU PRIMEQUEST2800E/SB, BIOS PRIMEQUEST 2000 Series BIOS Version 1.87 04/28/2015 task: ffff880838df8000 ti: ffff880017b94000 task.ti: ffff880017b94000 RIP: 0010:[<ffffffff810dff80>] [<ffffffff810dff80>] __wake_up_bit+0x20/0x70 RSP: 0018:ffff880017b97be8 EFLAGS: 00010246 RAX: ffffc90008963690 RBX: 00000000003c0000 RCX: 000000000000a4c9 RDX: 0000000000000000 RSI: ffffea101bffd500 RDI: ffffc90008963648 RBP: ffff880017b97c08 R08: 0000000002000020 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a0797c73800 R13: ffffea101bffd500 R14: 0000000000000001 R15: 00000000003c0000 FS: 00007fcc7ffff700(0000) GS:ffff880874800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc90008963690 CR3: 0000000836761000 CR4: 00000000001407e0 Call Trace: unlock_page+0x6d/0x70 generic_write_end+0x53/0xb0 xfs_vm_write_end+0x29/0x80 [xfs] generic_perform_write+0x10a/0x1e0 xfs_file_buffered_aio_write+0x14d/0x3e0 [xfs] xfs_file_write_iter+0x79/0x120 [xfs] __vfs_write+0xd4/0x110 vfs_write+0xac/0x1c0 SyS_write+0x58/0xd0 system_call_fastpath+0x12/0x76 Code: 5d c3 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 48 83 ec 20 65 48 8b 04 25 28 00 00 00 48 89 45 f8 31 c0 48 8d 47 48 <48> 39 47 48 48 c7 45 e8 00 00 00 00 48 c7 45 f0 00 00 00 00 48 RIP [<ffffffff810dff80>] __wake_up_bit+0x20/0x70 RSP <ffff880017b97be8> CR2: ffffc90008963690 Reproduce method (re-add a node):: Hot-add nodeA --> remove nodeA --> hot-add nodeA (panic) This seems an use-after-free problem, and the root cause is zone->wait_table was not set to *NULL* after free it in try_offline_node. When hot re-add a node, we will reuse the pgdat of it, so does the zone struct, and when add pages to the target zone, it will init the zone first (including the wait_table) if the zone is not initialized. The judgement of zone initialized is based on zone->wait_table: static inline bool zone_is_initialized(struct zone *zone) { return !!zone->wait_table; } so if we do not set the zone->wait_table to *NULL* after free it, the memory hotplug routine will skip the init of new zone when hot re-add the node, and the wait_table still points to the freed memory, then we will access the invalid address when trying to wake up the waiting people after the i/o operation with the page is done, such as mentioned above. Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com> Reported-by: Taku Izumi <izumi.taku@jp.fujitsu.com> Reviewed by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Cc: Tang Chen <tangchen@cn.fujitsu.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 5879ae5
File | Mode | Size |
---|---|---|
fonts | ||
lz4 | ||
lzo | ||
mpi | ||
raid6 | ||
reed_solomon | ||
xz | ||
zlib_deflate | ||
zlib_inflate | ||
.gitignore | -rw-r--r-- | 70 bytes |
Kconfig | -rw-r--r-- | 11.7 KB |
Kconfig.debug | -rw-r--r-- | 60.0 KB |
Kconfig.kasan | -rw-r--r-- | 1.8 KB |
Kconfig.kgdb | -rw-r--r-- | 4.1 KB |
Kconfig.kmemcheck | -rw-r--r-- | 2.9 KB |
Makefile | -rw-r--r-- | 6.2 KB |
argv_split.c | -rw-r--r-- | 2.1 KB |
asn1_decoder.c | -rw-r--r-- | 12.4 KB |
assoc_array.c | -rw-r--r-- | 52.6 KB |
atomic64.c | -rw-r--r-- | 4.1 KB |
atomic64_test.c | -rw-r--r-- | 3.4 KB |
audit.c | -rw-r--r-- | 1.7 KB |
average.c | -rw-r--r-- | 1.9 KB |
bcd.c | -rw-r--r-- | 261 bytes |
bch.c | -rw-r--r-- | 35.6 KB |
bitmap.c | -rw-r--r-- | 32.4 KB |
bitrev.c | -rw-r--r-- | 1.9 KB |
bsearch.c | -rw-r--r-- | 1.6 KB |
btree.c | -rw-r--r-- | 19.3 KB |
bug.c | -rw-r--r-- | 4.9 KB |
build_OID_registry | -rwxr-xr-x | 4.7 KB |
bust_spinlocks.c | -rw-r--r-- | 660 bytes |
check_signature.c | -rw-r--r-- | 599 bytes |
checksum.c | -rw-r--r-- | 5.0 KB |
clz_ctz.c | -rw-r--r-- | 1.3 KB |
clz_tab.c | -rw-r--r-- | 855 bytes |
cmdline.c | -rw-r--r-- | 4.1 KB |
compat_audit.c | -rw-r--r-- | 796 bytes |
cordic.c | -rw-r--r-- | 2.5 KB |
cpu-notifier-error-inject.c | -rw-r--r-- | 1.2 KB |
cpu_rmap.c | -rw-r--r-- | 7.8 KB |
cpumask.c | -rw-r--r-- | 4.6 KB |
crc-ccitt.c | -rw-r--r-- | 3.0 KB |
crc-itu-t.c | -rw-r--r-- | 2.8 KB |
crc-t10dif.c | -rw-r--r-- | 1.5 KB |
crc16.c | -rw-r--r-- | 2.8 KB |
crc32.c | -rw-r--r-- | 45.4 KB |
crc32defs.h | -rw-r--r-- | 2.0 KB |
crc7.c | -rw-r--r-- | 2.6 KB |
crc8.c | -rw-r--r-- | 2.4 KB |
ctype.c | -rw-r--r-- | 1.4 KB |
debug_locks.c | -rw-r--r-- | 1.2 KB |
debugobjects.c | -rw-r--r-- | 26.1 KB |
dec_and_lock.c | -rw-r--r-- | 784 bytes |
decompress.c | -rw-r--r-- | 1.6 KB |
decompress_bunzip2.c | -rw-r--r-- | 23.4 KB |
decompress_inflate.c | -rw-r--r-- | 3.8 KB |
decompress_unlz4.c | -rw-r--r-- | 4.1 KB |
decompress_unlzma.c | -rw-r--r-- | 15.8 KB |
decompress_unlzo.c | -rw-r--r-- | 6.8 KB |
decompress_unxz.c | -rw-r--r-- | 10.6 KB |
devres.c | -rw-r--r-- | 10.0 KB |
digsig.c | -rw-r--r-- | 5.5 KB |
div64.c | -rw-r--r-- | 4.0 KB |
dma-debug.c | -rw-r--r-- | 41.9 KB |
dump_stack.c | -rw-r--r-- | 1.1 KB |
dynamic_debug.c | -rw-r--r-- | 25.1 KB |
dynamic_queue_limits.c | -rw-r--r-- | 4.3 KB |
earlycpio.c | -rw-r--r-- | 3.9 KB |
extable.c | -rw-r--r-- | 2.4 KB |
fault-inject.c | -rw-r--r-- | 6.0 KB |
fdt.c | -rw-r--r-- | 69 bytes |
fdt_empty_tree.c | -rw-r--r-- | 80 bytes |
fdt_ro.c | -rw-r--r-- | 72 bytes |
fdt_rw.c | -rw-r--r-- | 72 bytes |
fdt_strerror.c | -rw-r--r-- | 78 bytes |
fdt_sw.c | -rw-r--r-- | 72 bytes |
fdt_wip.c | -rw-r--r-- | 73 bytes |
find_bit.c | -rw-r--r-- | 4.5 KB |
flex_array.c | -rw-r--r-- | 11.0 KB |
flex_proportions.c | -rw-r--r-- | 6.9 KB |
gcd.c | -rw-r--r-- | 313 bytes |
gen_crc32table.c | -rw-r--r-- | 3.2 KB |
genalloc.c | -rw-r--r-- | 17.8 KB |
glob.c | -rw-r--r-- | 7.7 KB |
halfmd4.c | -rw-r--r-- | 2.0 KB |
hexdump.c | -rw-r--r-- | 8.2 KB |
hweight.c | -rw-r--r-- | 1.9 KB |
idr.c | -rw-r--r-- | 28.0 KB |
inflate.c | -rw-r--r-- | 38.6 KB |
int_sqrt.c | -rw-r--r-- | 652 bytes |
interval_tree.c | -rw-r--r-- | 499 bytes |
interval_tree_test.c | -rw-r--r-- | 2.3 KB |
iomap.c | -rw-r--r-- | 6.5 KB |
iomap_copy.c | -rw-r--r-- | 2.1 KB |
iommu-common.c | -rw-r--r-- | 7.1 KB |
iommu-helper.c | -rw-r--r-- | 1.0 KB |
ioremap.c | -rw-r--r-- | 3.4 KB |
iov_iter.c | -rw-r--r-- | 19.8 KB |
irq_regs.c | -rw-r--r-- | 604 bytes |
is_single_threaded.c | -rw-r--r-- | 1.3 KB |
jedec_ddr_data.c | -rw-r--r-- | 3.0 KB |
kasprintf.c | -rw-r--r-- | 717 bytes |
kfifo.c | -rw-r--r-- | 12.7 KB |
klist.c | -rw-r--r-- | 9.3 KB |
kobject.c | -rw-r--r-- | 25.7 KB |
kobject_uevent.c | -rw-r--r-- | 11.3 KB |
kstrtox.c | -rw-r--r-- | 9.4 KB |
kstrtox.h | -rw-r--r-- | 254 bytes |
lcm.c | -rw-r--r-- | 441 bytes |
libcrc32c.c | -rw-r--r-- | 2.0 KB |
list_debug.c | -rw-r--r-- | 2.6 KB |
list_sort.c | -rw-r--r-- | 6.8 KB |
llist.c | -rw-r--r-- | 3.1 KB |
locking-selftest-hardirq.h | -rw-r--r-- | 207 bytes |
locking-selftest-mutex.h | -rw-r--r-- | 120 bytes |
locking-selftest-rlock-hardirq.h | -rw-r--r-- | 74 bytes |
locking-selftest-rlock-softirq.h | -rw-r--r-- | 74 bytes |
locking-selftest-rlock.h | -rw-r--r-- | 158 bytes |
locking-selftest-rsem.h | -rw-r--r-- | 163 bytes |
locking-selftest-softirq.h | -rw-r--r-- | 207 bytes |
locking-selftest-spin-hardirq.h | -rw-r--r-- | 73 bytes |
locking-selftest-spin-softirq.h | -rw-r--r-- | 73 bytes |
locking-selftest-spin.h | -rw-r--r-- | 118 bytes |
locking-selftest-wlock-hardirq.h | -rw-r--r-- | 74 bytes |
locking-selftest-wlock-softirq.h | -rw-r--r-- | 74 bytes |
locking-selftest-wlock.h | -rw-r--r-- | 158 bytes |
locking-selftest-wsem.h | -rw-r--r-- | 163 bytes |
locking-selftest.c | -rw-r--r-- | 40.1 KB |
lockref.c | -rw-r--r-- | 4.1 KB |
lru_cache.c | -rw-r--r-- | 19.4 KB |
md5.c | -rw-r--r-- | 3.7 KB |
memory-notifier-error-inject.c | -rw-r--r-- | 1.1 KB |
memweight.c | -rw-r--r-- | 999 bytes |
net_utils.c | -rw-r--r-- | 604 bytes |
nlattr.c | -rw-r--r-- | 12.5 KB |
notifier-error-inject.c | -rw-r--r-- | 2.7 KB |
notifier-error-inject.h | -rw-r--r-- | 614 bytes |
of-reconfig-notifier-error-inject.c | -rw-r--r-- | 1.3 KB |
oid_registry.c | -rw-r--r-- | 3.8 KB |
parser.c | -rw-r--r-- | 7.1 KB |
pci_iomap.c | -rw-r--r-- | 2.2 KB |
percpu-refcount.c | -rw-r--r-- | 11.7 KB |
percpu_counter.c | -rw-r--r-- | 5.5 KB |
percpu_ida.c | -rw-r--r-- | 9.5 KB |
percpu_test.c | -rw-r--r-- | 3.2 KB |
plist.c | -rw-r--r-- | 5.9 KB |
pm-notifier-error-inject.c | -rw-r--r-- | 1.1 KB |
proportions.c | -rw-r--r-- | 9.4 KB |
radix-tree.c | -rw-r--r-- | 39.3 KB |
random32.c | -rw-r--r-- | 12.6 KB |
ratelimit.c | -rw-r--r-- | 1.5 KB |
rational.c | -rw-r--r-- | 1.5 KB |
rbtree.c | -rw-r--r-- | 15.0 KB |
rbtree_test.c | -rw-r--r-- | 5.5 KB |
reciprocal_div.c | -rw-r--r-- | 492 bytes |
rhashtable.c | -rw-r--r-- | 20.5 KB |
scatterlist.c | -rw-r--r-- | 18.2 KB |
seq_buf.c | -rw-r--r-- | 7.8 KB |
sha1.c | -rw-r--r-- | 6.1 KB |
show_mem.c | -rw-r--r-- | 1.3 KB |
smp_processor_id.c | -rw-r--r-- | 1.3 KB |
sort.c | -rw-r--r-- | 2.5 KB |
stmp_device.c | -rw-r--r-- | 2.1 KB |
string.c | -rw-r--r-- | 17.0 KB |
string_helpers.c | -rw-r--r-- | 10.2 KB |
strncpy_from_user.c | -rw-r--r-- | 2.9 KB |
strnlen_user.c | -rw-r--r-- | 4.0 KB |
swiotlb.c | -rw-r--r-- | 27.1 KB |
syscall.c | -rw-r--r-- | 2.4 KB |
test-hexdump.c | -rw-r--r-- | 4.0 KB |
test-kstrtox.c | -rw-r--r-- | 17.4 KB |
test-string_helpers.c | -rw-r--r-- | 8.1 KB |
test_bpf.c | -rw-r--r-- | 56.9 KB |
test_firmware.c | -rw-r--r-- | 2.8 KB |
test_kasan.c | -rw-r--r-- | 5.1 KB |
test_module.c | -rw-r--r-- | 753 bytes |
test_rhashtable.c | -rw-r--r-- | 4.6 KB |
test_user_copy.c | -rw-r--r-- | 3.1 KB |
textsearch.c | -rw-r--r-- | 9.4 KB |
timerqueue.c | -rw-r--r-- | 3.1 KB |
ts_bm.c | -rw-r--r-- | 5.3 KB |
ts_fsm.c | -rw-r--r-- | 10.6 KB |
ts_kmp.c | -rw-r--r-- | 4.3 KB |
ucs2_string.c | -rw-r--r-- | 1.2 KB |
usercopy.c | -rw-r--r-- | 197 bytes |
uuid.c | -rw-r--r-- | 1.3 KB |
vsprintf.c | -rw-r--r-- | 63.4 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...