Revision c9d398fa237882ea07167e23bcfc5e6847066518 authored by Naoya Horiguchi on 31 March 2017, 22:11:55 UTC, committed by Linus Torvalds on 01 April 2017, 00:13:30 UTC
I found the race condition which triggers the following bug when move_pages() and soft offline are called on a single hugetlb page concurrently. Soft offlining page 0x119400 at 0x700000000000 BUG: unable to handle kernel paging request at ffffea0011943820 IP: follow_huge_pmd+0x143/0x190 PGD 7ffd2067 PUD 7ffd1067 PMD 0 [61163.582052] Oops: 0000 [#1] SMP Modules linked in: binfmt_misc ppdev virtio_balloon parport_pc pcspkr i2c_piix4 parport i2c_core acpi_cpufreq ip_tables xfs libcrc32c ata_generic pata_acpi virtio_blk 8139too crc32c_intel ata_piix serio_raw libata virtio_pci 8139cp virtio_ring virtio mii floppy dm_mirror dm_region_hash dm_log dm_mod [last unloaded: cap_check] CPU: 0 PID: 22573 Comm: iterate_numa_mo Tainted: P OE 4.11.0-rc2-mm1+ #2 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:follow_huge_pmd+0x143/0x190 RSP: 0018:ffffc90004bdbcd0 EFLAGS: 00010202 RAX: 0000000465003e80 RBX: ffffea0004e34d30 RCX: 00003ffffffff000 RDX: 0000000011943800 RSI: 0000000000080001 RDI: 0000000465003e80 RBP: ffffc90004bdbd18 R08: 0000000000000000 R09: ffff880138d34000 R10: ffffea0004650000 R11: 0000000000c363b0 R12: ffffea0011943800 R13: ffff8801b8d34000 R14: ffffea0000000000 R15: 000077ff80000000 FS: 00007fc977710740(0000) GS:ffff88007dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffea0011943820 CR3: 000000007a746000 CR4: 00000000001406f0 Call Trace: follow_page_mask+0x270/0x550 SYSC_move_pages+0x4ea/0x8f0 SyS_move_pages+0xe/0x10 do_syscall_64+0x67/0x180 entry_SYSCALL64_slow_path+0x25/0x25 RIP: 0033:0x7fc976e03949 RSP: 002b:00007ffe72221d88 EFLAGS: 00000246 ORIG_RAX: 0000000000000117 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc976e03949 RDX: 0000000000c22390 RSI: 0000000000001400 RDI: 0000000000005827 RBP: 00007ffe72221e00 R08: 0000000000c2c3a0 R09: 0000000000000004 R10: 0000000000c363b0 R11: 0000000000000246 R12: 0000000000400650 R13: 00007ffe72221ee0 R14: 0000000000000000 R15: 0000000000000000 Code: 81 e4 ff ff 1f 00 48 21 c2 49 c1 ec 0c 48 c1 ea 0c 4c 01 e2 49 bc 00 00 00 00 00 ea ff ff 48 c1 e2 06 49 01 d4 f6 45 bc 04 74 90 <49> 8b 7c 24 20 40 f6 c7 01 75 2b 4c 89 e7 8b 47 1c 85 c0 7e 2a RIP: follow_huge_pmd+0x143/0x190 RSP: ffffc90004bdbcd0 CR2: ffffea0011943820 ---[ end trace e4f81353a2d23232 ]--- Kernel panic - not syncing: Fatal exception Kernel Offset: disabled This bug is triggered when pmd_present() returns true for non-present hugetlb, so fixing the present check in follow_huge_pmd() prevents it. Using pmd_present() to determine present/non-present for hugetlb is not correct, because pmd_present() checks multiple bits (not only _PAGE_PRESENT) for historical reason and it can misjudge hugetlb state. Fixes: e66f17ff7177 ("mm/hugetlb: take page table lock in follow_huge_pmd()") Link: http://lkml.kernel.org/r/1490149898-20231-1-git-send-email-n-horiguchi@ah.jp.nec.com Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> Acked-by: Hillf Danton <hillf.zj@alibaba-inc.com> Cc: Hugh Dickins <hughd@google.com> Cc: Michal Hocko <mhocko@kernel.org> Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> Cc: Mike Kravetz <mike.kravetz@oracle.com> Cc: Christian Borntraeger <borntraeger@de.ibm.com> Cc: Gerald Schaefer <gerald.schaefer@de.ibm.com> Cc: <stable@vger.kernel.org> [4.0+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 0cefabd
File | Mode | Size |
---|---|---|
bpf | ||
cgroup | ||
configs | ||
debug | ||
events | ||
gcov | ||
irq | ||
livepatch | ||
locking | ||
power | ||
printk | ||
rcu | ||
sched | ||
time | ||
trace | ||
.gitignore | -rw-r--r-- | 69 bytes |
Kconfig.freezer | -rw-r--r-- | 52 bytes |
Kconfig.hz | -rw-r--r-- | 1.6 KB |
Kconfig.locks | -rw-r--r-- | 4.8 KB |
Kconfig.preempt | -rw-r--r-- | 2.1 KB |
Makefile | -rw-r--r-- | 3.9 KB |
acct.c | -rw-r--r-- | 15.4 KB |
async.c | -rw-r--r-- | 9.9 KB |
audit.c | -rw-r--r-- | 61.0 KB |
audit.h | -rw-r--r-- | 11.1 KB |
audit_fsnotify.c | -rw-r--r-- | 6.1 KB |
audit_tree.c | -rw-r--r-- | 22.9 KB |
audit_watch.c | -rw-r--r-- | 14.4 KB |
auditfilter.c | -rw-r--r-- | 34.0 KB |
auditsc.c | -rw-r--r-- | 65.0 KB |
backtracetest.c | -rw-r--r-- | 2.1 KB |
bounds.c | -rw-r--r-- | 703 bytes |
capability.c | -rw-r--r-- | 13.9 KB |
compat.c | -rw-r--r-- | 29.7 KB |
configs.c | -rw-r--r-- | 2.8 KB |
context_tracking.c | -rw-r--r-- | 6.3 KB |
cpu.c | -rw-r--r-- | 44.2 KB |
cpu_pm.c | -rw-r--r-- | 6.5 KB |
crash_dump.c | -rw-r--r-- | 1.3 KB |
cred.c | -rw-r--r-- | 21.5 KB |
delayacct.c | -rw-r--r-- | 4.5 KB |
dma.c | -rw-r--r-- | 3.6 KB |
elfcore.c | -rw-r--r-- | 396 bytes |
exec_domain.c | -rw-r--r-- | 1.4 KB |
exit.c | -rw-r--r-- | 44.0 KB |
extable.c | -rw-r--r-- | 4.3 KB |
fork.c | -rw-r--r-- | 57.8 KB |
freezer.c | -rw-r--r-- | 4.4 KB |
futex.c | -rw-r--r-- | 89.5 KB |
futex_compat.c | -rw-r--r-- | 4.5 KB |
groups.c | -rw-r--r-- | 5.2 KB |
hung_task.c | -rw-r--r-- | 6.0 KB |
irq_work.c | -rw-r--r-- | 4.4 KB |
jump_label.c | -rw-r--r-- | 17.9 KB |
kallsyms.c | -rw-r--r-- | 16.5 KB |
kcmp.c | -rw-r--r-- | 4.4 KB |
kcov.c | -rw-r--r-- | 7.3 KB |
kexec.c | -rw-r--r-- | 6.8 KB |
kexec_core.c | -rw-r--r-- | 39.6 KB |
kexec_file.c | -rw-r--r-- | 25.4 KB |
kexec_internal.h | -rw-r--r-- | 818 bytes |
kmod.c | -rw-r--r-- | 19.6 KB |
kprobes.c | -rw-r--r-- | 61.6 KB |
ksysfs.c | -rw-r--r-- | 6.2 KB |
kthread.c | -rw-r--r-- | 32.0 KB |
latencytop.c | -rw-r--r-- | 7.9 KB |
membarrier.c | -rw-r--r-- | 2.5 KB |
memremap.c | -rw-r--r-- | 12.0 KB |
module-internal.h | -rw-r--r-- | 458 bytes |
module.c | -rw-r--r-- | 109.6 KB |
module_signing.c | -rw-r--r-- | 2.2 KB |
notifier.c | -rw-r--r-- | 16.3 KB |
nsproxy.c | -rw-r--r-- | 6.4 KB |
padata.c | -rw-r--r-- | 25.3 KB |
panic.c | -rw-r--r-- | 15.8 KB |
params.c | -rw-r--r-- | 24.1 KB |
pid.c | -rw-r--r-- | 15.0 KB |
pid_namespace.c | -rw-r--r-- | 11.1 KB |
profile.c | -rw-r--r-- | 14.8 KB |
ptrace.c | -rw-r--r-- | 32.4 KB |
range.c | -rw-r--r-- | 3.0 KB |
reboot.c | -rw-r--r-- | 13.3 KB |
relay.c | -rw-r--r-- | 32.1 KB |
resource.c | -rw-r--r-- | 39.3 KB |
seccomp.c | -rw-r--r-- | 24.1 KB |
signal.c | -rw-r--r-- | 94.8 KB |
smp.c | -rw-r--r-- | 21.0 KB |
smpboot.c | -rw-r--r-- | 13.3 KB |
smpboot.h | -rw-r--r-- | 601 bytes |
softirq.c | -rw-r--r-- | 19.0 KB |
stacktrace.c | -rw-r--r-- | 1.6 KB |
stop_machine.c | -rw-r--r-- | 17.1 KB |
sys.c | -rw-r--r-- | 58.0 KB |
sys_ni.c | -rw-r--r-- | 7.2 KB |
sysctl.c | -rw-r--r-- | 67.4 KB |
sysctl_binary.c | -rw-r--r-- | 50.9 KB |
task_work.c | -rw-r--r-- | 3.3 KB |
taskstats.c | -rw-r--r-- | 15.0 KB |
test_kprobes.c | -rw-r--r-- | 7.4 KB |
torture.c | -rw-r--r-- | 21.0 KB |
tracepoint.c | -rw-r--r-- | 14.6 KB |
tsacct.c | -rw-r--r-- | 5.1 KB |
ucount.c | -rw-r--r-- | 5.7 KB |
uid16.c | -rw-r--r-- | 5.0 KB |
up.c | -rw-r--r-- | 2.0 KB |
user-return-notifier.c | -rw-r--r-- | 1.3 KB |
user.c | -rw-r--r-- | 5.4 KB |
user_namespace.c | -rw-r--r-- | 27.4 KB |
utsname.c | -rw-r--r-- | 3.6 KB |
utsname_sysctl.c | -rw-r--r-- | 3.0 KB |
watchdog.c | -rw-r--r-- | 22.8 KB |
watchdog_hld.c | -rw-r--r-- | 6.5 KB |
workqueue.c | -rw-r--r-- | 154.5 KB |
workqueue_internal.h | -rw-r--r-- | 2.2 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...