| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1473755948-13215-1-git-send-email-rui.teng@linux.vnet.ibm.com>
Date: Tue, 13 Sep 2016 16:39:08 +0800
From: Rui Teng <rui.teng@...ux.vnet.ibm.com>
To: linux-mm@...ck.org, linux-kernel@...r.kernel.org
Cc: Andrew Morton <akpm@...ux-foundation.org>,
Naoya Horiguchi <n-horiguchi@...jp.nec.com>,
Michal Hocko <mhocko@...e.com>,
"Kirill A . Shutemov" <kirill.shutemov@...ux.intel.com>,
Vlastimil Babka <vbabka@...e.cz>,
Mike Kravetz <mike.kravetz@...cle.com>,
"Aneesh Kumar K . V" <aneesh.kumar@...ux.vnet.ibm.com>,
Dave Hansen <dave.hansen@...ux.intel.com>,
Paul Gortmaker <paul.gortmaker@...driver.com>,
Santhosh G <santhog4@...ibm.com>,
Rui Teng <rui.teng@...ux.vnet.ibm.com>
Subject: [PATCH] memory-hotplug: Fix bad area access on dissolve_free_huge_pages()
Santhosh G reported that call traces occurs when memory-hotplug script is run
with 16Gb hugepages configured.
It was found that the page_hstate(page) will get 0 if the PageHead(page) return
false, Which will cause the bad area access.
Issue:
Call traces occurs when memory-hotplug script is run with 16Gb hugepages configured.
Environment:
ppc64le PowerVM Lpar
root@...tuleta-lp1:~# uname -r
4.4.0-34-generic
root@...tuleta-lp1:~# cat /proc/meminfo | grep -i huge
AnonHugePages: 0 kB
HugePages_Total: 2
HugePages_Free: 2
HugePages_Rsvd: 0
HugePages_Surp: 0
Hugepagesize: 16777216 kB
root@...tuleta-lp1:~# free -h
total used free shared buff/cache available
Mem: 85G 32G 52G 16M 193M 52G
Swap: 43G 0B 43G
Steps to reproduce:
1 - Download kernel source and enter to the directory- tools/testing/selftests/memory-hotplug/
2 - Run mem-on-off-test.sh script in it.
System gives call traces like:
offline_memory_expect_success 639: unexpected fail
online-offline 668
[ 57.552964] Unable to handle kernel paging request for data at address 0x00000028
[ 57.552977] Faulting instruction address: 0xc00000000029bc04
[ 57.552987] Oops: Kernel access of bad area, sig: 11 [#1]
[ 57.552992] SMP NR_CPUS=2048 NUMA pSeries
[ 57.553002] Modules linked in: btrfs xor raid6_pq pseries_rng sunrpc autofs4 ses enclosure nouveau bnx2x i2c_algo_bit ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm vxlan ip6_udp_tunnel ipr udp_tunnel rtc_generic mdio libcrc32c
[ 57.553050] CPU: 44 PID: 6518 Comm: mem-on-off-test Not tainted 4.4.0-34-generic #53-Ubuntu
[ 57.553059] task: c00000072773c8e0 ti: c000000727780000 task.ti: c000000727780000
[ 57.553067] NIP: c00000000029bc04 LR: c00000000029bbdc CTR: c0000000001107f0
[ 57.553076] REGS: c000000727783770 TRAP: 0300 Not tainted (4.4.0-34-generic)
[ 57.553083] MSR: 8000000100009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24242882 XER: 00000002
[ 57.553104] CFAR: c000000000008468 DAR: 0000000000000028 DSISR: 40000000 SOFTE: 1
GPR00: c00000000029bbdc c0000007277839f0 c0000000015b5d00 0000000000000000
GPR04: 000000000029d000 0000000000000800 0000000000000000 f00000000a000001
GPR08: f00000000a700020 0000000000000008 c00000000185e270 c000000e7e000050
GPR12: 0000000000002200 c00000000e6ea200 000000000029d000 0000000022000000
GPR16: 1000000000000000 c0000000015e2200 000000000a700000 0000000000000000
GPR20: 0000000000010000 0000000000000100 0000000000000200 c0000000015f16d0
GPR24: c000000001876510 0000000000000000 0000000000000001 c000000001872a00
GPR28: 000000000029d000 f000000000000000 f00000000a700000 000000000029c000
[ 57.553211] NIP [c00000000029bc04] dissolve_free_huge_pages+0x154/0x220
[ 57.553219] LR [c00000000029bbdc] dissolve_free_huge_pages+0x12c/0x220
[ 57.553226] Call Trace:
[ 57.553231] [c0000007277839f0] [c00000000029bbdc] dissolve_free_huge_pages+0x12c/0x220 (unreliable)
[ 57.553244] [c000000727783a80] [c0000000002dcbc8] __offline_pages.constprop.6+0x3f8/0x900
[ 57.553254] [c000000727783bd0] [c0000000006fbb38] memory_subsys_offline+0xa8/0x110
[ 57.553265] [c000000727783c00] [c0000000006d6424] device_offline+0x104/0x140
[ 57.553274] [c000000727783c40] [c0000000006fba80] store_mem_state+0x180/0x190
[ 57.553283] [c000000727783c80] [c0000000006d1e58] dev_attr_store+0x68/0xa0
[ 57.553293] [c000000727783cc0] [c000000000398110] sysfs_kf_write+0x80/0xb0
[ 57.553302] [c000000727783d00] [c000000000397028] kernfs_fop_write+0x188/0x200
[ 57.553312] [c000000727783d50] [c0000000002e190c] __vfs_write+0x6c/0xe0
[ 57.553321] [c000000727783d90] [c0000000002e2640] vfs_write+0xc0/0x230
[ 57.553329] [c000000727783de0] [c0000000002e367c] SyS_write+0x6c/0x110
[ 57.553339] [c000000727783e30] [c000000000009204] system_call+0x38/0xb4
[ 57.553346] Instruction dump:
[ 57.553351] 7e831836 4bfff991 e91e0028 e8fe0020 7d32e82a f9070008 f8e80000 fabe0020
[ 57.553366] fade0028 79294620 79291764 7d234a14 <e9030028> 3908ffff f9030028 81091458
[ 57.553383] ---[ end trace 617f7bdd75bcfc10 ]---
[ 57.557133]
Segmentation fault
Reported-by: Santhosh G <santhog4@...ibm.com>
Signed-off-by: Rui Teng <rui.teng@...ux.vnet.ibm.com>
---
mm/hugetlb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 87e11d8..64b5f81 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1442,7 +1442,7 @@ static int free_pool_huge_page(struct hstate *h, nodemask_t *nodes_allowed,
static void dissolve_free_huge_page(struct page *page)
{
spin_lock(&hugetlb_lock);
- if (PageHuge(page) && !page_count(page)) {
+ if (PageHuge(page) && !page_count(page) && PageHead(page)) {
struct hstate *h = page_hstate(page);
int nid = page_to_nid(page);
list_del(&page->lru);
--
2.7.4
Powered by blists - more mailing lists