Date:   Tue, 13 Sep 2016 16:39:08 +0800
From:   Rui Teng <rui.teng@...ux.vnet.ibm.com>
To:     linux-mm@...ck.org, linux-kernel@...r.kernel.org
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Naoya Horiguchi <n-horiguchi@...jp.nec.com>,
        Michal Hocko <mhocko@...e.com>,
        "Kirill A . Shutemov" <kirill.shutemov@...ux.intel.com>,
        Vlastimil Babka <vbabka@...e.cz>,
        Mike Kravetz <mike.kravetz@...cle.com>,
        "Aneesh Kumar K . V" <aneesh.kumar@...ux.vnet.ibm.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Paul Gortmaker <paul.gortmaker@...driver.com>,
        Santhosh G <santhog4@...ibm.com>,
        Rui Teng <rui.teng@...ux.vnet.ibm.com>
Subject: [PATCH] memory-hotplug: Fix bad area access on dissolve_free_huge_pages()

Santhosh G reported that call traces occurs when memory-hotplug script is run
with 16Gb hugepages configured.

It was found that the page_hstate(page) will get 0 if the PageHead(page) return
false, Which will cause the bad area access.

Issue:
Call traces occurs when memory-hotplug script is run with 16Gb hugepages configured.

Environment:
ppc64le PowerVM Lpar

root@...tuleta-lp1:~# uname -r
4.4.0-34-generic

root@...tuleta-lp1:~# cat /proc/meminfo | grep -i huge
AnonHugePages:         0 kB
HugePages_Total:       2
HugePages_Free:        2
HugePages_Rsvd:        0
HugePages_Surp:        0
Hugepagesize:   16777216 kB

root@...tuleta-lp1:~# free -h
              total        used        free      shared  buff/cache   available
Mem:            85G         32G         52G         16M        193M         52G
Swap:           43G          0B         43G

Steps to reproduce:
1 - Download kernel source and enter to the directory- tools/testing/selftests/memory-hotplug/
2 - Run  mem-on-off-test.sh script in it.

System gives call traces like:

offline_memory_expect_success 639: unexpected fail
online-offline 668
[   57.552964] Unable to handle kernel paging request for data at address 0x00000028
[   57.552977] Faulting instruction address: 0xc00000000029bc04
[   57.552987] Oops: Kernel access of bad area, sig: 11 [#1]
[   57.552992] SMP NR_CPUS=2048 NUMA pSeries
[   57.553002] Modules linked in: btrfs xor raid6_pq pseries_rng sunrpc autofs4 ses enclosure nouveau bnx2x i2c_algo_bit ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm vxlan ip6_udp_tunnel ipr udp_tunnel rtc_generic mdio libcrc32c
[   57.553050] CPU: 44 PID: 6518 Comm: mem-on-off-test Not tainted 4.4.0-34-generic #53-Ubuntu
[   57.553059] task: c00000072773c8e0 ti: c000000727780000 task.ti: c000000727780000
[   57.553067] NIP: c00000000029bc04 LR: c00000000029bbdc CTR: c0000000001107f0
[   57.553076] REGS: c000000727783770 TRAP: 0300   Not tainted  (4.4.0-34-generic)
[   57.553083] MSR: 8000000100009033 <SF,EE,ME,IR,DR,RI,LE>  CR: 24242882  XER: 00000002
[   57.553104] CFAR: c000000000008468 DAR: 0000000000000028 DSISR: 40000000 SOFTE: 1
GPR00: c00000000029bbdc c0000007277839f0 c0000000015b5d00 0000000000000000
GPR04: 000000000029d000 0000000000000800 0000000000000000 f00000000a000001
GPR08: f00000000a700020 0000000000000008 c00000000185e270 c000000e7e000050
GPR12: 0000000000002200 c00000000e6ea200 000000000029d000 0000000022000000
GPR16: 1000000000000000 c0000000015e2200 000000000a700000 0000000000000000
GPR20: 0000000000010000 0000000000000100 0000000000000200 c0000000015f16d0
GPR24: c000000001876510 0000000000000000 0000000000000001 c000000001872a00
GPR28: 000000000029d000 f000000000000000 f00000000a700000 000000000029c000
[   57.553211] NIP [c00000000029bc04] dissolve_free_huge_pages+0x154/0x220
[   57.553219] LR [c00000000029bbdc] dissolve_free_huge_pages+0x12c/0x220
[   57.553226] Call Trace:
[   57.553231] [c0000007277839f0] [c00000000029bbdc] dissolve_free_huge_pages+0x12c/0x220 (unreliable)
[   57.553244] [c000000727783a80] [c0000000002dcbc8] __offline_pages.constprop.6+0x3f8/0x900
[   57.553254] [c000000727783bd0] [c0000000006fbb38] memory_subsys_offline+0xa8/0x110
[   57.553265] [c000000727783c00] [c0000000006d6424] device_offline+0x104/0x140
[   57.553274] [c000000727783c40] [c0000000006fba80] store_mem_state+0x180/0x190
[   57.553283] [c000000727783c80] [c0000000006d1e58] dev_attr_store+0x68/0xa0
[   57.553293] [c000000727783cc0] [c000000000398110] sysfs_kf_write+0x80/0xb0
[   57.553302] [c000000727783d00] [c000000000397028] kernfs_fop_write+0x188/0x200
[   57.553312] [c000000727783d50] [c0000000002e190c] __vfs_write+0x6c/0xe0
[   57.553321] [c000000727783d90] [c0000000002e2640] vfs_write+0xc0/0x230
[   57.553329] [c000000727783de0] [c0000000002e367c] SyS_write+0x6c/0x110
[   57.553339] [c000000727783e30] [c000000000009204] system_call+0x38/0xb4
[   57.553346] Instruction dump:
[   57.553351] 7e831836 4bfff991 e91e0028 e8fe0020 7d32e82a f9070008 f8e80000 fabe0020
[   57.553366] fade0028 79294620 79291764 7d234a14 <e9030028> 3908ffff f9030028 81091458
[   57.553383] ---[ end trace 617f7bdd75bcfc10 ]---
[   57.557133]
Segmentation fault

Reported-by: Santhosh G <santhog4@...ibm.com>
Signed-off-by: Rui Teng <rui.teng@...ux.vnet.ibm.com>
---
 mm/hugetlb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 87e11d8..64b5f81 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1442,7 +1442,7 @@ static int free_pool_huge_page(struct hstate *h, nodemask_t *nodes_allowed,
 static void dissolve_free_huge_page(struct page *page)
 {
 	spin_lock(&hugetlb_lock);
-	if (PageHuge(page) && !page_count(page)) {
+	if (PageHuge(page) && !page_count(page) && PageHead(page)) {
 		struct hstate *h = page_hstate(page);
 		int nid = page_to_nid(page);
 		list_del(&page->lru);
-- 
2.7.4

Powered by blists - more mailing lists