• Gu Zheng's avatar
    mm/memory hotplug: postpone the reset of obsolete pgdat · b0dc3a34
    Gu Zheng authored
    Qiu Xishi reported the following BUG when testing hot-add/hot-remove node under
    stress condition:
    
      BUG: unable to handle kernel paging request at 0000000000025f60
      IP: next_online_pgdat+0x1/0x50
      PGD 0
      Oops: 0000 [#1] SMP
      ACPI: Device does not support D3cold
      Modules linked in: fuse nls_iso8859_1 nls_cp437 vfat fat loop dm_mod coretemp mperf crc32c_intel ghash_clmulni_intel aesni_intel ablk_helper cryptd lrw gf128mul glue_helper aes_x86_64 pcspkr microcode igb dca i2c_algo_bit ipv6 megaraid_sas iTCO_wdt i2c_i801 i2c_core iTCO_vendor_support tg3 sg hwmon ptp lpc_ich pps_core mfd_core acpi_pad rtc_cmos button ext3 jbd mbcache sd_mod crc_t10dif scsi_dh_alua scsi_dh_rdac scsi_dh_hp_sw scsi_dh_emc scsi_dh ahci libahci libata scsi_mod [last unloaded: rasf]
      CPU: 23 PID: 238 Comm: kworker/23:1 Tainted: G           O 3.10.15-5885-euler0302 #1
      Hardware name: HUAWEI TECHNOLOGIES CO.,LTD. Huawei N1/Huawei N1, BIOS V100R001 03/02/2015
      Workqueue: events vmstat_update
      task: ffffa800d32c0000 ti: ffffa800d32ae000 task.ti: ffffa800d32ae000
      RIP: 0010: next_online_pgdat+0x1/0x50
      RSP: 0018:ffffa800d32afce8  EFLAGS: 00010286
      RAX: 0000000000001440 RBX: ffffffff81da53b8 RCX: 0000000000000082
      RDX: 0000000000000000 RSI: 0000000000000082 RDI: 0000000000000000
      RBP: ffffa800d32afd28 R08: ffffffff81c93bfc R09: ffffffff81cbdc96
      R10: 00000000000040ec R11: 00000000000000a0 R12: ffffa800fffb3440
      R13: ffffa800d32afd38 R14: 0000000000000017 R15: ffffa800e6616800
      FS:  0000000000000000(0000) GS:ffffa800e6600000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000000025f60 CR3: 0000000001a0b000 CR4: 00000000001407e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
        refresh_cpu_vm_stats+0xd0/0x140
        vmstat_update+0x11/0x50
        process_one_work+0x194/0x3d0
        worker_thread+0x12b/0x410
        kthread+0xc6/0xd0
        ret_from_fork+0x7c/0xb0
    
    The cause is the "memset(pgdat, 0, sizeof(*pgdat))" at the end of
    try_offline_node, which will reset all the content of pgdat to 0, as the
    pgdat is accessed lock-free, so that the users still using the pgdat
    will panic, such as the vmstat_update routine.
    
    process A:				offline node XX:
    
    vmstat_updat()
       refresh_cpu_vm_stats()
         for_each_populated_zone()
           find online node XX
         cond_resched()
    					offline cpu and memory, then try_offline_node()
    					node_set_offline(nid), and memset(pgdat, 0, sizeof(*pgdat))
           zone = next_zone(zone)
             pg_data_t *pgdat = zone->zone_pgdat;  // here pgdat is NULL now
               next_online_pgdat(pgdat)
                 next_online_node(pgdat->node_id);  // NULL pointer access
    
    So the solution here is postponing the reset of obsolete pgdat from
    try_offline_node() to hotadd_new_pgdat(), and just resetting
    pgdat->nr_zones and pgdat->classzone_idx to be 0 rather than the memset
    0 to avoid breaking pointer information in pgdat.
    Signed-off-by: 's avatarGu Zheng <guz.fnst@cn.fujitsu.com>
    Reported-by: 's avatarXishi Qiu <qiuxishi@huawei.com>
    Suggested-by: 's avatarKAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Cc: David Rientjes <rientjes@google.com>
    Cc: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
    Cc: Taku Izumi <izumi.taku@jp.fujitsu.com>
    Cc: Tang Chen <tangchen@cn.fujitsu.com>
    Cc: Xie XiuQi <xiexiuqi@huawei.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: 's avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: 's avatarLinus Torvalds <torvalds@linux-foundation.org>
    b0dc3a34
memory_hotplug.c 51.1 KB