All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] memory-hotplug: Fix bad area access on dissolve_free_huge_pages()
@ 2016-09-13  8:39 ` Rui Teng
  0 siblings, 0 replies; 30+ messages in thread
From: Rui Teng @ 2016-09-13  8:39 UTC (permalink / raw)
  To: linux-mm, linux-kernel
  Cc: Andrew Morton, Naoya Horiguchi, Michal Hocko,
	Kirill A . Shutemov, Vlastimil Babka, Mike Kravetz,
	Aneesh Kumar K . V, Dave Hansen, Paul Gortmaker, Santhosh G,
	Rui Teng

Santhosh G reported that call traces occurs when memory-hotplug script is run
with 16Gb hugepages configured.

It was found that the page_hstate(page) will get 0 if the PageHead(page) return
false, Which will cause the bad area access.

Issue:
Call traces occurs when memory-hotplug script is run with 16Gb hugepages configured.

Environment:
ppc64le PowerVM Lpar

root@ltctuleta-lp1:~# uname -r
4.4.0-34-generic

root@ltctuleta-lp1:~# cat /proc/meminfo | grep -i huge
AnonHugePages:         0 kB
HugePages_Total:       2
HugePages_Free:        2
HugePages_Rsvd:        0
HugePages_Surp:        0
Hugepagesize:   16777216 kB

root@ltctuleta-lp1:~# free -h
              total        used        free      shared  buff/cache   available
Mem:            85G         32G         52G         16M        193M         52G
Swap:           43G          0B         43G

Steps to reproduce:
1 - Download kernel source and enter to the directory- tools/testing/selftests/memory-hotplug/
2 - Run  mem-on-off-test.sh script in it.

System gives call traces like:

offline_memory_expect_success 639: unexpected fail
online-offline 668
[   57.552964] Unable to handle kernel paging request for data at address 0x00000028
[   57.552977] Faulting instruction address: 0xc00000000029bc04
[   57.552987] Oops: Kernel access of bad area, sig: 11 [#1]
[   57.552992] SMP NR_CPUS=2048 NUMA pSeries
[   57.553002] Modules linked in: btrfs xor raid6_pq pseries_rng sunrpc autofs4 ses enclosure nouveau bnx2x i2c_algo_bit ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm vxlan ip6_udp_tunnel ipr udp_tunnel rtc_generic mdio libcrc32c
[   57.553050] CPU: 44 PID: 6518 Comm: mem-on-off-test Not tainted 4.4.0-34-generic #53-Ubuntu
[   57.553059] task: c00000072773c8e0 ti: c000000727780000 task.ti: c000000727780000
[   57.553067] NIP: c00000000029bc04 LR: c00000000029bbdc CTR: c0000000001107f0
[   57.553076] REGS: c000000727783770 TRAP: 0300   Not tainted  (4.4.0-34-generic)
[   57.553083] MSR: 8000000100009033 <SF,EE,ME,IR,DR,RI,LE>  CR: 24242882  XER: 00000002
[   57.553104] CFAR: c000000000008468 DAR: 0000000000000028 DSISR: 40000000 SOFTE: 1
GPR00: c00000000029bbdc c0000007277839f0 c0000000015b5d00 0000000000000000
GPR04: 000000000029d000 0000000000000800 0000000000000000 f00000000a000001
GPR08: f00000000a700020 0000000000000008 c00000000185e270 c000000e7e000050
GPR12: 0000000000002200 c00000000e6ea200 000000000029d000 0000000022000000
GPR16: 1000000000000000 c0000000015e2200 000000000a700000 0000000000000000
GPR20: 0000000000010000 0000000000000100 0000000000000200 c0000000015f16d0
GPR24: c000000001876510 0000000000000000 0000000000000001 c000000001872a00
GPR28: 000000000029d000 f000000000000000 f00000000a700000 000000000029c000
[   57.553211] NIP [c00000000029bc04] dissolve_free_huge_pages+0x154/0x220
[   57.553219] LR [c00000000029bbdc] dissolve_free_huge_pages+0x12c/0x220
[   57.553226] Call Trace:
[   57.553231] [c0000007277839f0] [c00000000029bbdc] dissolve_free_huge_pages+0x12c/0x220 (unreliable)
[   57.553244] [c000000727783a80] [c0000000002dcbc8] __offline_pages.constprop.6+0x3f8/0x900
[   57.553254] [c000000727783bd0] [c0000000006fbb38] memory_subsys_offline+0xa8/0x110
[   57.553265] [c000000727783c00] [c0000000006d6424] device_offline+0x104/0x140
[   57.553274] [c000000727783c40] [c0000000006fba80] store_mem_state+0x180/0x190
[   57.553283] [c000000727783c80] [c0000000006d1e58] dev_attr_store+0x68/0xa0
[   57.553293] [c000000727783cc0] [c000000000398110] sysfs_kf_write+0x80/0xb0
[   57.553302] [c000000727783d00] [c000000000397028] kernfs_fop_write+0x188/0x200
[   57.553312] [c000000727783d50] [c0000000002e190c] __vfs_write+0x6c/0xe0
[   57.553321] [c000000727783d90] [c0000000002e2640] vfs_write+0xc0/0x230
[   57.553329] [c000000727783de0] [c0000000002e367c] SyS_write+0x6c/0x110
[   57.553339] [c000000727783e30] [c000000000009204] system_call+0x38/0xb4
[   57.553346] Instruction dump:
[   57.553351] 7e831836 4bfff991 e91e0028 e8fe0020 7d32e82a f9070008 f8e80000 fabe0020
[   57.553366] fade0028 79294620 79291764 7d234a14 <e9030028> 3908ffff f9030028 81091458
[   57.553383] ---[ end trace 617f7bdd75bcfc10 ]---
[   57.557133]
Segmentation fault

Reported-by: Santhosh G <santhog4@in.ibm.com>
Signed-off-by: Rui Teng <rui.teng@linux.vnet.ibm.com>
---
 mm/hugetlb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 87e11d8..64b5f81 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1442,7 +1442,7 @@ static int free_pool_huge_page(struct hstate *h, nodemask_t *nodes_allowed,
 static void dissolve_free_huge_page(struct page *page)
 {
 	spin_lock(&hugetlb_lock);
-	if (PageHuge(page) && !page_count(page)) {
+	if (PageHuge(page) && !page_count(page) && PageHead(page)) {
 		struct hstate *h = page_hstate(page);
 		int nid = page_to_nid(page);
 		list_del(&page->lru);
-- 
2.7.4

^ permalink raw reply related	[flat|nested] 30+ messages in thread

end of thread, other threads:[~2016-09-21 16:54 UTC | newest]

Thread overview: 30+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-13  8:39 [PATCH] memory-hotplug: Fix bad area access on dissolve_free_huge_pages() Rui Teng
2016-09-13  8:39 ` Rui Teng
2016-09-13 17:32 ` Dave Hansen
2016-09-13 17:32   ` Dave Hansen
2016-09-14 16:33   ` Rui Teng
2016-09-14 16:33     ` Rui Teng
2016-09-14 16:37     ` Dave Hansen
2016-09-14 16:37       ` Dave Hansen
2016-09-16 13:58       ` Rui Teng
2016-09-16 13:58         ` Rui Teng
2016-09-16 16:25         ` Dave Hansen
2016-09-16 16:25           ` Dave Hansen
2016-09-20 14:45           ` Rui Teng
2016-09-20 14:45             ` Rui Teng
2016-09-20 14:53             ` Dave Hansen
2016-09-20 14:53               ` Dave Hansen
2016-09-20 15:52               ` Rui Teng
2016-09-20 15:52                 ` Rui Teng
2016-09-20 17:43                 ` Dave Hansen
2016-09-20 17:43                   ` Dave Hansen
2016-09-21 12:05                   ` Michal Hocko
2016-09-21 12:05                     ` Michal Hocko
2016-09-21 16:04                     ` Dave Hansen
2016-09-21 16:04                       ` Dave Hansen
2016-09-21 16:27                       ` Michal Hocko
2016-09-21 16:27                         ` Michal Hocko
2016-09-21 16:32                         ` Dave Hansen
2016-09-21 16:32                           ` Dave Hansen
2016-09-21 16:52                           ` Michal Hocko
2016-09-21 16:52                             ` Michal Hocko

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.