From c19a406344ecb82aeaa9ecfc35beb9a2997c46f2 Mon Sep 17 00:00:00 2001 From: Vladimir Davydov Date: Wed, 9 Dec 2015 16:31:12 +1100 Subject: [PATCH] mm/khugepaged: fix scan not aborted on SCAN_EXCEED_SWAP_PTE This patch fixes a typo in khugepaged_scan_pmd(): instead of setting "result" to SCAN_EXCEED_SWAP_PTE we set "ret". Setting "ret" results in an attempt to collapse a huge page although we meant aborting the scan. As a result, we can call khugepaged_find_target_node() with all entries in the khugepaged_node_load array being zeros. The latter is not ready for that and might return an offline node on such input. This leads to a warning followed by kernel panic: WARNING: CPU: 1 PID: 40 at include/linux/gfp.h:314 khugepaged_alloc_page+0xd4/0xf0() CPU: 1 PID: 40 Comm: khugepaged Not tainted 4.3.0-rc1-mm1+ #102 000000000000013a ffff88010ae77b58 ffffffff813270d4 ffffffff818cda31 0000000000000000 ffff88010ae77b98 ffffffff8107c9f5 dead000000000100 ffff88010ae77e70 0000000000c752da 0000000000000001 0000000000000000 Call Trace: [] dump_stack+0x48/0x64 [] warn_slowpath_common+0x95/0xe0 [] warn_slowpath_null+0x1a/0x20 [] khugepaged_alloc_page+0xd4/0xf0 [] collapse_huge_page+0x58/0x550 [] ? account_entity_dequeue+0xb6/0xd0 [] ? idle_balance+0x79/0x2b0 [] khugepaged_scan_pmd+0x49e/0x710 [] ? lock_timer_base+0x5a/0x80 [] ? try_to_del_timer_sync+0x5b/0x70 [] ? del_timer_sync+0x4c/0x60 [] ? schedule_timeout+0x11f/0x200 [] khugepaged_scan_mm_slot+0x160/0x2a0 [] khugepaged_do_scan+0xef/0x160 [] ? wait_woken+0x80/0x80 [] ? khugepaged_do_scan+0x160/0x160 [] khugepaged+0x28/0x80 [] kthread+0xcc/0xf0 [] ? schedule_tail+0x1e/0xc0 [] ? kthread_freezable_should_stop+0x70/0x70 [] ret_from_fork+0x3f/0x70 [] ? kthread_freezable_should_stop+0x70/0x70 BUG: unable to handle kernel paging request at 0000000000014028 IP: [] __alloc_pages_nodemask+0xc2/0x2c0 PGD aaac7067 PUD aaac6067 PMD 0 Oops: 0000 [#1] SMP CPU: 1 PID: 40 Comm: khugepaged Tainted: G W 4.3.0-rc1-mm1+ #102 task: ffff88010ae16400 ti: ffff88010ae74000 task.ti: ffff88010ae74000 RIP: 0010:[] [] __alloc_pages_nodemask+0xc2/0x2c0 RSP: 0018:ffff88010ae77ad8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000014020 RCX: 0000000000000014 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 0000000000c752da RBP: ffff88010ae77ba8 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000000 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000c752da FS: 0000000000000000(0000) GS:ffff88010be40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000014028 CR3: 00000000aaac4000 CR4: 00000000000006e0 Stack: ffff88010ae77ae8 ffffffff810d0b3b ffff88010ae77b48 ffffffff81179e73 0000000000000010 ffff88010ae77b58 ffff88010ae77b18 ffffffff811ec124 ffff88010ae77b38 00000009a6e3aff4 0000000000000000 0000000000000000 Call Trace: [] ? vprintk_default+0x2b/0x40 [] ? printk+0x46/0x48 [] ? khugepaged_alloc_page+0xd4/0xf0 [] ? warn_slowpath_common+0xa4/0xe0 [] khugepaged_alloc_page+0x7d/0xf0 [] collapse_huge_page+0x58/0x550 [] ? account_entity_dequeue+0xb6/0xd0 [] ? idle_balance+0x79/0x2b0 [] khugepaged_scan_pmd+0x49e/0x710 [] ? lock_timer_base+0x5a/0x80 [] ? try_to_del_timer_sync+0x5b/0x70 [] ? del_timer_sync+0x4c/0x60 [] ? schedule_timeout+0x11f/0x200 [] khugepaged_scan_mm_slot+0x160/0x2a0 [] khugepaged_do_scan+0xef/0x160 [] ? wait_woken+0x80/0x80 [] ? khugepaged_do_scan+0x160/0x160 [] khugepaged+0x28/0x80 [] kthread+0xcc/0xf0 [] ? schedule_tail+0x1e/0xc0 [] ? kthread_freezable_should_stop+0x70/0x70 [] ret_from_fork+0x3f/0x70 [] ? kthread_freezable_should_stop+0x70/0x70 RIP [] __alloc_pages_nodemask+0xc2/0x2c0 RSP CR2: 0000000000014028 Fixes: acc067d59a1f9 ("mm: make optimistic check for swapin readahead") Signed-off-by: Vladimir Davydov Cc: Ebru Akagunduz Cc: Rik van Riel Cc: Kirill A. Shutemov Signed-off-by: Andrew Morton --- mm/huge_memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 65e169ca98c998..ba399bed030333 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -2769,7 +2769,7 @@ static int khugepaged_scan_pmd(struct mm_struct *mm, if (++unmapped <= khugepaged_max_ptes_swap) { continue; } else { - ret = SCAN_EXCEED_SWAP_PTE; + result = SCAN_EXCEED_SWAP_PTE; goto out_unmap; } }