| Message ID | 20200706011947.184166-3-justin.he@arm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Fix and enable pmem as RAM on arm64 | expand |
On 06.07.20 03:19, Jia He wrote: > When testing the remove_memory path of dax pmem, there will be a panic with > call trace: > try_remove_memory+0x84/0x170 > remove_memory+0x38/0x58 > dev_dax_kmem_remove+0x3c/0x84 [kmem] > device_release_driver_internal+0xfc/0x1c8 > device_release_driver+0x28/0x38 > bus_remove_device+0xd4/0x158 > device_del+0x160/0x3a0 > unregister_dev_dax+0x30/0x68 > devm_action_release+0x20/0x30 > release_nodes+0x150/0x240 > devres_release_all+0x6c/0x1d0 > device_release_driver_internal+0x10c/0x1c8 > driver_detach+0xac/0x170 > bus_remove_driver+0x64/0x130 > driver_unregister+0x34/0x60 > dax_pmem_exit+0x14/0xffc4 [dax_pmem] > __arm64_sys_delete_module+0x18c/0x2d0 > el0_svc_common.constprop.2+0x78/0x168 > do_el0_svc+0x34/0xa0 > el0_sync_handler+0xe0/0x188 > el0_sync+0x164/0x180 > > It is caused by the bogus nid (-1). Although the root cause is pmem dax > translates from pxm to node_id incorrectly due to numa_off, it is worth > hardening the codes in try_offline_node(), quiting if !pgdat. > > Signed-off-by: Jia He <justin.he@arm.com> > --- > mm/memory_hotplug.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c > index da374cd3d45b..e1e290577b45 100644 > --- a/mm/memory_hotplug.c > +++ b/mm/memory_hotplug.c > @@ -1680,6 +1680,9 @@ void try_offline_node(int nid) > pg_data_t *pgdat = NODE_DATA(nid); > int rc; > > + if (WARN_ON(!pgdat)) > + return; > + > /* > * If the node still spans pages (especially ZONE_DEVICE), don't > * offline it. A node spans memory after move_pfn_range_to_zone(), > Hm. If I am not wrong, somebody used add_memory() with another nid than try_remove_memory()? Or did we pass the node_possible(nid) check in add_memory_resource(), and succeeded to add to nid==-1? Having that said, this feels somewhat wrong, especially checking against pgdat down in try_offline_node(). It really has to be the same nid as used when adding - and that nid has to be sane.
Hi David > -----Original Message----- > From: David Hildenbrand <david@redhat.com> > Sent: Monday, July 6, 2020 3:58 PM > To: Justin He <Justin.He@arm.com>; Catalin Marinas > <Catalin.Marinas@arm.com>; Will Deacon <will@kernel.org> > Cc: Andrew Morton <akpm@linux-foundation.org>; Mike Rapoport > <rppt@linux.ibm.com>; Baoquan He <bhe@redhat.com>; Chuhong Yuan > <hslester96@gmail.com>; linux-arm-kernel@lists.infradead.org; linux- > kernel@vger.kernel.org; linux-mm@kvack.org; Kaly Xin <Kaly.Xin@arm.com> > Subject: Re: [PATCH 2/3] mm/memory_hotplug: harden try_offline_node > against bogus nid > > On 06.07.20 03:19, Jia He wrote: > > When testing the remove_memory path of dax pmem, there will be a panic > with > > call trace: > > try_remove_memory+0x84/0x170 > > remove_memory+0x38/0x58 > > dev_dax_kmem_remove+0x3c/0x84 [kmem] > > device_release_driver_internal+0xfc/0x1c8 > > device_release_driver+0x28/0x38 > > bus_remove_device+0xd4/0x158 > > device_del+0x160/0x3a0 > > unregister_dev_dax+0x30/0x68 > > devm_action_release+0x20/0x30 > > release_nodes+0x150/0x240 > > devres_release_all+0x6c/0x1d0 > > device_release_driver_internal+0x10c/0x1c8 > > driver_detach+0xac/0x170 > > bus_remove_driver+0x64/0x130 > > driver_unregister+0x34/0x60 > > dax_pmem_exit+0x14/0xffc4 [dax_pmem] > > __arm64_sys_delete_module+0x18c/0x2d0 > > el0_svc_common.constprop.2+0x78/0x168 > > do_el0_svc+0x34/0xa0 > > el0_sync_handler+0xe0/0x188 > > el0_sync+0x164/0x180 > > > > It is caused by the bogus nid (-1). Although the root cause is pmem dax > > translates from pxm to node_id incorrectly due to numa_off, it is worth > > hardening the codes in try_offline_node(), quiting if !pgdat. > > > > Signed-off-by: Jia He <justin.he@arm.com> > > --- > > mm/memory_hotplug.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c > > index da374cd3d45b..e1e290577b45 100644 > > --- a/mm/memory_hotplug.c > > +++ b/mm/memory_hotplug.c > > @@ -1680,6 +1680,9 @@ void try_offline_node(int nid) > > pg_data_t *pgdat = NODE_DATA(nid); > > int rc; > > > > + if (WARN_ON(!pgdat)) > > + return; > > + > > /* > > * If the node still spans pages (especially ZONE_DEVICE), don't > > * offline it. A node spans memory after move_pfn_range_to_zone(), > > > > Hm. If I am not wrong, somebody used add_memory() with another nid than > try_remove_memory()? > Yes after commit fa6d9ec790550, it can prevent this possibility. I will drop this single patch. Thanks -- Cheers, Justin (Jia He)
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c index da374cd3d45b..e1e290577b45 100644 --- a/mm/memory_hotplug.c +++ b/mm/memory_hotplug.c @@ -1680,6 +1680,9 @@ void try_offline_node(int nid) pg_data_t *pgdat = NODE_DATA(nid); int rc; + if (WARN_ON(!pgdat)) + return; + /* * If the node still spans pages (especially ZONE_DEVICE), don't * offline it. A node spans memory after move_pfn_range_to_zone(),
When testing the remove_memory path of dax pmem, there will be a panic with call trace: try_remove_memory+0x84/0x170 remove_memory+0x38/0x58 dev_dax_kmem_remove+0x3c/0x84 [kmem] device_release_driver_internal+0xfc/0x1c8 device_release_driver+0x28/0x38 bus_remove_device+0xd4/0x158 device_del+0x160/0x3a0 unregister_dev_dax+0x30/0x68 devm_action_release+0x20/0x30 release_nodes+0x150/0x240 devres_release_all+0x6c/0x1d0 device_release_driver_internal+0x10c/0x1c8 driver_detach+0xac/0x170 bus_remove_driver+0x64/0x130 driver_unregister+0x34/0x60 dax_pmem_exit+0x14/0xffc4 [dax_pmem] __arm64_sys_delete_module+0x18c/0x2d0 el0_svc_common.constprop.2+0x78/0x168 do_el0_svc+0x34/0xa0 el0_sync_handler+0xe0/0x188 el0_sync+0x164/0x180 It is caused by the bogus nid (-1). Although the root cause is pmem dax translates from pxm to node_id incorrectly due to numa_off, it is worth hardening the codes in try_offline_node(), quiting if !pgdat. Signed-off-by: Jia He <justin.he@arm.com> --- mm/memory_hotplug.c | 3 +++ 1 file changed, 3 insertions(+)