Re: [Bug 198497] New: handle_mm_fault / xen_pmd_val / radix_tree_lookup_slot Null pointer

[Matthew Wilcox <willy@infradead.org>]

On Thu, Jan 18, 2018 at 02:18:20PM -0800, Laura Abbott wrote:
> Fedora has been seeing similar reports
> https://bugzilla.redhat.com/show_bug.cgi?id=1531779
> 
> Multiple reporters, one in XEN, another on actual hardware

Can you chuck this patch into Fedora?  Should make it easier to see if it's
a "stuck bit" kind of a problem.

---

From: Matthew Wilcox <mawilcox@microsoft.com>
Subject: Detect bad swap entries in lookup

If we have a stuck bit in a PTE, we can end up looking for an entry in
a NULL mapping, which oopses fairly quickly.  Print a warning to help
us debug, and return NULL which will help the machine survive a little
longer.  Although if it has a permanently stuck bit in a PTE, there's only
a 50% chance it'll surive the insertion of a real PTE into that entry.

Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>

diff --git a/mm/swap_state.c b/mm/swap_state.c
index 39ae7cfad90f..5a928e0191a1 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -334,8 +334,12 @@ struct page *lookup_swap_cache(swp_entry_t entry, struct vm_area_struct *vma,
 	struct page *page;
 	unsigned long ra_info;
 	int win, hits, readahead;
+	struct address_space *swapper_space = swap_address_space(entry);
+
+	if (WARN(!swapper_space, "Bad swp_entry: %lx\n", entry.val))
+		return NULL;
 
-	page = find_get_page(swap_address_space(entry), swp_offset(entry));
+	page = find_get_page(swapper_space, swp_offset(entry));
 
 	INC_CACHE_INFO(find_total);
 	if (page) {

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>