[PATCH] powerpc/book3s/64: check for NULL pointer in pgd_alloc()

[PATCH] powerpc/book3s/64: check for NULL pointer in pgd_alloc()

[Rick Lindsley]

When the memset code was added to pgd_alloc(), it failed to consider that kmem_cache_alloc() can return NULL.  It's uncommon, but not impossible under heavy memory contention.

Signed-off-by: Rick Lindsley <ricklind@vnet.linux.ibm.com>
Fixes: cf266dbcd2a7 ("Zero PGD pages on allocation")

--- a/arch/powerpc/include/asm/book3s/64/pgalloc.h
+++ b/arch/powerpc/include/asm/book3s/64/pgalloc.h
@@ -81,6 +81,10 @@ static inline pgd_t *pgd_alloc(struct mm
  
	pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
			       pgtable_gfp_flags(mm, GFP_KERNEL));
+
+	if (unlikely(!pgd))
+		return pgd;
+
	/*
	 * Don't scan the PGD for pointers, it contains references to PUDs but
	 * those references are not full pointers and so can't be recognised by

Re: [PATCH] powerpc/book3s/64: check for NULL pointer in pgd_alloc()

[Michael Ellerman]

Rick Lindsley <ricklind@linux.vnet.ibm.com> writes:
> When the memset code was added to pgd_alloc(), it failed to consider
> that kmem_cache_alloc() can return NULL. It's uncommon, but not
> impossible under heavy memory contention.

Can you post an oops log? Just so if someone hits it they can possibly
recognise it from the back trace etc.


> Signed-off-by: Rick Lindsley <ricklind@vnet.linux.ibm.com>
> Fixes: cf266dbcd2a7 ("Zero PGD pages on allocation")

I don't have that commit. Did you mean:

Fixes: fc5c2f4a55a2 ("powerpc/mm/hash64: Zero PGD pages on allocation")


cheers

> --- a/arch/powerpc/include/asm/book3s/64/pgalloc.h
> +++ b/arch/powerpc/include/asm/book3s/64/pgalloc.h
> @@ -81,6 +81,10 @@ static inline pgd_t *pgd_alloc(struct mm
>   
> 	pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
> 			       pgtable_gfp_flags(mm, GFP_KERNEL));
> +
> +	if (unlikely(!pgd))
> +		return pgd;
> +
> 	/*
> 	 * Don't scan the PGD for pointers, it contains references to PUDs but
> 	 * those references are not full pointers and so can't be recognised by

Re: [PATCH] powerpc/book3s/64: check for NULL pointer in pgd_alloc()

[Rick Lindsley]

On 05/06/2019 04:33 AM, Michael Ellerman wrote:

> 
> Can you post an oops log? Just so if someone hits it they can possibly
> recognise it from the back trace etc.

Sure.  The system waa already at the mercy of the oom killer (for other reasons) and finally ran out of things to kill.  Here's the stack trace.  The "missing" (static inline) function in the trace is mm_alloc_pgd().

[ 1849.077846] Unable to handle kernel paging request for data at address 0x00000000
[ 1849.077871] Faulting instruction address: 0xc0000000000a4000
[ 1849.077889] Oops: Kernel access of bad area, sig: 11 [#1]
[ 1849.077905] LE SMP NR_CPUS=2048 NUMA pSeries
[ 1849.077920] Modules linked in: xt_recent ipt_REJECT nf_reject_ipv4 xt_set iptable_mangle iptable_raw ip_set_hash_ip ip_set_hash_net xt_nat xt_comment veth ipip tunnel4 ip_tunnel xt_multiport xt_mark ip_set ip6_tables rpadlpar_io rpaphp ipt_MASQUERADE nf_nat_masquerade_ipv4 nf_conntrack_netlink nfnetlink sctp_diag sctp iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 xt_addrtype tcp_diag udp_diag inet_diag unix_diag af_packet_diag netlink_diag iptable_filter xt_conntrack nf_nat nf_conntrack br_netfilter bridge stp llc overlay nls_utf8 isofs sg pseries_rng binfmt_misc ip_tables xfs libcrc32c sr_mod cdrom sd_mod ibmvscsi scsi_transport_srp ibmveth dm_mirror dm_region_hash dm_log dm_mod
[ 1849.078125] CPU: 70 PID: 48471 Comm: entrypoint.sh Kdump: loaded Not tainted 4.14.0-115.6.1.el7a.ppc64le #1
[ 1849.078154] task: c000000334a00000 task.stack: c000000331c00000
[ 1849.078171] NIP:  c0000000000a4000 LR: c00000000012f43c CTR: 0000000000000020
[ 1849.078192] REGS: c000000331c039c0 TRAP: 0300   Not tainted  (4.14.0-115.6.1.el7a.ppc64le)
[ 1849.078217] MSR:  800000010280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE,TM[E]>  CR: 44022840  XER: 20040000
[ 1849.078249] CFAR: c000000000008874 DAR: 0000000000000000 DSISR: 42000000 SOFTE: 1
[ 1849.078249] GPR00: 0000000000000020 c000000331c03c40 c0000000014ce100 0000000000000000
[ 1849.078249] GPR04: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[ 1849.078249] GPR08: 000000000000001a c00000000166e230 0000000000000000 0000000000000004
[ 1849.078249] GPR12: 0000000000002000 c000000007a50200 00000000100fa0a8 000000001013b118
[ 1849.078249] GPR16: 0000000000000000 0000010008089120 0000000000000060 0000000000000001
[ 1849.078249] GPR20: 00000000ffffffff c000000001691928 c000000334a00000 0000000000000000
[ 1849.078249] GPR24: 0000000000000000 0000000000000000 0000000000000000 c000000330640000
[ 1849.078249] GPR28: c000000322980000 c00000000143bea8 0000000000000000 c000000322a40000
[ 1849.078467] NIP [c0000000000a4000] memset+0x68/0x104
[ 1849.078483] LR [c00000000012f43c] mm_init+0x27c/0x2f0
[ 1849.078497] Call Trace:
[ 1849.078506] [c000000331c03c40] [c00000000012f420] mm_init+0x260/0x2f0 (unreliable)
[ 1849.078529] [c000000331c03c80] [c0000000001342c4] copy_mm+0x11c/0x638
[ 1849.078550] [c000000331c03d40] [c00000000013105c] copy_process.isra.28.part.29+0x6fc/0x1080
[ 1849.078575] [c000000331c03dc0] [c00000000013292c] _do_fork+0xdc/0x4c0
[ 1849.078596] [c000000331c03e30] [c00000000000b580] ppc_clone+0x8/0xc
[ 1849.078614] Instruction dump:
[ 1849.078624] 409e000c b0860000 38c60002 409d000c 90860000 38c60004 78a0d183 78a506a0
[ 1849.078648] 7c0903a6 41820034 60000000 60420000 <f8860000> f8860008 f8860010 f8860018
[ 1849.078674] ---[ end trace 4005ba72a5a65464 ]---
[ 1849.081449]
[ 1849.081559] Sending IPI to other CPUs
[ 1849.089581] IPI complete
[ 1849.125032] kexec: Starting switchover sequence.


>> Signed-off-by: Rick Lindsley <ricklind@vnet.linux.ibm.com>
>> Fixes: cf266dbcd2a7 ("Zero PGD pages on allocation")
> 
> I don't have that commit. Did you mean:
> 
> Fixes: fc5c2f4a55a2 ("powerpc/mm/hash64: Zero PGD pages on allocation")

Whoops, sorry, yes.

Rick

Re: [PATCH] powerpc/book3s/64: check for NULL pointer in pgd_alloc()

[Michael Ellerman]

On Mon, 2019-05-06 at 00:20:43 UTC, Rick Lindsley wrote:
> When the memset code was added to pgd_alloc(), it failed to consider that kmem_cache_alloc() can return NULL.  It's uncommon, but not impossible under heavy memory contention.
> 
> Signed-off-by: Rick Lindsley <ricklind@vnet.linux.ibm.com>
> Fixes: cf266dbcd2a7 ("Zero PGD pages on allocation")

Applied to powerpc next, thanks.

https://git.kernel.org/powerpc/c/f39356261c265a0689d7ee568132d516

cheers