Hi Christoph,

When doing CPU hotplug tests, I got this oops:

[   10.826675] CPU1 attaching NULL sched-domain.
[   10.827421] CPU0 attaching NULL sched-domain.
[   10.831165] BUG: unable to handle kernel paging request at c19d50e4
[   10.832068] IP: [<c11e2149>] __flush_cpu_slab+0x12/0x6e
[   10.832101] *pde = 0231a067 *pte = 019d5162 
[   10.832101] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
[   10.832101] Modules linked in:
[   10.832101] Pid: 459, comm: reboot Not tainted 3.7.0-rc1-00016-gb59d450 #44 Bochs Bochs
[   10.832101] EIP: 0060:[<c11e2149>] EFLAGS: 00010046 CPU: 0
[   10.832101] EIP is at __flush_cpu_slab+0x12/0x6e
[   10.832101] EAX: c19d50e4 EBX: c19d50e4 ECX: 00000006 EDX: 00000001
[   10.832101] ESI: 00000246 EDI: 00000001 EBP: c734ddf0 ESP: c734ddec
[   10.832101]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[   10.832101] CR0: 8005003b CR2: c19d50e4 CR3: 0735b000 CR4: 00000690
[   10.832101] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[   10.832101] DR6: ffff0ff0 DR7: 00000400
[   10.832101] Process reboot (pid: 459, ti=c734c000 task=c7380000 task.ti=c734c000)
[   10.832101] Stack:
[   10.832101]  c19d50e4 c734de04 c155b2ca c1962664 00000000 c19625ec c734de20 c15757a7
[   10.832101]  00000001 00000017 00000001 00000000 00000010 c734de30 c10990e8 fffffff6
[   10.832101]  00000000 c734de40 c105dc62 ffffffff 00000000 c734de4c c105dcd3 00000000
[   10.832101] Call Trace:
[   10.832101]  [<c155b2ca>] slab_cpuup_callback+0x9a/0x158
[   10.832101]  [<c15757a7>] notifier_call_chain+0x46/0x91
[   10.832101]  [<c10990e8>] __raw_notifier_call_chain+0x21/0x31
[   10.832101]  [<c105dc62>] __cpu_notify+0x28/0x79
[   10.832101]  [<c105dcd3>] cpu_notify+0x20/0x30
[   10.832101]  [<c105dcfe>] cpu_notify_nofail+0x1b/0x4d
[   10.832101]  [<c15343bd>] _cpu_down+0x2a2/0x426
[   10.832101]  [<c1560e1a>] ? printk+0x57/0x6a
[   10.832101]  [<c105e47a>] disable_nonboot_cpus+0xc9/0x20c
[   10.832101]  [<c107d0b6>] kernel_restart+0x31/0xb9
[   10.832101]  [<c107d30d>] sys_reboot+0x1a2/0x2f4
[   10.832101]  [<c1158e05>] ? time_hardirqs_off+0x47/0x5a
[   10.832101]  [<c10ade85>] ? local_clock+0x78/0xc7
[   10.832101]  [<c10e1a3f>] ? trace_hardirqs_off_caller+0x34/0x168
[   10.832101]  [<c10e1b9a>] ? trace_hardirqs_off+0x27/0x37
[   10.832101]  [<c10ade85>] ? local_clock+0x78/0xc7
[   10.832101]  [<c10e1ce1>] ? lock_release_holdtime+0xca/0xdd
[   10.832101]  [<c10e8142>] ? lock_release+0x39d/0x46e
[   10.832101]  [<c10973f9>] ? up_read+0x37/0x82
[   10.832101]  [<c157562e>] ? __do_page_fault+0x87d/0x985
[   10.832101]  [<c10e8142>] ? lock_release+0x39d/0x46e
[   10.832101]  [<c156f959>] ? restore_all+0xf/0xf
[   10.832101]  [<c12f45b4>] ? trace_hardirqs_on_thunk+0xc/0x10
[   10.832101]  [<c156f959>] ? restore_all+0xf/0xf
[   10.832101]  [<c1574947>] ? arch_init_optprobes+0xb5/0xb5
[   10.832101]  [<c156f959>] ? restore_all+0xf/0xf
[   10.832101]  [<c1574947>] ? arch_init_optprobes+0xb5/0xb5
[   10.832101]  [<c10e89b9>] ? trace_hardirqs_on_caller+0x291/0x390
[   10.832101]  [<c12f45b4>] ? trace_hardirqs_on_thunk+0xc/0x10
[   10.832101]  [<c157b92a>] sysenter_do_call+0x12/0x3c
[   10.832101] Code: 15 74 6c 1c c2 00 ff 43 04 c7 43 08 00 00 00 00 c7 03 00 00 00 00 5b 5d c3 83 05 38 7b 1c c2 01 55 83 15 3c 7b 1c c2 00 89 e5 53 <8b> 08 89 c3 03 0c 95 b0 78 96 c1 74 4c 83 05 40 7b 1c c2 01 89
[   10.832101] EIP: [<c11e2149>] __flush_cpu_slab+0x12/0x6e SS:ESP 0068:c734ddec
[   10.832101] CR2: 00000000c19d50e4

And it's bisected down to:

commit 911f72e18af709c7ea17f5f2aae29eaf4157bc60
Author: Christoph Lameter <cl@linux.com>
Date:   Fri Oct 19 14:51:48 2012 +0000

    CK2 [03/15] slub: Use a statically allocated kmem_cache boot structure for bootstrap

Thanks,
Fengguang