Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1577692

Re: [PATCH 4.4 05/48] mm: fix devm_memremap_pages crash, use mem_hotplug_{begin, done}

From Ben Hutchings <ben@decadent.org.uk>
Newsgroups linux.kernel
Subject Re: [PATCH 4.4 05/48] mm: fix devm_memremap_pages crash, use mem_hotplug_{begin, done}
Date 2017-02-09 16:30 +0100
Message-ID <t8YPw-7PX-39@gated-at.bofh.it> (permalink)
References <t0VYt-2Rb-7@gated-at.bofh.it> <t0WKR-3x9-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


[Multipart message — attachments visible in raw view] - view raw

On Wed, 2017-01-18 at 11:46 +0100, Greg Kroah-Hartman wrote:
> 4.4-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Dan Williams <dan.j.williams@intel.com>
> 
> commit f931ab479dd24cf7a2c6e2df19778406892591fb upstream.
> 
> Both arch_add_memory() and arch_remove_memory() expect a single threaded
> context.
[...]
> The result is that two threads calling devm_memremap_pages()
> simultaneously can end up colliding on pgd initialization.  This leads
> to crash signatures like the following where the loser of the race
> initializes the wrong pgd entry:
[...]
> Hold the standard memory hotplug mutex over calls to
> arch_{add,remove}_memory().
[...]

This is not a sufficient fix, because memory_hotplug.c still assumes
there's only one 'writer':

void put_online_mems(void)
{
	...
        if (!--mem_hotplug.refcount && unlikely(mem_hotplug.active_writer))
                wake_up_process(mem_hotplug.active_writer);
        ...
}

void mem_hotplug_begin(void)
{
        mem_hotplug.active_writer = current;

        memhp_lock_acquire();
        for (;;) {
                mutex_lock(&mem_hotplug.lock);
                if (likely(!mem_hotplug.refcount))
                        break;
                __set_current_state(TASK_UNINTERRUPTIBLE);
                mutex_unlock(&mem_hotplug.lock);
                schedule();
        }
}

With multiple writers, one or more of them may hang or
{get,put}_online_mems() may mess up the hotplug reference count.

Is there a good reason that memory_hotplug.c isn't using an rwsem?

Ben.

-- 
Ben Hutchings
All the simple programs have been written, and all the good names
taken.

Back to linux.kernel | Previous | NextNext in thread | Find similar | Unroll thread


Thread

Re: [PATCH 4.4 05/48] mm: fix devm_memremap_pages crash, use  mem_hotplug_{begin, done} Ben Hutchings <ben@decadent.org.uk> - 2017-02-09 16:30 +0100
  Re: [PATCH 4.4 05/48] mm: fix devm_memremap_pages crash, use  mem_hotplug_{begin, done} Dan Williams <dan.j.williams@intel.com> - 2017-02-10 06:10 +0100

csiph-web