[5.17,112/114] mm/hwpoison: use pr_err() instead of dump_page() in get_any_page()

From: Naoya Horiguchi <naoya.horiguchi@nec.com>

From: Naoya Horiguchi <naoya.horiguchi@nec.com>

commit 1825b93b626e99eb9a0f9f50342c7b2fa201b387 upstream.

The following VM_BUG_ON_FOLIO() is triggered when memory error event
happens on the (thp/folio) pages which are about to be freed:

  [ 1160.232771] page:00000000b36a8a0f refcount:1 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x16a000
  [ 1160.236916] page:00000000b36a8a0f refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x16a000
  [ 1160.240684] flags: 0x57ffffc0800000(hwpoison|node=1|zone=2|lastcpupid=0x1fffff)
  [ 1160.243458] raw: 0057ffffc0800000 dead000000000100 dead000000000122 0000000000000000
  [ 1160.246268] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
  [ 1160.249197] page dumped because: VM_BUG_ON_FOLIO(!folio_test_large(folio))
  [ 1160.251815] ------------[ cut here ]------------
  [ 1160.253438] kernel BUG at include/linux/mm.h:788!
  [ 1160.256162] invalid opcode: 0000 [#1] PREEMPT SMP PTI
  [ 1160.258172] CPU: 2 PID: 115368 Comm: mceinj.sh Tainted: G            E     5.18.0-rc1-v5.18-rc1-220404-2353-005-g83111+ #3
  [ 1160.262049] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 04/01/2014
  [ 1160.265103] RIP: 0010:dump_page.cold+0x27e/0x2bd
  [ 1160.266757] Code: fe ff ff 48 c7 c6 81 f1 5a 98 e9 4c fe ff ff 48 c7 c6 a1 95 59 98 e9 40 fe ff ff 48 c7 c6 50 bf 5a 98 48 89 ef e8 9d 04 6d ff <0f> 0b 41 f7 c4 ff 0f 00 00 0f 85 9f fd ff ff 49 8b 04 24 a9 00 00
  [ 1160.273180] RSP: 0018:ffffaa2c4d59fd18 EFLAGS: 00010292
  [ 1160.274969] RAX: 000000000000003e RBX: 0000000000000001 RCX: 0000000000000000
  [ 1160.277263] RDX: 0000000000000001 RSI: ffffffff985995a1 RDI: 00000000ffffffff
  [ 1160.279571] RBP: ffffdc9c45a80000 R08: 0000000000000000 R09: 00000000ffffdfff
  [ 1160.281794] R10: ffffaa2c4d59fb08 R11: ffffffff98940d08 R12: ffffdc9c45a80000
  [ 1160.283920] R13: ffffffff985b6f94 R14: 0000000000000000 R15: ffffdc9c45a80000
  [ 1160.286641] FS:  00007eff54ce1740(0000) GS:ffff99c67bd00000(0000) knlGS:0000000000000000
  [ 1160.289498] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [ 1160.291106] CR2: 00005628381a5f68 CR3: 0000000104712003 CR4: 0000000000170ee0
  [ 1160.293031] Call Trace:
  [ 1160.293724]  <TASK>
  [ 1160.294334]  get_hwpoison_page+0x47d/0x570
  [ 1160.295474]  memory_failure+0x106/0xaa0
  [ 1160.296474]  ? security_capable+0x36/0x50
  [ 1160.297524]  hard_offline_page_store+0x43/0x80
  [ 1160.298684]  kernfs_fop_write_iter+0x11c/0x1b0
  [ 1160.299829]  new_sync_write+0xf9/0x160
  [ 1160.300810]  vfs_write+0x209/0x290
  [ 1160.301835]  ksys_write+0x4f/0xc0
  [ 1160.302718]  do_syscall_64+0x3b/0x90
  [ 1160.303664]  entry_SYSCALL_64_after_hwframe+0x44/0xae
  [ 1160.304981] RIP: 0033:0x7eff54b018b7

As shown in the RIP address, this VM_BUG_ON in folio_entire_mapcount() is
called from dump_page("hwpoison: unhandlable page") in get_any_page().
The below explains the mechanism of the race:

  CPU 0                                       CPU 1

    memory_failure
      get_hwpoison_page
        get_any_page
          dump_page
            compound = PageCompound
                                                free_pages_prepare
                                                  page->flags &= ~PAGE_FLAGS_CHECK_AT_PREP
            folio_entire_mapcount
              VM_BUG_ON_FOLIO(!folio_test_large(folio))

So replace dump_page() with safer one, pr_err().

Link: https://lkml.kernel.org/r/20220427053220.719866-1-naoya.horiguchi@linux.dev
Fixes: 74e8ee4708a8 ("mm: Turn head_compound_mapcount() into folio_entire_mapcount()")
Signed-off-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Jason Gunthorpe <jgg@nvidia.com>
Cc: William Kucharski <william.kucharski@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/memory-failure.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Message ID	20220516193628.688800703@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Naoya Horiguchi <naoya.horiguchi@nec.com>, John Hubbard <jhubbard@nvidia.com>, Miaohe Lin <linmiaohe@huawei.com>, Matthew Wilcox <willy@infradead.org>, Christoph Hellwig <hch@infradead.org>, Jason Gunthorpe <jgg@nvidia.com>, William Kucharski <william.kucharski@oracle.com>, Andrew Morton <akpm@linux-foundation.org> Subject: [PATCH 5.17 112/114] mm/hwpoison: use pr_err() instead of dump_page() in get_any_page() Date: Mon, 16 May 2022 21:37:26 +0200 Message-Id: <20220516193628.688800703@linuxfoundation.org> In-Reply-To: <20220516193625.489108457@linuxfoundation.org> References: <20220516193625.489108457@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.17,002/114] iwlwifi: iwl-dbg: Use del_timer_sync() before freeing [5.17,003/114] hwmon: (tmp401) Add OF device ID table [5.17,004/114] mac80211: Reset MBSSID parameters upon connection [5.17,005/114] net: rds: use maybe_get_net() when acquiring refcount on TCP sockets [5.17,006/114] net: Fix features skip in for_each_netdev_feature() [5.17,007/114] net: mscc: ocelot: fix last VCAP IS1/IS2 filter persisting in hardware when deleted [5.17,008/114] net: mscc: ocelot: fix VCAP IS2 filters matching on both lookups [5.17,009/114] net: mscc: ocelot: restrict tc-trap actions to VCAP IS2 lookup 0 [5.17,010/114] net: mscc: ocelot: avoid corrupting hardware counters when moving VCAP filters [5.17,011/114] fbdev: simplefb: Cleanup fb_info in .fb_destroy rather than .remove [5.17,012/114] fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove [5.17,013/114] fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove [5.17,014/114] platform/surface: aggregator: Fix initialization order when compiling as builtin m... [5.17,015/114] ice: Fix race during aux device (un)plugging [5.17,016/114] ice: clear stale Tx queue settings before configuring [5.17,017/114] ice: fix PTP stale Tx timestamps cleanup [5.17,018/114] ipv4: drop dst in multicast routing path [5.17,019/114] drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name() [5.17,020/114] netlink: do not reset transport header in netlink_recvmsg() [5.17,021/114] net: chelsio: cxgb4: Avoid potential negative array offset [5.17,022/114] fbdev: efifb: Fix a use-after-free due early fb_info cleanup [5.17,023/114] net: sfc: fix memory leak due to ptp channel [5.17,024/114] fanotify: do not allow setting dirent events in mask of non-dir [5.17,025/114] mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection [5.17,026/114] nfs: fix broken handling of the softreval mount option [5.17,027/114] ionic: fix missing pci_release_regions() on error in ionic_probe() [5.17,028/114] dim: initialize all struct fields [5.17,029/114] hwmon: (ltq-cputemp) restrict it to SOC_XWAY [5.17,030/114] procfs: prevent unprivileged processes accessing fdinfo dir [5.17,031/114] selftests: vm: Makefile: rename TARGETS to VMTARGETS [5.17,032/114] net: dsa: flush switchdev workqueue on bridge join error path [5.17,033/114] arm64: vdso: fix makefile dependency on vdso.so [5.17,034/114] virtio: fix virtio transitional ids [5.17,035/114] s390/ctcm: fix variable dereferenced before check [5.17,036/114] s390/ctcm: fix potential memory leak [5.17,037/114] s390/lcs: fix variable dereferenced before check [5.17,038/114] net/sched: act_pedit: really ensure the skb is writable [5.17,039/114] net: ethernet: mediatek: ppe: fix wrong size passed to memset() [5.17,040/114] net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral [5.17,041/114] drm/vc4: hdmi: Fix build error for implicit function declaration [5.17,042/114] mlxsw: Avoid warning during ip6gre device removal [5.17,043/114] net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down() [5.17,044/114] net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending [5.17,045/114] net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe() [5.17,046/114] tls: Fix context leak on tls_device_down [5.17,047/114] drm/vmwgfx: Fix fencing on SVGAv3 [5.17,048/114] gfs2: Fix filesystem block deallocation for short writes [5.17,049/114] hwmon: (asus_wmi_sensors) Fix CROSSHAIR VI HERO name [5.17,050/114] hwmon: (f71882fg) Fix negative temperature [5.17,051/114] RDMA/irdma: Fix deadlock in irdma_cleanup_cm_core() [5.17,052/114] iommu: arm-smmu: disable large page mappings for Nvidia arm-smmu [5.17,053/114] ASoC: max98090: Reject invalid values in custom control put() [5.17,054/114] ASoC: max98090: Generate notifications on changes for custom control [5.17,055/114] ASoC: ops: Validate input values in snd_soc_put_volsw_range() [5.17,056/114] s390: disable -Warray-bounds [5.17,057/114] ASoC: SOF: Fix NULL pointer exception in sof_pci_probe callback [5.17,058/114] io_uring: assign non-fixed early for async work [5.17,059/114] net: emaclite: Dont advertise 1000BASE-T and do auto negotiation [5.17,060/114] net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT [5.17,061/114] secure_seq: use the 64 bits of the siphash for port offset calculation [5.17,062/114] tcp: use different parts of the port_offset for index and offset [5.17,063/114] tcp: resalt the secret every 10 seconds [5.17,064/114] tcp: add small random increments to the source port [5.17,065/114] tcp: dynamically allocate the perturb table used by source ports [5.17,066/114] tcp: increase source port perturb table to 2^16 [5.17,067/114] tcp: drop the hash_32() part from the index calculation [5.17,068/114] block: Do not call folio_next() on an unreferenced folio [5.17,069/114] interconnect: Restore sync state by ignoring ipa-virt in provider count [5.17,070/114] perf tests: Fix coresight `perf test` failure. [5.17,071/114] firmware_loader: use kernel credentials when reading firmware [5.17,072/114] KVM: PPC: Book3S PR: Enable MSR_DR for switch_mmu_context() [5.17,073/114] usb: xhci-mtk: fix fs isocs transfer error [5.17,074/114] x86/mm: Fix marking of unused sub-pmd ranges [5.17,075/114] tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe() [5.17,076/114] tty: n_gsm: fix buffer over-read in gsm_dlci_data() [5.17,077/114] tty: n_gsm: fix mux activation issues in gsm_config() [5.17,078/114] tty: n_gsm: fix invalid gsmtty_write_room() result [5.17,079/114] usb: gadget: uvc: allow for application to cleanly shutdown [5.17,080/114] usb: cdc-wdm: fix reading stuck on device close [5.17,081/114] usb: typec: tcpci: Dont skip cleanup in .remove() on error [5.17,082/114] usb: typec: tcpci_mt6360: Update for BMC PHY setting [5.17,083/114] USB: serial: pl2303: add device id for HP LM930 Display [5.17,084/114] USB: serial: qcserial: add support for Sierra Wireless EM7590 [5.17,085/114] USB: serial: option: add Fibocom L610 modem [5.17,086/114] USB: serial: option: add Fibocom MA510 modem [5.17,087/114] slimbus: qcom: Fix IRQ check in qcom_slim_probe [5.17,088/114] fsl_lpuart: Dont enable interrupts too early [5.17,089/114] genirq: Remove WARN_ON_ONCE() in generic_handle_domain_irq() [5.17,090/114] serial: 8250_mtk: Fix UART_EFR register address [5.17,091/114] serial: 8250_mtk: Fix register address for XON/XOFF character [5.17,092/114] ceph: fix setting of xattrs on async created inodes [5.17,093/114] Revert "mm/memory-failure.c: skip huge_zero_page in memory_failure()" [5.17,094/114] mm/huge_memory: do not overkill when splitting huge_zero_page [5.17,095/114] mm: mremap: fix sign for EFAULT error return value [5.17,096/114] drm/vmwgfx: Disable command buffers on svga3 without gbobjects [5.17,097/114] drm/nouveau/tegra: Stop using iommu_present() [5.17,098/114] i40e: i40e_main: fix a missing check on list iterator [5.17,099/114] net: atlantic: always deep reset on pm op, fixing up my null deref regression [5.17,100/114] net: phy: Fix race condition on link status change [5.17,101/114] writeback: Avoid skipping inode writeback [5.17,102/114] cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp() [5.17,103/114] ping: fix address binding wrt vrf [5.17,104/114] ath11k: reduce the wait time of 11d scan and hw scan while add interface [5.17,105/114] arm[64]/memremap: dont abuse pfn_valid() to ensure presence of linear map [5.17,106/114] net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061 [5.17,107/114] net: phy: micrel: Pass .probe for KS8737 [5.17,108/114] SUNRPC: Ensure that the gssproxy client can start in a connected state [5.17,109/114] drm/vmwgfx: Initialize drm_mode_fb_cmd2 [5.17,110/114] Revert "drm/amd/pm: keep the BACO feature enabled for suspend" [5.17,111/114] dma-buf: call dma_buf_stats_setup after dmabuf is in valid list [5.17,112/114] mm/hwpoison: use pr_err() instead of dump_page() in get_any_page() [5.17,113/114] net: phy: micrel: Fix incorrect variable type in micrel [5.17,114/114] mm/kfence: reset PG_slab and memcg_data before freeing __kfence_pool

[5.17,112/114] mm/hwpoison: use pr_err() instead of dump_page() in get_any_page()

Commit Message

Patch