diff options
| author | Michal Hocko <mhocko@suse.com> | 2016-01-08 11:18:29 +0100 |
|---|---|---|
| committer | Luis Henriques <luis.henriques@canonical.com> | 2016-01-25 10:43:53 +0000 |
| commit | 77da2b229d4a5c98284ca01dfee31314df153119 (patch) | |
| tree | 903fee92126a320d5fd9f7c2e2358e5b33fc2e66 /mm | |
| parent | 2b5cef7bfd908e3cef8f2d2996915676c0f5687c (diff) | |
| download | lwn-77da2b229d4a5c98284ca01dfee31314df153119.tar.gz lwn-77da2b229d4a5c98284ca01dfee31314df153119.zip | |
vmstat: allocate vmstat_wq before it is used
commit 751e5f5c753e8d447bcf89f9e96b9616ac081628 upstream.
kernel test robot has reported the following crash:
BUG: unable to handle kernel NULL pointer dereference at 00000100
IP: [<c1074df6>] __queue_work+0x26/0x390
*pdpt = 0000000000000000 *pde = f000ff53f000ff53 *pde = f000ff53f000ff53
Oops: 0000 [#1] PREEMPT PREEMPT SMP SMP
CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.4.0-rc4-00139-g373ccbe #1
Workqueue: events vmstat_shepherd
task: cb684600 ti: cb7ba000 task.ti: cb7ba000
EIP: 0060:[<c1074df6>] EFLAGS: 00010046 CPU: 0
EIP is at __queue_work+0x26/0x390
EAX: 00000046 EBX: cbb37800 ECX: cbb37800 EDX: 00000000
ESI: 00000000 EDI: 00000000 EBP: cb7bbe68 ESP: cb7bbe38
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
CR0: 8005003b CR2: 00000100 CR3: 01fd5000 CR4: 000006b0
Stack:
Call Trace:
__queue_delayed_work+0xa1/0x160
queue_delayed_work_on+0x36/0x60
vmstat_shepherd+0xad/0xf0
process_one_work+0x1aa/0x4c0
worker_thread+0x41/0x440
kthread+0xb0/0xd0
ret_from_kernel_thread+0x21/0x40
The reason is that start_shepherd_timer schedules the shepherd work item
which uses vmstat_wq (vmstat_shepherd) before setup_vmstat allocates
that workqueue so if the further initialization takes more than HZ we
might end up scheduling on a NULL vmstat_wq. This is really unlikely
but not impossible.
Fixes: 373ccbe59270 ("mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress")
Reported-by: kernel test robot <ying.huang@linux.intel.com>
Signed-off-by: Michal Hocko <mhocko@suse.com>
Tested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Ben Hutchings <ben@decadent.org.uk>
[ luis: backported to 3.16: based on Ben's backport to 3.2:
- as with 3.2, there's a similar race but with the CPU hotplug code ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Diffstat (limited to 'mm')
| -rw-r--r-- | mm/vmstat.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/mm/vmstat.c b/mm/vmstat.c index 7e913ba2b9e0..038f9418b234 100644 --- a/mm/vmstat.c +++ b/mm/vmstat.c @@ -1305,6 +1305,8 @@ static int __init setup_vmstat(void) #ifdef CONFIG_SMP int cpu; + vmstat_wq = alloc_workqueue("vmstat", WQ_FREEZABLE|WQ_MEM_RECLAIM, 0); + cpu_notifier_register_begin(); __register_cpu_notifier(&vmstat_notifier); @@ -1313,7 +1315,6 @@ static int __init setup_vmstat(void) node_set_state(cpu_to_node(cpu), N_CPU); } cpu_notifier_register_done(); - vmstat_wq = alloc_workqueue("vmstat", WQ_FREEZABLE|WQ_MEM_RECLAIM, 0); #endif #ifdef CONFIG_PROC_FS proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations); |