(2014/12/01 7:16), Paul Mackerras wrote:
The bounds check for nodeid in ____cache_alloc_node gives false
positives on machines where the node IDs are not contiguous, leading
to a panic at boot time. For example, on a POWER8 machine the node
IDs are typically 0, 1, 16 and 17. This means that num_online_nodes()
returns 4, so when ____cache_alloc_node is called with nodeid = 16 the
VM_BUG_ON triggers.
Do you have the call trace? If you have it, please add it in the description.
To fix this, we instead compare the nodeid with MAX_NUMNODES, and
additionally make sure it isn't negative (since nodeid is an int).
The check is there mainly to protect the array dereference in the
get_node() call in the next line, and the array being dereferenced is
of size MAX_NUMNODES. If the nodeid is in range but invalid, the
BUG_ON in the next line will catch that.
Signed-off-by: Paul Mackerras <[email protected]>
Do you need to backport it into -stable kernels?
---
diff --git a/mm/slab.c b/mm/slab.c
index eb2b2ea..f34e053 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -3076,7 +3076,7 @@ static void *____cache_alloc_node(struct kmem_cache
*cachep, gfp_t flags,
void *obj;
int x;
- VM_BUG_ON(nodeid > num_online_nodes());
+ VM_BUG_ON(nodeid < 0 || nodeid >= MAX_NUMNODES);
How about use:
VM_BUG_ON(!node_online(nodeid));
When allocating the memory, the node of the memory being allocated must be
online. But your code cannot check the condition.
Thanks,
Yasuaki Ishimatsu
n = get_node(cachep, nodeid);
BUG_ON(!n);
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]";> [email protected] </a>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
