[patch v3.6] mm, slab: lock the correct nodelist after reenabling irqs

[David Rientjes <rientjes@xxxxxxxxxx>]

On Tue, 28 Aug 2012, Haggai Eran wrote:

> Hi,
> 
> I believe I have encountered a bug in kernel 3.6-rc3. It starts with the
> assertion in mm/slab.c:2629 failing, and then the system hangs. I can
> reproduce this bug by running a large compilation (compiling the kernel
> for instance).
> 
> Here's what I see in netconsole:
> > ------------[ cut here ]------------
> > kernel BUG at mm/slab.c:2629!
> > invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC
> 
> I'm attaching netconsole logs I got with kernel 3.6-rc1, which contain a
> little more details after the crash, but for some reason netconsole
> didn't capture the full stack trace of the assertion. I caught a glimpse
> at the console and I saw RIP was at cache_alloc_refill.
> 

It only gets called from cache_alloc_refill().

Looks like a problem in 072bb0aa5e0 ("mm: sl[au]b: add knowledge of 
PFMEMALLOC reserve pages").  cache_grow() can reenable irqs which allows 
this to be scheduled on a different cpu, possibly with a different node.  
So it turns out that we lock the wrong node's list_lock because we don't 
check the new node id when irqs are disabled again.

I doubt you can reliably reproduce this, but the following should fix the 
issue.


mm, slab: lock the correct nodelist after reenabling irqs

cache_grow() can reenable irqs so the cpu (and node) can change, so ensure 
that we take list_lock on the correct nodelist.

Fixes an issue with 072bb0aa5e0 ("mm: sl[au]b: add knowledge of PFMEMALLOC 
reserve pages") where list_lock for the wrong node was taken after growing 
the cache.

Reported-by: Haggai Eran <haggaie@xxxxxxxxxxxx>
Signed-off-by: David Rientjes <rientjes@xxxxxxxxxx>
---
 mm/slab.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/slab.c b/mm/slab.c
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -3260,6 +3260,7 @@ force_grow:
 
 		/* cache_grow can reenable interrupts, then ac could change. */
 		ac = cpu_cache_get(cachep);
+		node = numa_mem_id();
 
 		/* no objects in sight? abort */
 		if (!x && (ac->avail == 0 || force_refill))
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/