• Tetsuo Handa's avatar
    mm/page_io.c: fix oops during block io poll in swapin path · b0ba2d0f
    Tetsuo Handa authored
    When a thread is OOM-killed during swap_readpage() operation, an oops
    occurs because end_swap_bio_read() is calling wake_up_process() based on
    an assumption that the thread which called swap_readpage() is still
    alive.
    
      Out of memory: Kill process 525 (polkitd) score 0 or sacrifice child
      Killed process 525 (polkitd) total-vm:528128kB, anon-rss:0kB, file-rss:4kB, shmem-rss:0kB
      oom_reaper: reaped process 525 (polkitd), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB
      general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
      Modules linked in: nf_conntrack_netbios_ns nf_conntrack_broadcast ip6t_rpfilter ipt_REJECT nf_reject_ipv4 ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_raw ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter coretemp ppdev pcspkr vmw_balloon sg shpchp vmw_vmci parport_pc parport i2c_piix4 ip_tables xfs libcrc32c sd_mod sr_mod cdrom ata_generic pata_acpi vmwgfx ahci libahci drm_kms_helper ata_piix syscopyarea sysfillrect sysimgblt fb_sys_fops mptspi scsi_transport_spi ttm e1000 mptscsih drm mptbase i2c_core libata serio_raw
      CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.13.0-rc2-next-20170725 #129
      Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013
      task: ffffffffb7c16500 task.stack: ffffffffb7c00000
      RIP: 0010:__lock_acquire+0x151/0x12f0
      Call Trace:
       <IRQ>
       lock_acquire+0x59/0x80
       _raw_spin_lock_irqsave+0x3b/0x4f
       try_to_wake_up+0x3b/0x410
       wake_up_process+0x10/0x20
       end_swap_bio_read+0x6f/0xf0
       bio_endio+0x92/0xb0
       blk_update_request+0x88/0x270
       scsi_end_request+0x32/0x1c0
       scsi_io_completion+0x209/0x680
       scsi_finish_command+0xd4/0x120
       scsi_softirq_done+0x120/0x140
       __blk_mq_complete_request_remote+0xe/0x10
       flush_smp_call_function_queue+0x51/0x120
       generic_smp_call_function_single_interrupt+0xe/0x20
       smp_trace_call_function_single_interrupt+0x22/0x30
       smp_call_function_single_interrupt+0x9/0x10
       call_function_single_interrupt+0xa7/0xb0
       </IRQ>
      RIP: 0010:native_safe_halt+0x6/0x10
       default_idle+0xe/0x20
       arch_cpu_idle+0xa/0x10
       default_idle_call+0x1e/0x30
       do_idle+0x187/0x200
       cpu_startup_entry+0x6e/0x70
       rest_init+0xd0/0xe0
       start_kernel+0x456/0x477
       x86_64_start_reservations+0x24/0x26
       x86_64_start_kernel+0xf7/0x11a
       secondary_startup_64+0xa5/0xa5
      Code: c3 49 81 3f 20 9e 0b b8 41 bc 00 00 00 00 44 0f 45 e2 83 fe 01 0f 87 62 ff ff ff 89 f0 49 8b 44 c7 08 48 85 c0 0f 84 52 ff ff ff <f0> ff 80 98 01 00 00 8b 3d 5a 49 c4 01 45 8b b3 18 0c 00 00 85
      RIP: __lock_acquire+0x151/0x12f0 RSP: ffffa01f39e03c50
      ---[ end trace 6c441db499169b1e ]---
      Kernel panic - not syncing: Fatal exception in interrupt
      Kernel Offset: 0x36000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
      ---[ end Kernel panic - not syncing: Fatal exception in interrupt
    
    Fix it by holding a reference to the thread.
    
    [akpm@linux-foundation.org: add comment]
    Fixes: 23955622 ("swap: add block io poll in swapin path")
    Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Reviewed-by: default avatarShaohua Li <shli@fb.com>
    Cc: Tim Chen <tim.c.chen@intel.com>
    Cc: Huang Ying <ying.huang@intel.com>
    Cc: Jens Axboe <axboe@fb.com>
    Cc: Hugh Dickins <hughd@google.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    b0ba2d0f
page_io.c 10.1 KB