• Paul Mackerras's avatar
    slab: fix nodeid bounds check for non-contiguous node IDs · 7c3fbbdd
    Paul Mackerras authored
    The bounds check for nodeid in ____cache_alloc_node gives false
    positives on machines where the node IDs are not contiguous, leading to
    a panic at boot time.  For example, on a POWER8 machine the node IDs are
    typically 0, 1, 16 and 17.  This means that num_online_nodes() returns
    4, so when ____cache_alloc_node is called with nodeid = 16 the VM_BUG_ON
    triggers, like this:
    
      kernel BUG at /home/paulus/kernel/kvm/mm/slab.c:3079!
      Call Trace:
        .____cache_alloc_node+0x5c/0x270 (unreliable)
        .kmem_cache_alloc_node_trace+0xdc/0x360
        .init_list+0x3c/0x128
        .kmem_cache_init+0x1dc/0x258
        .start_kernel+0x2a0/0x568
        start_here_common+0x20/0xa8
    
    To fix this, we instead compare the nodeid with MAX_NUMNODES, and
    additionally make sure it isn't negative (since nodeid is an int).  The
    check is there mainly to protect the array dereference in the get_node()
    call in the next line, and the array being dereferenced is of size
    MAX_NUMNODES.  If the nodeid is in range but invalid (for example if the
    node is off-line), the BUG_ON in the next line will catch that.
    
    Fixes: 14e50c6a ("mm: slab: Verify the nodeid passed to ____cache_alloc_node")
    Signed-off-by: default avatarPaul Mackerras <paulus@samba.org>
    Reviewed-by: default avatarYasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
    Reviewed-by: default avatarPekka Enberg <penberg@kernel.org>
    Acked-by: default avatarDavid Rientjes <rientjes@google.com>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    7c3fbbdd
slab.c 107 KB