From: Thomas Gleixner <tglx@linutronix.de>
To: Tejun Heo <tj@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>, Jiri Slaby <jslaby@suse.cz>,
Petr Mladek <pmladek@suse.com>, Jan Kara <jack@suse.cz>,
Ben Hutchings <ben@decadent.org.uk>,
Sasha Levin <sasha.levin@oracle.com>, Shaohua Li <shli@fb.com>,
LKML <linux-kernel@vger.kernel.org>,
stable@vger.kernel.org, Daniel Bilik <daniel.bilik@neosystem.cz>
Subject: Re: Crashes with 874bbfe600a6 in 3.18.25
Date: Wed, 3 Feb 2016 19:46:11 +0100 (CET) [thread overview]
Message-ID: <alpine.DEB.2.11.1602031940160.25254@nanos> (raw)
In-Reply-To: <20160203162441.GE14091@mtj.duckdns.org>
On Wed, 3 Feb 2016, Tejun Heo wrote:
> On Wed, Feb 03, 2016 at 01:28:56PM +0100, Michal Hocko wrote:
> > > The CPU was 168, and that one was offlined in the meantime. So
> > > __queue_work fails at:
> > > if (!(wq->flags & WQ_UNBOUND))
> > > pwq = per_cpu_ptr(wq->cpu_pwqs, cpu);
> > > else
> > > pwq = unbound_pwq_by_node(wq, cpu_to_node(cpu));
> > > ^^^ ^^^^ NODE is -1
> > > \ pwq is NULL
> > >
> > > if (last_pool && last_pool != pwq->pool) { <--- BOOM
>
> So, the proper fix here is keeping cpu <-> node mapping stable across
> cpu on/offlining which has been being worked on for a long time now.
> The patchst is pending and it fixes other issues too.
>
> > So I think 874bbfe600a6 is really bogus. It should be reverted. We
> > already have a proper fix for vmstat 176bed1de5bf ("vmstat: explicitly
> > schedule per-cpu work on the CPU we need it to run on"). This which
> > should be used for the stable trees as a replacement.
>
> It's not bogus. We can't flip a property that has been guaranteed
> without any provision for verification. Why do you think vmstat blow
> up in the first place? vmstat would be the canary case as it runs
> frequently on all systems. It's exactly the sign that we can't break
> this guarantee willy-nilly.
You're in complete failure denial mode once again.
Fact is:
That patch breaks stuff because there is no stable cpu -> node mapping
accross cpu on/offlining. As a result this selects unbound_pwq_by_node() on
node -1.
The reason why you need to do that work->cpu assignment might be legitimate,
but that does not justify that you expose systems to a lurking out of bounds
access which results in a NULL pointer dereference.
As long as cpu_to_node(cpu) can return -1, we need a sanity check there. And
we need that now and not at some point in the future when the patches
establishing a stable cpu -> node mapping are finished.
Stop arguing around a bug which really exists and was exposed by this patch.
Thanks,
tglx
next prev parent reply other threads:[~2016-02-03 18:47 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-20 21:19 Crashes with 874bbfe600a6 in 3.18.25 Jan Kara
2016-01-20 21:39 ` Shaohua Li
2016-01-21 9:52 ` Jan Kara
2016-01-21 13:29 ` Sasha Levin
2016-01-22 1:10 ` Sasha Levin
2016-01-22 16:09 ` Tejun Heo
2016-01-23 2:20 ` Ben Hutchings
2016-01-23 16:11 ` Thomas Gleixner
2016-01-26 9:34 ` Jan Kara
2016-01-26 9:49 ` Thomas Gleixner
2016-01-26 11:14 ` Petr Mladek
2016-01-26 13:09 ` Thomas Gleixner
2016-02-03 9:35 ` Jiri Slaby
2016-02-03 10:41 ` Thomas Gleixner
2016-02-03 12:28 ` Michal Hocko
2016-02-03 16:24 ` Tejun Heo
2016-02-03 16:48 ` Michal Hocko
2016-02-03 16:59 ` Tejun Heo
2016-02-04 6:37 ` Michal Hocko
2016-02-04 7:40 ` Michal Hocko
2016-02-03 17:01 ` Mike Galbraith
2016-02-03 17:06 ` Tejun Heo
2016-02-03 17:13 ` Mike Galbraith
2016-02-03 17:15 ` Tejun Heo
2016-02-04 2:00 ` Mike Galbraith
2016-02-05 16:49 ` Tejun Heo
2016-02-05 20:47 ` Mike Galbraith
2016-02-05 20:54 ` Tejun Heo
2016-02-05 20:59 ` Mike Galbraith
2016-02-05 21:06 ` Tejun Heo
2016-02-06 13:07 ` Henrique de Moraes Holschuh
2016-02-07 5:19 ` Mike Galbraith
2016-02-07 5:59 ` Mike Galbraith
2016-02-09 15:31 ` Mike Galbraith
2016-02-09 16:39 ` Linus Torvalds
2016-02-09 16:50 ` Tejun Heo
2016-02-09 17:04 ` Mike Galbraith
2016-02-09 17:54 ` Tejun Heo
2016-02-09 17:56 ` Mike Galbraith
2016-02-09 18:02 ` Mike Galbraith
2016-02-09 18:27 ` Tejun Heo
2016-02-09 17:04 ` Linus Torvalds
2016-02-09 17:51 ` Tejun Heo
2016-02-09 18:06 ` Linus Torvalds
2016-02-04 10:04 ` Mike Galbraith
2016-02-04 10:46 ` Thomas Gleixner
2016-02-04 11:07 ` Mike Galbraith
2016-02-04 11:20 ` Jan Kara
2016-02-04 16:39 ` Daniel Bilik
2016-02-05 2:40 ` Mike Galbraith
2016-02-05 8:11 ` Daniel Bilik
2016-02-05 8:33 ` Mike Galbraith
2016-02-03 18:46 ` Thomas Gleixner [this message]
2016-02-03 19:01 ` Tejun Heo
2016-02-03 19:05 ` Thomas Gleixner
2016-02-03 19:15 ` Tejun Heo
2016-02-05 5:44 ` Mike Galbraith
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.11.1602031940160.25254@nanos \
--to=tglx@linutronix.de \
--cc=ben@decadent.org.uk \
--cc=daniel.bilik@neosystem.cz \
--cc=jack@suse.cz \
--cc=jslaby@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=mhocko@kernel.org \
--cc=pmladek@suse.com \
--cc=sasha.levin@oracle.com \
--cc=shli@fb.com \
--cc=stable@vger.kernel.org \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).