Re: [PATCH 4.4 05/48] mm: fix devm_memremap_pages crash, use mem_hotplug_{begin, done}

From: Ben Hutchings
Date: Thu Feb 09 2017 - 10:29:54 EST

On Wed, 2017-01-18 at 11:46 +0100, Greg Kroah-Hartman wrote:
> 4.4-stable review patch.ÂÂIf anyone has any objections, please let me know.
> ------------------
> From: Dan Williams <dan.j.williams@xxxxxxxxx>
> commit f931ab479dd24cf7a2c6e2df19778406892591fb upstream.
> Both arch_add_memory() and arch_remove_memory() expect a single threaded
> context.
> The result is that two threads calling devm_memremap_pages()
> simultaneously can end up colliding on pgd initialization.ÂÂThis leads
> to crash signatures like the following where the loser of the race
> initializes the wrong pgd entry:
> Hold the standard memory hotplug mutex over calls to
> arch_{add,remove}_memory().

This is not a sufficient fix, because memory_hotplug.c still assumes
there's only one 'writer':

void put_online_mems(void)
if (!--mem_hotplug.refcount && unlikely(mem_hotplug.active_writer))

void mem_hotplug_begin(void)
mem_hotplug.active_writer = current;

for (;;) {
if (likely(!mem_hotplug.refcount))

With multiple writers, one or more of them may hang or
{get,put}_online_mems() mayÂmess up the hotplug reference count.

Is there a good reason that memory_hotplug.c isn't using an rwsem?


Ben Hutchings
All the simple programs have been written, and all the good names

Attachment: signature.asc
Description: This is a digitally signed message part