Re: [PATCH 2/3] mm/memory_hotplug: harden try_offline_node against bogus nid

[David Hildenbrand]

On 06.07.20 03:19, Jia He wrote:
> When testing the remove_memory path of dax pmem, there will be a panic with
> call trace:
>   try_remove_memory+0x84/0x170
>   remove_memory+0x38/0x58
>   dev_dax_kmem_remove+0x3c/0x84 [kmem]
>   device_release_driver_internal+0xfc/0x1c8
>   device_release_driver+0x28/0x38
>   bus_remove_device+0xd4/0x158
>   device_del+0x160/0x3a0
>   unregister_dev_dax+0x30/0x68
>   devm_action_release+0x20/0x30
>   release_nodes+0x150/0x240
>   devres_release_all+0x6c/0x1d0
>   device_release_driver_internal+0x10c/0x1c8
>   driver_detach+0xac/0x170
>   bus_remove_driver+0x64/0x130
>   driver_unregister+0x34/0x60
>   dax_pmem_exit+0x14/0xffc4 [dax_pmem]
>   __arm64_sys_delete_module+0x18c/0x2d0
>   el0_svc_common.constprop.2+0x78/0x168
>   do_el0_svc+0x34/0xa0
>   el0_sync_handler+0xe0/0x188
>   el0_sync+0x164/0x180
> 
> It is caused by the bogus nid (-1). Although the root cause is pmem dax
> translates from pxm to node_id incorrectly due to numa_off, it is worth
> hardening the codes in try_offline_node(), quiting if !pgdat.
> 
> Signed-off-by: Jia He <justin.he@xxxxxxx>
> ---
>  mm/memory_hotplug.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
> index da374cd3d45b..e1e290577b45 100644
> --- a/mm/memory_hotplug.c
> +++ b/mm/memory_hotplug.c
> @@ -1680,6 +1680,9 @@ void try_offline_node(int nid)
>  	pg_data_t *pgdat = NODE_DATA(nid);
>  	int rc;
>  
> +	if (WARN_ON(!pgdat))
> +		return;
> +
>  	/*
>  	 * If the node still spans pages (especially ZONE_DEVICE), don't
>  	 * offline it. A node spans memory after move_pfn_range_to_zone(),
> 

Hm. If I am not wrong, somebody used add_memory() with another nid than
try_remove_memory()?

Or did we pass the node_possible(nid) check in add_memory_resource(),
and succeeded to add to nid==-1?

Having that said, this feels somewhat wrong, especially checking against
pgdat down in try_offline_node(). It really has to be the same nid as
used when adding - and that nid has to be sane.

-- 
Thanks,

David / dhildenb