Commit b943f045 authored by Aneesh Kumar K.V's avatar Aneesh Kumar K.V Committed by Linus Torvalds
Browse files

mm/sparse: fix kernel crash with pfn_section_valid check

Fix the crash like this:

    BUG: Kernel NULL pointer dereference on read at 0x00000000
    Faulting instruction address: 0xc000000000c3447c
    Oops: Kernel access of bad area, sig: 11 [#1]
    LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
    CPU: 11 PID: 7519 Comm: lt-ndctl Not tainted 5.6.0-rc7-autotest #1
    NIP [c000000000c3447c] vmemmap_populated+0x98/0xc0
    LR [c000000000088354] vmemmap_free+0x144/0x320
    Call Trace:

The crash is due to NULL dereference at

	test_bit(idx, ms->usage->subsection_map);

due to ms->usage = NULL in pfn_section_valid()

With commit d41e2f3b ("mm/hotplug: fix hot remove failure in
SPARSEMEM|!VMEMMAP case") section_mem_map is set to NULL after
depopulate_section_mem().  This was done so that pfn_page() can work
correctly with kernel config that disables SPARSEMEM_VMEMMAP.  With that
config pfn_to_page does

	__section_mem_map_addr(__sec) + __pfn;


  static inline struct page *__section_mem_map_addr(struct mem_section *section)
	unsigned long map = section->section_mem_map;
	return (struct page *)map;

Now with SPASEMEM_VMEMAP enabled, mem_section->usage->subsection_map is
used to check the pfn validity (pfn_valid()).  Since section_deactivate
release mem_section->usage if a section is fully deactivated,
pfn_valid() check after a subsection_deactivate cause a kernel crash.

  static inline int pfn_valid(unsigned long pfn)
	return early_section(ms) || pfn_section_valid(ms, pfn);


  static inline int pfn_section_valid(struct mem_section *ms, unsigned long pfn)
	int idx = subsection_map_index(pfn);

	return test_bit(idx, ms->usage->subsection_map);

Avoid this by clearing SECTION_HAS_MEM_MAP when mem_section->usage is
freed.  For architectures like ppc64 where large pages are used for
vmmemap mapping (16MB), a specific vmemmap mapping can cover multiple
sections.  Hence before a vmemmap mapping page can be freed, the kernel
needs to make sure there are no valid sections within that mapping.
Clearing the section valid bit before depopulate_section_memap enables

[ add comment]
Fixes: d41e2f3b

 ("mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case")
Reported-by: default avatarSachin Sant <>
Signed-off-by: default avatarAneesh Kumar K.V <>
Signed-off-by: default avatarAndrew Morton <>
Tested-by: default avatarSachin Sant <>
Reviewed-by: default avatarBaoquan He <>
Reviewed-by: default avatarWei Yang <>
Acked-by: default avatarMichal Hocko <>
Acked-by: default avatarPankaj Gupta <>
Cc: Michael Ellerman <>
Cc: Dan Williams <>
Cc: David Hildenbrand <>
Cc: Oscar Salvador <>
Cc: Mike Rapoport <>
Cc: <>
Signed-off-by: default avatarLinus Torvalds <>
parent 8380ce47
......@@ -781,6 +781,12 @@ static void section_deactivate(unsigned long pfn, unsigned long nr_pages,
ms->usage = NULL;
memmap = sparse_decode_mem_map(ms->section_mem_map, section_nr);
* Mark the section invalid so that valid_section()
* return false. This prevents code from dereferencing
* ms->usage array.
ms->section_mem_map &= ~SECTION_HAS_MEM_MAP;
if (section_is_early && memmap)
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment