linux

mirror of https://github.com/torvalds/linux.git synced 2026-07-28 10:09:10 +02:00

Linux kernel source tree

Go to file

David Chen 462a8e08e0 Fix page corruption caused by racy check in __free_pages When we upgraded our kernel, we started seeing some page corruption like the following consistently: BUG: Bad page state in process ganesha.nfsd pfn:1304ca page:0000000022261c55 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x1304ca flags: 0x17ffffc0000000() raw: 0017ffffc0000000 ffff8a513ffd4c98 ffffeee24b35ec08 0000000000000000 raw: 0000000000000000 0000000000000001 00000000ffffff7f 0000000000000000 page dumped because: nonzero mapcount CPU: 0 PID: 15567 Comm: ganesha.nfsd Kdump: loaded Tainted: P B O 5.10.158-1.nutanix.20221209.el7.x86_64 #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/05/2016 Call Trace: dump_stack+0x74/0x96 bad_page.cold+0x63/0x94 check_new_page_bad+0x6d/0x80 rmqueue+0x46e/0x970 get_page_from_freelist+0xcb/0x3f0 ? _cond_resched+0x19/0x40 __alloc_pages_nodemask+0x164/0x300 alloc_pages_current+0x87/0xf0 skb_page_frag_refill+0x84/0x110 ... Sometimes, it would also show up as corruption in the free list pointer and cause crashes. After bisecting the issue, we found the issue started from commit `e320d3012d` ("mm/page_alloc.c: fix freeing non-compound pages"): if (put_page_testzero(page)) free_the_page(page, order); else if (!PageHead(page)) while (order-- > 0) free_the_page(page + (1 << order), order); So the problem is the check PageHead is racy because at this point we already dropped our reference to the page. So even if we came in with compound page, the page can already be freed and PageHead can return false and we will end up freeing all the tail pages causing double free. Fixes: `e320d3012d` ("mm/page_alloc.c: fix freeing non-compound pages") Link: https://lore.kernel.org/lkml/BYAPR02MB448855960A9656EEA81141FC94D99@BYAPR02MB4488.namprd02.prod.outlook.com/ Cc: Andrew Morton <akpm@linux-foundation.org> Cc: stable@vger.kernel.org Signed-off-by: Chunwei Chen <david.chen@nutanix.com> Reviewed-by: Vlastimil Babka <vbabka@suse.cz> Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2023-02-12 10:30:05 -08:00
arch	Fix a kprobes bug, plus add a new Intel model number to the	2023-02-11 11:17:21 -08:00
block	block-6.2-2023-02-03	2023-02-03 11:35:42 -08:00
certs	certs: Fix build error when PKCS#11 URI contains semicolon	2023-01-31 17:53:01 +09:00
crypto	This update includes the following changes:	2022-12-14 12:31:09 -08:00
Documentation	Networking fixes for 6.2-rc8, including fixes from can and	2023-02-09 09:17:38 -08:00
drivers	spi: Fixes for v6.2	2023-02-11 16:39:05 -08:00
fs	A fix for a pretty embarrassing omission in the session flush handler	2023-02-10 09:04:00 -08:00
include	drm fixes for 6.2-rc8	2023-02-09 17:52:00 -08:00
init	Kbuild fixes for v6.2 (3rd)	2023-01-21 10:56:37 -08:00
io_uring	io_uring: always prep_async for drain requests	2023-01-27 06:29:29 -07:00
ipc	Non-MM patches for 6.2-rc1.	2022-12-12 17:28:58 -08:00
kernel	Fix an rtmutex missed-wakeup bug.	2023-02-11 11:11:18 -08:00
lib	- Lock the proper critical section when dealing with perf event context	2023-02-05 11:03:56 -08:00
LICENSES	LICENSES: Add the copyleft-next-0.3.1 license	2022-11-08 15:44:01 +01:00
mm	Fix page corruption caused by racy check in __free_pages	2023-02-12 10:30:05 -08:00
net	rds: rds_rm_zerocopy_callback() use list_first_entry()	2023-02-09 10:37:26 +01:00
rust	rust: print: avoid evaluating arguments in `pr_*` macros in `unsafe` blocks	2023-01-16 00:54:35 +01:00
samples	ftrace: Export ftrace_free_filter() to modules	2023-01-24 11:20:58 -05:00
scripts	Kbuild fixes for v6.2 (4th)	2023-02-04 11:30:23 -08:00
security	tomoyo: Update website link	2023-01-13 23:11:38 +09:00
sound	sound fixes for 6.2-rc8	2023-02-10 08:37:48 -08:00
tools	Revert "mm: Always release pages to the buddy allocator in memblock_free_late()."	2023-02-11 10:51:45 -08:00
usr	usr/gen_init_cpio.c: remove unnecessary -1 values from int file	2022-10-03 14:21:44 -07:00
virt	VFIO fixes for v6.2-rc6	2023-01-23 11:56:07 -08:00
.clang-format	iommufd for 6.2	2022-12-14 09:15:43 -08:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.get_maintainer.ignore	get_maintainer: add Alan to .get_maintainer.ignore	2022-08-20 15:17:44 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	.gitignore: ignore *.rpm	2022-12-30 17:22:14 +09:00
.mailmap	25 hotfixes, mainly for MM. 13 are cc:stable.	2023-02-03 10:01:57 -08:00
.rustfmt.toml	rust: add `.rustfmt.toml`	2022-09-28 09:02:20 +02:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: update SCTP maintainers	2023-02-02 11:35:33 -08:00
Kbuild	Kbuild updates for v6.1	2022-10-10 12:00:45 -07:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	pci-v6.2-fixes-2	2023-02-10 14:18:48 -08:00
Makefile	Linux 6.2-rc7	2023-02-05 13:13:28 -08:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.