Minchan Kim 21ea9fb69e virtio_balloon: fix race between migration and ballooning ... In balloon_page_dequeue, pages_lock should cover the loop (ie, list_for_each_entry_safe). Otherwise, the cursor page could be isolated by compaction and then list_del by isolation could poison the page->lru.{prev,next} so the loop finally could access wrong address like this. This patch fixes the bug. general protection fault: 0000 [#1] SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 2 PID: 82 Comm: vballoon Not tainted 4.4.0-rc5-mm1-access_bit+ #1906 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff8800a7ff0000 ti: ffff8800a7fec000 task.ti: ffff8800a7fec000 RIP: 0010:[<ffffffff8115e754>] [<ffffffff8115e754>] balloon_page_dequeue+0x54/0x130 RSP: 0018:ffff8800a7fefdc0 EFLAGS: 00010246 RAX: ffff88013fff9a70 RBX: ffffea000056fe00 RCX: 0000000000002b7d RDX: ffff88013fff9a70 RSI: ffffea000056fe00 RDI: ffff88013fff9a68 RBP: ffff8800a7fefde8 R08: ffffea000056fda0 R09: 0000000000000000 R10: ffff8800a7fefd90 R11: 0000000000000001 R12: dead0000000000e0 R13: ffffea000056fe20 R14: ffff880138809070 R15: ffff880138809060 FS: 0000000000000000(0000) GS:ffff88013fc40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 00007f229c10e000 CR3: 00000000b8b53000 CR4: 00000000000006a0 Stack: 0000000000000100 ffff880138809088 ffff880138809000 ffff880138809060 0000000000000046 ffff8800a7fefe28 ffffffff812c86d3 ffff880138809020 ffff880138809000 fffffffffff91900 0000000000000100 ffff880138809060 Call Trace: [<ffffffff812c86d3>] leak_balloon+0x93/0x1a0 [<ffffffff812c8bc7>] balloon+0x217/0x2a0 [<ffffffff8143739e>] ? __schedule+0x31e/0x8b0 [<ffffffff81078160>] ? abort_exclusive_wait+0xb0/0xb0 [<ffffffff812c89b0>] ? update_balloon_stats+0xf0/0xf0 [<ffffffff8105b6e9>] kthread+0xc9/0xe0 [<ffffffff8105b620>] ? kthread_park+0x60/0x60 [<ffffffff8143b4af>] ret_from_fork+0x3f/0x70 [<ffffffff8105b620>] ? kthread_park+0x60/0x60 Code: 8d 60 e0 0f 84 af 00 00 00 48 8b 43 20 a8 01 75 3b 48 89 d8 f0 0f ba 28 00 72 10 48 8b 03 f6 c4 08 75 2f 48 89 df e8 8c 83 f9 ff <49> 8b 44 24 20 4d 8d 6c 24 20 48 83 e8 20 4d 39 f5 74 7a 4c 89 RIP [<ffffffff8115e754>] balloon_page_dequeue+0x54/0x130 RSP <ffff8800a7fefdc0> ---[ end trace 43cf28060d708d5f ]--- Kernel panic - not syncing: Fatal exception Dumping ftrace buffer: (ftrace buffer empty) Kernel Offset: disabled Cc: <stable@vger.kernel.org> Signed-off-by: Minchan Kim <minchan@kernel.org> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Rafael Aquini <aquini@redhat.com>		2016-01-12 20:47:06 +02:00
..
kasan	kasan: fix kmemleak false-positive in kasan_module_alloc()	2015-11-20 16:17:32 -08:00
backing-dev.c	mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress	2015-12-12 10:15:34 -08:00
balloon_compaction.c	virtio_balloon: fix race between migration and ballooning	2016-01-12 20:47:06 +02:00
bootmem.c	bootmem: avoid freeing to bootmem after bootmem is done	2015-09-08 15:35:28 -07:00
cleancache.c	cleancache: remove limit on the number of cleancache enabled filesystems	2015-04-14 16:49:03 -07:00
cma_debug.c	mm/cma_debug: correct size input to bitmap function	2015-07-17 16:39:54 -07:00
cma.c	mm/cma.c: suppress warning	2015-11-05 19:34:48 -08:00
cma.h	mm: cma: mark cma_bitmap_maxno() inline in header	2015-08-14 15:56:32 -07:00
compaction.c	mm, compaction: distinguish contended status in tracepoints	2015-11-05 19:34:48 -08:00
debug-pagealloc.c	mm/debug-pagealloc: make debug-pagealloc boottime configurable	2014-12-13 12:42:48 -08:00
debug.c	mm: make compound_head() robust	2015-11-06 17:50:42 -08:00
dmapool.c	mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd	2015-11-06 17:50:42 -08:00
early_ioremap.c	mm/early_ioremap: use offset_in_page macro	2015-11-05 19:34:48 -08:00
fadvise.c	writeback: implement and use inode_congested()	2015-06-02 08:33:35 -06:00
failslab.c	mm, page_alloc: rename __GFP_WAIT to __GFP_RECLAIM	2015-11-06 17:50:42 -08:00
filemap.c	mm, fs: introduce mapping_gfp_constraint()	2015-11-06 17:50:42 -08:00
frame_vector.c	mm: fix docbook comment for get_vaddr_frames()	2015-11-05 19:34:48 -08:00
frontswap.c	frontswap: allow multiple backends	2015-06-24 17:49:45 -07:00
gup.c	mm: introduce VM_LOCKONFAULT	2015-11-05 19:34:48 -08:00
highmem.c	mm/highmem: make kmap cache coloring aware	2014-08-06 18:01:22 -07:00
huge_memory.c	mm: loosen MADV_NOHUGEPAGE to enable Qemu postcopy on s390	2015-11-20 16:17:32 -08:00
hugetlb_cgroup.c	mm: make compound_head() robust	2015-11-06 17:50:42 -08:00
hugetlb.c	mm/hugetlb.c: fix resv map memory leak for placeholder entries	2015-12-12 10:15:34 -08:00
hwpoison-inject.c	hwpoison: use page_cgroup_ino for filtering by memcg	2015-09-10 13:29:01 -07:00
init-mm.c
internal.h	mm: use 'unsigned int' for page order	2015-11-06 17:50:42 -08:00
interval_tree.c	mm: replace vma->sharead.linear with vma->shared	2015-02-10 14:30:31 -08:00
Kconfig	mm: make compound_head() robust	2015-11-06 17:50:42 -08:00
Kconfig.debug	mm/debug_pagealloc: remove obsolete Kconfig options	2015-01-08 15:10:52 -08:00
kmemcheck.c	mm/slab_common: move kmem_cache definition to internal header	2014-10-09 22:25:50 -04:00
kmemleak-test.c	mm/kmemleak-test.c: use pr_fmt for logging	2014-06-06 16:08:18 -07:00
kmemleak.c	mm/kmemleak.c: remove unneeded initialization of object to NULL	2015-11-05 19:34:48 -08:00
ksm.c	ksm: unstable_tree_search_insert error checking cleanup	2015-11-05 19:34:48 -08:00
list_lru.c	memcg: simplify and inline __mem_cgroup_from_kmem	2015-11-05 19:34:48 -08:00
maccess.c	mm/maccess.c: actually return -EFAULT from strncpy_from_unsafe	2015-11-05 19:34:48 -08:00
madvise.c	mm: madvise allow remove operation for hugetlbfs	2015-09-08 15:35:28 -07:00
Makefile	media updates for v4.3-rc1	2015-09-11 16:42:39 -07:00
memblock.c	mm/memblock: make memblock_remove_range() static	2015-11-05 19:34:48 -08:00
memcontrol.c	mm: memcontrol: fix possible memcg leak due to interrupted reclaim	2015-12-29 17:45:49 -08:00
memory_hotplug.c	mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone()	2015-12-29 17:45:49 -08:00
memory-failure.c	mm: make compound_head() robust	2015-11-06 17:50:42 -08:00
memory.c	mm, dax: fix DAX deadlocks (COW fault)	2015-11-18 16:54:36 -08:00
mempolicy.c	mm: rename alloc_pages_exact_node() to __alloc_pages_node()	2015-09-08 15:35:28 -07:00
mempool.c	mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd	2015-11-06 17:50:42 -08:00
memtest.c	memtest: remove unused header files	2015-09-08 15:35:28 -07:00
migrate.c	mm, page_alloc: rename __GFP_WAIT to __GFP_RECLAIM	2015-11-06 17:50:42 -08:00
mincore.c	mm/mincore: use offset_in_page macro	2015-11-05 19:34:48 -08:00
mlock.c	mm: mlock: add mlock flags to enable VM_LOCKONFAULT usage	2015-11-05 19:34:48 -08:00
mm_init.c	mm: meminit: remove mminit_verify_page_links	2015-06-30 19:44:56 -07:00
mmap.c	mm: introduce VM_LOCKONFAULT	2015-11-05 19:34:48 -08:00
mmu_context.c	sched/mm: call finish_arch_post_lock_switch in idle_task_exit and use_mm	2014-02-21 08:50:17 +01:00
mmu_notifier.c	mmu-notifier: add clear_young callback	2015-09-10 13:29:01 -07:00
mmzone.c	mm: microoptimize zonelist operations	2015-02-11 17:06:02 -08:00
mprotect.c	userfaultfd: teach vma_merge to merge across vma->vm_userfaultfd_ctx	2015-09-04 16:54:41 -07:00
mremap.c	mm/mremap: use offset_in_page macro	2015-11-05 19:34:48 -08:00
msync.c	mm/msync: use offset_in_page macro	2015-11-05 19:34:48 -08:00
nobootmem.c	mm: page_alloc: pass PFN to __free_pages_bootmem	2015-06-30 19:44:55 -07:00
nommu.c	mm/nommu.c: drop unlikely inside BUG_ON()	2015-11-05 19:34:48 -08:00
oom_kill.c	mm/oom_kill.c: avoid attempting to kill init sharing same memory	2015-12-12 10:15:34 -08:00
page_alloc.c	mm: fix swapped Movable and Reclaimable in /proc/pagetypeinfo	2015-12-12 10:15:34 -08:00
page_counter.c	mm: page_counter: let page_counter_try_charge() return bool	2015-11-05 19:34:48 -08:00
page_ext.c	mm: introduce idle page tracking	2015-09-10 13:29:01 -07:00
page_idle.c	mm: introduce idle page tracking	2015-09-10 13:29:01 -07:00
page_io.c	fs: use helper bio_add_page() instead of open coding on bi_io_vec	2015-08-13 12:32:00 -06:00
page_isolation.c	mm, page_isolation: make set/unset_migratetype_isolate() file-local	2015-09-08 15:35:28 -07:00
page_owner.c	mm/page_owner: set correct gfp_mask on page_owner	2015-07-17 16:39:54 -07:00
page-writeback.c	treewide: Remove old email address	2015-11-23 09:44:58 +01:00
pagewalk.c	mm/pagewalk.c: prevent positive return value of walk_page_test() from being passed to callers	2015-03-25 16:20:30 -07:00
percpu-km.c	percpu: implmeent pcpu_nr_empty_pop_pages and chunk->nr_populated	2014-09-02 14:46:05 -04:00
percpu-vm.c	percpu: move region iterations out of pcpu_[de]populate_chunk()	2014-09-02 14:46:02 -04:00
percpu.c	mm/percpu: use offset_in_page macro	2015-11-05 19:34:48 -08:00
pgtable-generic.c	mm,thp: introduce flush_pmd_tlb_range	2015-10-17 17:48:20 +05:30
process_vm_access.c	process_vm_access: switch to {compat_,}import_iovec()	2015-04-11 22:27:12 -04:00
quicklist.c
readahead.c	mm, fs: introduce mapping_gfp_constraint()	2015-11-06 17:50:42 -08:00
rmap.c	mm: page migration use migration entry for swapcache too	2015-11-05 19:34:48 -08:00
shmem.c	tmpfs: fix shmem_evict_inode() warnings on i_blocks	2015-12-12 10:15:34 -08:00
slab_common.c	slab/slub: adjust kmem_cache_alloc_bulk API	2015-11-22 11:58:44 -08:00
slab.c	slab/slub: adjust kmem_cache_alloc_bulk API	2015-11-22 11:58:44 -08:00
slab.h	slab/slub: adjust kmem_cache_alloc_bulk API	2015-11-22 11:58:44 -08:00
slob.c	slab/slub: adjust kmem_cache_alloc_bulk API	2015-11-22 11:58:44 -08:00
slub.c	slab/slub: adjust kmem_cache_alloc_bulk API	2015-11-22 11:58:44 -08:00
sparse-vmemmap.c	mm/sparse: use memblock apis for early memory allocations	2014-01-21 16:19:47 -08:00
sparse.c	mm: use macros from compiler.h instead of __attribute__((...))	2014-04-07 16:35:54 -07:00
swap_cgroup.c	mm: page_cgroup: rename file to mm/swap_cgroup.c	2014-12-10 17:41:09 -08:00
swap_state.c	mm: swap: zswap: maybe_preload & refactoring	2015-09-08 15:35:28 -07:00
swap.c	mm: make compound_head() robust	2015-11-06 17:50:42 -08:00
swapfile.c	mm: /proc/pid/smaps:: show proportional swap share of the mapping	2015-09-08 15:35:28 -07:00
truncate.c	memcg: add per cgroup dirty page accounting	2015-06-02 08:33:33 -06:00
userfaultfd.c	userfaultfd: avoid mmap_sem read recursion in mcopy_atomic	2015-09-04 16:54:41 -07:00
util.c	mm/util: use offset_in_page macro	2015-11-05 19:34:48 -08:00
vmacache.c	mm/vmacache: inline vmacache_valid_mm()	2015-11-05 19:34:48 -08:00
vmalloc.c	mm: vmalloc: don't remove inexistent guard hole in remove_vm_area()	2015-11-20 16:17:32 -08:00
vmpressure.c	mm/vmpressure.c: fix race in vmpressure_work_fn()	2014-12-02 17:32:07 -08:00
vmscan.c	mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd	2015-11-06 17:50:42 -08:00
vmstat.c	vmstat: allocate vmstat_wq before it is used	2016-01-08 23:47:54 -08:00
workingset.c	list_lru: add helpers to isolate items	2015-02-12 18:54:10 -08:00
zbud.c	mm: zsmalloc: constify struct zs_pool name	2015-11-06 17:50:42 -08:00
zpool.c	mm: zsmalloc: constify struct zs_pool name	2015-11-06 17:50:42 -08:00
zsmalloc.c	zsmalloc: use page->private instead of page->first_page	2015-11-06 17:50:42 -08:00
zswap.c	mm/zswap: change incorrect strncmp use to strcmp	2015-12-18 14:25:40 -08:00