Re: [PATCH V4] mm: fix kernel crash in khugepaged thread

[Steven Rostedt <rostedt@goodmis.org>]

On Thu, 12 Nov 2015 16:21:02 +0800
yalin wang <yalin.wang2010@gmail.com> wrote:

> This crash is caused by NULL pointer deference, in page_to_pfn() marco,
> when page == NULL :
> 
> [  182.639154 ] Unable to handle kernel NULL pointer dereference at virtual address 00000000


> add the trace point with TP_CONDITION(page),

I wonder if we still want to trace even if page is NULL?

> avoid trace NULL page.
> 
> Signed-off-by: yalin wang <yalin.wang2010@gmail.com>
> ---
>  include/trace/events/huge_memory.h | 20 ++++++++++++--------
>  mm/huge_memory.c                   |  6 +++---
>  2 files changed, 15 insertions(+), 11 deletions(-)
> 
> diff --git a/include/trace/events/huge_memory.h b/include/trace/events/huge_memory.h
> index 11c59ca..727647b 100644
> --- a/include/trace/events/huge_memory.h
> +++ b/include/trace/events/huge_memory.h
> @@ -45,12 +45,14 @@ SCAN_STATUS
>  #define EM(a, b)	{a, b},
>  #define EMe(a, b)	{a, b}
>  
> -TRACE_EVENT(mm_khugepaged_scan_pmd,
> +TRACE_EVENT_CONDITION(mm_khugepaged_scan_pmd,
>  
> -	TP_PROTO(struct mm_struct *mm, unsigned long pfn, bool writable,
> +	TP_PROTO(struct mm_struct *mm, struct page *page, bool writable,
>  		 bool referenced, int none_or_zero, int status, int unmapped),
>  
> -	TP_ARGS(mm, pfn, writable, referenced, none_or_zero, status, unmapped),
> +	TP_ARGS(mm, page, writable, referenced, none_or_zero, status, unmapped),
> +
> +	TP_CONDITION(page),
>  
>  	TP_STRUCT__entry(
>  		__field(struct mm_struct *, mm)
> @@ -64,7 +66,7 @@ TRACE_EVENT(mm_khugepaged_scan_pmd,
>  
>  	TP_fast_assign(
>  		__entry->mm = mm;
> -		__entry->pfn = pfn;
> +		__entry->pfn = page_to_pfn(page);

Instead of the condition, we could have:

	__entry->pfn = page ? page_to_pfn(page) : -1;


But if there's no reason to do the tracepoint if page is NULL, then
this patch is fine. I'm just throwing out this idea.

-- Steve

>  		__entry->writable = writable;
>  		__entry->referenced = referenced;
>  		__entry->none_or_zero = none_or_zero;
> @@ -106,12 +108,14 @@ TRACE_EVENT(mm_collapse_huge_page,
>  		__print_symbolic(__entry->status, SCAN_STATUS))
>  );
>  
> -TRACE_EVENT(mm_collapse_huge_page_isolate,
> +TRACE_EVENT_CONDITION(mm_collapse_huge_page_isolate,
>  
> -	TP_PROTO(unsigned long pfn, int none_or_zero,
> +	TP_PROTO(struct page *page, int none_or_zero,
>  		 bool referenced, bool  writable, int status),
>  
> -	TP_ARGS(pfn, none_or_zero, referenced, writable, status),
> +	TP_ARGS(page, none_or_zero, referenced, writable, status),
> +
> +	TP_CONDITION(page),
>  
>  	TP_STRUCT__entry(
>  		__field(unsigned long, pfn)
\

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>