2010-04-19 13:21:13

by Vitaly Mayatskih

Subject: Fix OOPS in crash_kernel_shrink

Two "echo 0 > /sys/kernel/kexec_crash_size" OOPSes kernel. Also
content of this file is invalid after first shrink to zero: it shows 1
instead of 0.

This patch fixes it.

Signed-off-by: Vitaly Mayatskikh <[email protected]>

diff --git a/kernel/kexec.c b/kernel/kexec.c
index 87ebe8a..474a847 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1134,11 +1134,9 @@ int crash_shrink_memory(unsigned long new_size)

free_reserved_phys_range(end, crashk_res.end);

- if (start == end) {
- crashk_res.end = end;
+ if (start == end)
release_resource(&crashk_res);
- } else
- crashk_res.end = end - 1;
+ crashk_res.end = end - 1;

unlock:
mutex_unlock(&kexec_mutex);

--
wbr, Vitaly

2010-04-20 12:53:06

by Cong Wang

Subject: Re: Fix OOPS in crash_kernel_shrink

Vitaly Mayatskikh wrote:
> Two "echo 0 > /sys/kernel/kexec_crash_size" OOPSes kernel. Also
> content of this file is invalid after first shrink to zero: it shows 1
> instead of 0.
>
> This patch fixes it.

Hmmm, I certainly did tests for 'echo 0 > kexec_crash_size' when I
worked on this, but I didn't get any oops. Can you show me the full
oops?

But yes, the size calculation looks wrong.

>
> Signed-off-by: Vitaly Mayatskikh <[email protected]>
>
> diff --git a/kernel/kexec.c b/kernel/kexec.c
> index 87ebe8a..474a847 100644
> --- a/kernel/kexec.c
> +++ b/kernel/kexec.c
> @@ -1134,11 +1134,9 @@ int crash_shrink_memory(unsigned long new_size)
>
> free_reserved_phys_range(end, crashk_res.end);
>
> - if (start == end) {
> - crashk_res.end = end;
> + if (start == end)
> release_resource(&crashk_res);
> - } else
> - crashk_res.end = end - 1;
> + crashk_res.end = end - 1;
>

If we do this, crashk_res.end will be ahead of crashk.start.

Thanks.

2010-04-20 13:54:53

by Vitaly Mayatskih

Subject: Re: Fix OOPS in crash_kernel_shrink

At Tue, 20 Apr 2010 20:56:14 +0800, Cong Wang wrote:
>
> Vitaly Mayatskikh wrote:
> > Two "echo 0 > /sys/kernel/kexec_crash_size" OOPSes kernel. Also
> > content of this file is invalid after first shrink to zero: it shows 1
> > instead of 0.
> >
> > This patch fixes it.
>
> Hmmm, I certainly did tests for 'echo 0 > kexec_crash_size' when I
> worked on this, but I didn't get any oops. Can you show me the full
> oops?

Do it twice. start == end condition will work over and over, and
kernel will try to release_resource() again (and that's causes OOPS).

This scenario is unlikely to happen often (root privs, valid
crashkernel= in cmdline, dump-capture kernel not loaded), I hit it
only by chance.

--
wbr, Vitaly

2010-04-22 08:26:58

by Cong Wang

Subject: Re: Fix OOPS in crash_kernel_shrink

Vitaly Mayatskikh wrote:
> At Tue, 20 Apr 2010 20:56:14 +0800, Cong Wang wrote:
>> Vitaly Mayatskikh wrote:
>>> Two "echo 0 > /sys/kernel/kexec_crash_size" OOPSes kernel. Also
>>> content of this file is invalid after first shrink to zero: it shows 1
>>> instead of 0.
>>>
>>> This patch fixes it.
>> Hmmm, I certainly did tests for 'echo 0 > kexec_crash_size' when I
>> worked on this, but I didn't get any oops. Can you show me the full
>> oops?
>
> Do it twice. start == end condition will work over and over, and
> kernel will try to release_resource() again (and that's causes OOPS).
>

Hmm, I see. ACK to your patch.

Thanks much!