)]}' { "commit": "fd6db58867924d2bfbc4ece4b0092f697f9fc31c", "tree": "75f387ec7ca87db57b48fa6beb69b3bc5ffcc7da", "parents": [ "f76b1683d16dcd5299a9b67d8ef45fe8d29cb2e6" ], "author": { "name": "Vlastimil Babka", "email": "vbabka@suse.cz", "time": "Sat Oct 11 10:45:41 2025 +0200" }, "committer": { "name": "Vlastimil Babka", "email": "vbabka@suse.cz", "time": "Sat Oct 11 10:47:57 2025 +0200" }, "message": "slab: fix barn NULL pointer dereference on memoryless nodes\n\nPhil reported a boot failure once sheaves become used in commits\n59faa4da7cd4 (\"maple_tree: use percpu sheaves for maple_node_cache\") and\n3accabda4da1 (\"mm, vma: use percpu sheaves for vm_area_struct cache\"):\n\n BUG: kernel NULL pointer dereference, address: 0000000000000040\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP NOPTI\n CPU: 21 UID: 0 PID: 818 Comm: kworker/u398:0 Not tainted 6.17.0-rc3.slab+ #5 PREEMPT(voluntary)\n Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS 1.26.0 07/30/2025\n RIP: 0010:__pcs_replace_empty_main+0x44/0x1d0\n Code: ec 08 48 8b 46 10 48 8b 76 08 48 85 c0 74 0b 8b 48 18 85 c9 0f 85 e5 00 00 00 65 48 63 05 e4 ee 50 02 49 8b 84 c6 e0 00 00 00 \u003c4c\u003e 8b 68 40 4c 89 ef e8 b0 81 ff ff 48 89 c5 48 85 c0 74 1d 48 89\n RSP: 0018:ffffd2d10950bdb0 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: ffff8a775dab74b0 RCX: 00000000ffffffff\n RDX: 0000000000000cc0 RSI: ffff8a6800804000 RDI: ffff8a680004e300\n RBP: ffffd2d10950be40 R08: 0000000000000060 R09: ffffffffb9367388\n R10: 00000000000149e8 R11: ffff8a6f87a38000 R12: 0000000000000cc0\n R13: 0000000000000cc0 R14: ffff8a680004e300 R15: 00000000000000c0\n FS: 0000000000000000(0000) GS:ffff8a77a3541000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000040 CR3: 0000000e1aa24000 CR4: 00000000003506f0\n Call Trace:\n \u003cTASK\u003e\n ? srso_return_thunk+0x5/0x5f\n ? vm_area_alloc+0x1e/0x60\n kmem_cache_alloc_noprof+0x4ec/0x5b0\n vm_area_alloc+0x1e/0x60\n create_init_stack_vma+0x26/0x210\n alloc_bprm+0x139/0x200\n kernel_execve+0x4a/0x140\n call_usermodehelper_exec_async+0xd0/0x190\n ? __pfx_call_usermodehelper_exec_async+0x10/0x10\n ret_from_fork+0xf0/0x110\n ? __pfx_call_usermodehelper_exec_async+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n Modules linked in:\n CR2: 0000000000000040\n ---[ end trace 0000000000000000 ]---\n RIP: 0010:__pcs_replace_empty_main+0x44/0x1d0\n Code: ec 08 48 8b 46 10 48 8b 76 08 48 85 c0 74 0b 8b 48 18 85 c9 0f 85 e5 00 00 00 65 48 63 05 e4 ee 50 02 49 8b 84 c6 e0 00 00 00 \u003c4c\u003e 8b 68 40 4c 89 ef e8 b0 81 ff ff 48 89 c5 48 85 c0 74 1d 48 89\n RSP: 0018:ffffd2d10950bdb0 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: ffff8a775dab74b0 RCX: 00000000ffffffff\n RDX: 0000000000000cc0 RSI: ffff8a6800804000 RDI: ffff8a680004e300\n RBP: ffffd2d10950be40 R08: 0000000000000060 R09: ffffffffb9367388\n R10: 00000000000149e8 R11: ffff8a6f87a38000 R12: 0000000000000cc0\n R13: 0000000000000cc0 R14: ffff8a680004e300 R15: 00000000000000c0\n FS: 0000000000000000(0000) GS:ffff8a77a3541000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000040 CR3: 0000000e1aa24000 CR4: 00000000003506f0\n Kernel panic - not syncing: Fatal exception\n Kernel Offset: 0x36a00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)\n ---[ end Kernel panic - not syncing: Fatal exception ]---\n\nAnd noted \"this is an AMD EPYC 7401 with 8 NUMA nodes configured such\nthat memory is only on 2 of them.\"\n\n # numactl --hardware\n available: 8 nodes (0-7)\n node 0 cpus: 0 8 16 24 32 40 48 56 64 72 80 88\n node 0 size: 0 MB\n node 0 free: 0 MB\n node 1 cpus: 2 10 18 26 34 42 50 58 66 74 82 90\n node 1 size: 31584 MB\n node 1 free: 30397 MB\n node 2 cpus: 4 12 20 28 36 44 52 60 68 76 84 92\n node 2 size: 0 MB\n node 2 free: 0 MB\n node 3 cpus: 6 14 22 30 38 46 54 62 70 78 86 94\n node 3 size: 0 MB\n node 3 free: 0 MB\n node 4 cpus: 1 9 17 25 33 41 49 57 65 73 81 89\n node 4 size: 0 MB\n node 4 free: 0 MB\n node 5 cpus: 3 11 19 27 35 43 51 59 67 75 83 91\n node 5 size: 32214 MB\n node 5 free: 31625 MB\n node 6 cpus: 5 13 21 29 37 45 53 61 69 77 85 93\n node 6 size: 0 MB\n node 6 free: 0 MB\n node 7 cpus: 7 15 23 31 39 47 55 63 71 79 87 95\n node 7 size: 0 MB\n node 7 free: 0 MB\n\nLinus decoded the stacktrace to get_barn() and get_node() and determined\nthat kmem_cache-\u003enode[numa_mem_id()] is NULL.\n\nThe problem is due to a wrong assumption that memoryless nodes only\nexist on systems with CONFIG_HAVE_MEMORYLESS_NODES, where numa_mem_id()\npoints to the nearest node that has memory. SLUB has been allocating its\nkmem_cache_node structures only on nodes with memory and so it does with\nstruct node_barn.\n\nFor kmem_cache_node, get_partial_node() checks if get_node() result is\nnot NULL, which I assumed was for protection from a bogus node id passed\nto kmalloc_node() but apparently it\u0027s also for systems where\nnuma_mem_id() (used when no specific node is given) might return a\nmemoryless node.\n\nFix the sheaves code the same way by checking the result of get_node()\nand bailing out if it\u0027s NULL. Note that cpus on such memoryless nodes\nwill have degraded sheaves performance, which can be improved later,\npreferably by making numa_mem_id() work properly on such systems.\n\nFixes: 2d517aa09bbc (\"slab: add opt-in caching layer of percpu sheaves\")\nReported-and-tested-by: Phil Auld \u003cpauld@redhat.com\u003e\nCloses: https://lore.kernel.org/all/20251010151116.GA436967@pauld.westford.csb/\nAnalyzed-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nLink: https://lore.kernel.org/all/CAHk-%3Dwg1xK%2BBr%3DFJ5QipVhzCvq7uQVPt5Prze6HDhQQ%3DQD_BcQ@mail.gmail.com/\nSigned-off-by: Vlastimil Babka \u003cvbabka@suse.cz\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "135c408e051528389fe4b5952bcdd84f455956d4", "old_mode": 33188, "old_path": "mm/slub.c", "new_id": "b1f15598fbfd2320df7d7f7a306c6a2c311d378e", "new_mode": 33188, "new_path": "mm/slub.c" } ] }