Jeff Moyer 0f8baa3c98 io-wq: fully initialize wqe before calling cpuhp_state_add_instance_nocalls() ... I received a bug report with the following signature: [ 1759.937637] BUG: unable to handle page fault for address: ffffffffffffffe8 [ 1759.944564] #PF: supervisor read access in kernel mode [ 1759.949732] #PF: error_code(0x0000) - not-present page [ 1759.954901] PGD 7ab615067 P4D 7ab615067 PUD 7ab617067 PMD 0 [ 1759.960596] Oops: 0000 1 PREEMPT SMP PTI [ 1759.964804] CPU: 15 PID: 109 Comm: cpuhp/15 Kdump: loaded Tainted: G X ------- — 5.14.0-362.3.1.el9_3.x86_64 #1 [ 1759.976609] Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 06/20/2018 [ 1759.985181] RIP: 0010:io_wq_for_each_worker.isra.0+0x24/0xa0 [ 1759.990877] Code: 90 90 90 90 90 90 0f 1f 44 00 00 41 56 41 55 41 54 55 48 8d 6f 78 53 48 8b 47 78 48 39 c5 74 4f 49 89 f5 49 89 d4 48 8d 58 e8 <8b> 13 85 d2 74 32 8d 4a 01 89 d0 f0 0f b1 0b 75 5c 09 ca 78 3d 48 [ 1760.009758] RSP: 0000:ffffb6f403603e20 EFLAGS: 00010286 [ 1760.015013] RAX: 0000000000000000 RBX: ffffffffffffffe8 RCX: 0000000000000000 [ 1760.022188] RDX: ffffb6f403603e50 RSI: ffffffffb11e95b0 RDI: ffff9f73b09e9400 [ 1760.029362] RBP: ffff9f73b09e9478 R08: 000000000000000f R09: 0000000000000000 [ 1760.036536] R10: ffffffffffffff00 R11: ffffb6f403603d80 R12: ffffb6f403603e50 [ 1760.043712] R13: ffffffffb11e95b0 R14: ffffffffb28531e8 R15: ffff9f7a6fbdf548 [ 1760.050887] FS: 0000000000000000(0000) GS:ffff9f7a6fbc0000(0000) knlGS:0000000000000000 [ 1760.059025] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1760.064801] CR2: ffffffffffffffe8 CR3: 00000007ab610002 CR4: 00000000007706e0 [ 1760.071976] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1760.079150] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1760.086325] PKRU: 55555554 [ 1760.089044] Call Trace: [ 1760.091501] <TASK> [ 1760.093612] ? show_trace_log_lvl+0x1c4/0x2df [ 1760.097995] ? show_trace_log_lvl+0x1c4/0x2df [ 1760.102377] ? __io_wq_cpu_online+0x54/0xb0 [ 1760.106584] ? __die_body.cold+0x8/0xd [ 1760.110356] ? page_fault_oops+0x134/0x170 [ 1760.114479] ? kernelmode_fixup_or_oops+0x84/0x110 [ 1760.119298] ? exc_page_fault+0xa8/0x150 [ 1760.123247] ? asm_exc_page_fault+0x22/0x30 [ 1760.127458] ? __pfx_io_wq_worker_affinity+0x10/0x10 [ 1760.132453] ? __pfx_io_wq_worker_affinity+0x10/0x10 [ 1760.137446] ? io_wq_for_each_worker.isra.0+0x24/0xa0 [ 1760.142527] __io_wq_cpu_online+0x54/0xb0 [ 1760.146558] cpuhp_invoke_callback+0x109/0x460 [ 1760.151029] ? __pfx_io_wq_cpu_offline+0x10/0x10 [ 1760.155673] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 1760.160320] cpuhp_thread_fun+0x8d/0x140 [ 1760.164266] smpboot_thread_fn+0xd3/0x1a0 [ 1760.168297] kthread+0xdd/0x100 [ 1760.171457] ? __pfx_kthread+0x10/0x10 [ 1760.175225] ret_from_fork+0x29/0x50 [ 1760.178826] </TASK> [ 1760.181022] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs rfkill sunrpc vfat fat dm_multipath intel_rapl_msr intel_rapl_common isst_if_common ipmi_ssif nfit libnvdimm mgag200 i2c_algo_bit ioatdma drm_shmem_helper drm_kms_helper acpi_ipmi syscopyarea x86_pkg_temp_thermal sysfillrect ipmi_si intel_powerclamp sysimgblt ipmi_devintf coretemp acpi_power_meter ipmi_msghandler rapl pcspkr dca intel_pch_thermal intel_cstate ses lpc_ich intel_uncore enclosure hpilo mei_me mei acpi_tad fuse drm xfs sd_mod sg bnx2x nvme nvme_core crct10dif_pclmul crc32_pclmul nvme_common ghash_clmulni_intel smartpqi tg3 t10_pi mdio uas libcrc32c crc32c_intel scsi_transport_sas usb_storage hpwdt wmi dm_mirror dm_region_hash dm_log dm_mod [ 1760.248623] CR2: ffffffffffffffe8 A cpu hotplug callback was issued before wq->all_list was initialized. This results in a null pointer dereference. The fix is to fully setup the io_wq before calling cpuhp_state_add_instance_nocalls(). Signed-off-by: Jeff Moyer <jmoyer@redhat.com> Link: https://lore.kernel.org/r/x49y1ghnecs.fsf@segfault.boston.devel.redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk>		2023-10-05 14:11:18 -06:00
..
Makefile	…
advise.c	io_uring: always go async for unsupported fadvise flags	2023-01-29 15:18:26 -07:00
advise.h	…
alloc_cache.h	io_uring/rsrc: consolidate node caching	2023-04-12 12:09:41 -06:00
cancel.c	io_uring/cancel: wire up IORING_ASYNC_CANCEL_OP for sync cancel	2023-07-17 10:05:48 -06:00
cancel.h	io_uring/cancel: support opcode based lookup and cancelation	2023-07-17 10:05:48 -06:00
epoll.c	io_uring: undeprecate epoll_ctl support	2023-05-26 20:22:41 -06:00
epoll.h	…
fdinfo.c	io_uring/fdinfo: only print ->sq_array[] if it's there	2023-09-01 15:08:29 -06:00
fdinfo.h	…
filetable.c	io_uring: add helpers to decode the fixed file file_ptr	2023-06-20 09:36:22 -06:00
filetable.h	io_uring: add helpers to decode the fixed file file_ptr	2023-06-20 09:36:22 -06:00
fs.c	io_uring/fs: remove sqe->rw_flags checking from LINKAT	2023-09-29 03:07:09 -06:00
fs.h	…
io-wq.c	io-wq: fully initialize wqe before calling cpuhp_state_add_instance_nocalls()	2023-10-05 14:11:18 -06:00
io-wq.h	io_uring: break out of iowq iopoll on teardown	2023-09-07 09:02:27 -06:00
io_uring.c	io_uring: don't allow IORING_SETUP_NO_MMAP rings on highmem pages	2023-10-03 09:59:58 -06:00
io_uring.h	io_uring: ensure io_lockdep_assert_cq_locked() handles disabled rings	2023-10-03 08:12:54 -06:00
kbuf.c	io_uring/kbuf: don't allow registered buffer rings on highmem pages	2023-10-03 08:12:28 -06:00
kbuf.h	io_uring: add support for user mapped provided buffer ring	2023-04-03 07:14:21 -06:00
msg_ring.c	io_uring: use io_file_from_index in io_msg_grab_file	2023-06-20 09:36:22 -06:00
msg_ring.h	io_uring: get rid of double locking	2022-12-07 06:47:13 -07:00
net.c	io_uring/net: fix iter retargeting for selected buf	2023-09-14 10:12:55 -06:00
net.h	io_uring: Add KASAN support for alloc_caches	2023-04-03 07:16:14 -06:00
nop.c	…
nop.h	…
notif.c	io_uring/notif: add constant for ubuf_info flags	2023-04-15 14:21:04 -06:00
notif.h	io_uring/notif: add constant for ubuf_info flags	2023-04-15 14:21:04 -06:00
opdef.c	io_uring: Pass whole sqe to commands	2023-05-04 08:19:05 -06:00
opdef.h	io_uring: Split io_issue_def struct	2023-01-29 15:17:41 -07:00
openclose.c	io_uring: correct check for O_TMPFILE	2023-08-07 12:34:23 -06:00
openclose.h	…
poll.c	io_uring: never overflow io_aux_cqe	2023-08-11 10:42:57 -06:00
poll.h	io_uring: avoid indirect function calls for the hottest task_work	2023-06-02 08:55:37 -06:00
refs.h	…
rsrc.c	io_uring/rsrc: keep one global dummy_ubuf	2023-08-11 10:42:57 -06:00
rsrc.h	io_uring/rsrc: Annotate struct io_mapped_ubuf with __counted_by	2023-08-17 19:14:47 -06:00
rw.c	for-6.6/io_uring-2023-08-28	2023-08-29 20:11:33 -07:00
rw.h	io_uring: avoid indirect function calls for the hottest task_work	2023-06-02 08:55:37 -06:00
slist.h	io_uring: silence variable ‘prev’ set but not used warning	2023-03-09 10:10:58 -07:00
splice.c	io_uring/splice: use fput() directly	2023-08-10 10:24:25 -06:00
splice.h	…
sqpoll.c	io_uring: Don't set affinity on a dying sqpoll thread	2023-08-30 09:53:44 -06:00
sqpoll.h	io_uring/sqpoll: fix io-wq affinity when IORING_SETUP_SQPOLL is used	2023-08-16 13:40:28 -06:00
statx.c	io_uring: for requests that require async, force it	2023-01-29 15:18:26 -07:00
statx.h	…
sync.c	io_uring: for requests that require async, force it	2023-01-29 15:18:26 -07:00
sync.h	…
tctx.c	io_uring: Add io_uring_setup flag to pre-register ring fd and never install it	2023-05-16 08:06:00 -06:00
tctx.h	io_uring: simplify __io_uring_add_tctx_node	2022-10-07 12:25:30 -06:00
timeout.c	io_uring: never overflow io_aux_cqe	2023-08-11 10:42:57 -06:00
timeout.h	…
uring_cmd.c	io_uring: simplify big_cqe handling	2023-08-24 17:16:19 -06:00
uring_cmd.h	io_uring: Remove unnecessary BUILD_BUG_ON	2023-05-04 08:19:05 -06:00
xattr.c	io_uring: for requests that require async, force it	2023-01-29 15:18:26 -07:00
xattr.h	…