generic/320 triggers "list_add attempted on force-poisoned entry" warning on XFS

[Dan Williams]

On Sat, Feb 27, 2016 at 5:02 AM, Eryu Guan <eguan at redhat.com> wrote:
> Hi,
>
> Starting from 4.5-rc1 kernel, I sometimes see generic/320 triggers
> "list_add attempted on force-poisoned entry" warnings on XFS, test hosts
> are arm64/ppc64/ppc64le, haven't seen it on x86_64 hosts.

Hmm, this triggers when a list_head has ->next or ->prev pointing at
the address of force_poison which is only defined in lib/list_debug.c.
The only call site that uses list_force_poison() is in
devm_memremap_pages().  That currently depends on CONFIG_ZONE_DEVICE
which in turn depends on X86_64.

So, this appears to be a false positive and the address of
force_poison is somehow ending up on the stack by accident as that is
the random value being passed in from __down_common:

    struct semaphore_waiter waiter;

    list_add_tail(&waiter.list, &sem->wait_list);

So, I think we need a more unique poison value that should never
appear on the stack:

diff --git a/include/linux/poison.h b/include/linux/poison.h
index 4a27153574e2..0604806c2f52 100644
--- a/include/linux/poison.h
+++ b/include/linux/poison.h
@@ -21,6 +21,7 @@
 */
#define LIST_POISON1  ((void *) 0x100 + POISON_POINTER_DELTA)
#define LIST_POISON2  ((void *) 0x200 + POISON_POINTER_DELTA)
+#define LIST_POISON3  ((void *) 0x500 + POISON_POINTER_DELTA)

/********** include/linux/timer.h **********/
/*
diff --git a/lib/list_debug.c b/lib/list_debug.c
index 3345a089ef7b..318bf1c181b2 100644
--- a/lib/list_debug.c
+++ b/lib/list_debug.c
@@ -12,11 +12,10 @@
#include <linux/kernel.h>
#include <linux/rculist.h>

-static struct list_head force_poison;
void list_force_poison(struct list_head *entry)
{
-       entry->next = &force_poison;
-       entry->prev = &force_poison;
+       entry->next = LIST_POISON3;
+       entry->prev = LIST_POISON3;
}

/*
@@ -30,7 +29,7 @@ void __list_add(struct list_head *new,
                             struct list_head *prev,
                             struct list_head *next)
{
-       WARN(new->next == &force_poison || new->prev == &force_poison,
+       WARN(new->next == LIST_POISON3 || new->prev == LIST_POISON3,
               "list_add attempted on force-poisoned entry\n");
       WARN(next->prev != prev,
               "list_add corruption. next->prev should be "