The __add_zone() maybe call sleep-able init_currently_empty_zone()
to init wait_table,

But this function also modifies the zone_start_pfn without any lock.
It is bugy.

So we move this modification out, and we ensure the modification
of zone_start_pfn is only done with zone_span_writelock() held or in booting.

Since zone_start_pfn is not modified by init_currently_empty_zone()
grow_zone_span() needs to check zone_start_pfn before update it.

CC: Mel Gorman <redacted>
Signed-off-by: Lai Jiangshan <redacted>
Reported-by: Yasuaki ISIMATU <redacted>
Tested-by: Wen Congyang <redacted>
---
  mm/memory_hotplug.c |    2 +-
  mm/page_alloc.c     |    3 +--
  2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index b62d429b..790561f 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c

@@ -205,7 +205,7 @@ static void grow_zone_span(struct zone *zone, unsigned long start_pfn,
  	zone_span_writelock(zone);
  
  	old_zone_end_pfn = zone->zone_start_pfn + zone->spanned_pages;
-	if (start_pfn < zone->zone_start_pfn)
+	if (!zone->zone_start_pfn || start_pfn < zone->zone_start_pfn)
  		zone->zone_start_pfn = start_pfn;
  
  	zone->spanned_pages = max(old_zone_end_pfn, end_pfn) -

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index c13ea75..2545013 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c

@@ -3997,8 +3997,6 @@ int __meminit init_currently_empty_zone(struct zone *zone,
  		return ret;
  	pgdat->nr_zones = zone_idx(zone) + 1;
  
-	zone->zone_start_pfn = zone_start_pfn;
-

  	mminit_dprintk(MMINIT_TRACE, "memmap_init",
  			"Initialising map node %d zone %lu pfns %lu -> %lu\n",
  			pgdat->node_id,

@@ -4465,6 +4463,7 @@ static void __paginginit free_area_init_core(struct pglist_data *pgdat,
  		ret = init_currently_empty_zone(zone, zone_start_pfn,
  						size, MEMMAP_EARLY);
  		BUG_ON(ret);
+		zone->zone_start_pfn = zone_start_pfn;
  		memmap_init(size, nid, j, zone_start_pfn);
  		zone_start_pfn += size;
  	}