[linux-next][Oops] memory hot-unplug results fault instruction address at /include/linux/list.h:104

Hi,

Memory hot-unplug on PowerVM LPAR running next-20170911 results in
Faulting instruction address: 0xc0000000002b56c4

which maps to the below code path:

0xc0000000002b56c4 is in __rmqueue (./include/linux/list.h:104).
99	 * This is only for internal list manipulation where we know
100	 * the prev/next entries already!
101	 */
102	static inline void __list_del(struct list_head * prev, struct
list_head * next)
103	{
104		next->prev = prev;
105		WRITE_ONCE(prev->next, next);
106	}
107	
108	/**


Machine Type: Power 8 PowerVM LPAR
Kernel version: 4.13.0-next-20170911
config file : attached 


dmesg logs
---------

Unable to handle kernel paging request for data at address
0x5deadbeef0000108
Faulting instruction address: 0xc0000000002b56c4
Oops: Kernel access of bad area, sig: 11 [#1]
LE SMP NR_CPUS=2048 NUMA pSeries
Modules linked in: xt_addrtype xt_conntrack ipt_MASQUERADE
nf_nat_masquerade_ipv4 iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4
nf_nat_ipv4 iptable_filter ip_tables x_tables nf_nat nf_conntrack bridge
stp llc dm_thin_pool dm_persistent_data dm_bio_prison dm_bufio libcrc32c
rtc_generic vmx_crypto pseries_rng autofs4
CPU: 5 PID: 846 Comm: avocado Not tainted 4.13.0-next-20170911 #1
task: c000000771c02e00 task.stack: c000000771c88000
NIP:  c0000000002b56c4 LR: c0000000002b7738 CTR: c0000000003587b0
REGS: c000000771c8b2c0 TRAP: 0380   Not tainted  (4.13.0-next-20170911)
MSR:  800000010280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE,TM[E]>  CR:
84228828  XER: 20000000  
CFAR: c0000000002b7734 SOFTE: 0 
GPR00: c0000000002b7738 c000000771c8b540 c000000001598a00
0000000000000000 
GPR04: f000000001d2cce0 0000000000000001 5deadbeef0000100
5deadbeef0000200 
GPR08: 5deadbee00000000 c00000077ff54710 0000000000000000
0000000000000060 
GPR12: 0000000024242824 c00000000e743480 000000077eb90000
c00000077fc68978 
GPR16: c00000077ff54600 0000000040000000 0000000000000000
0000000020000000 
GPR20: 0000000000000002 c00000077fc68998 c0000000010d8978
0000000000000000 
GPR24: 0000000000000001 0000000000000040 c00000077ff54600
f000000001d2ccc0 
GPR28: 0000000000000010 0000000000000000 0000000000000001
0000000000000000 
NIP [c0000000002b56c4] __rmqueue+0xd4/0x680
LR [c0000000002b7738] get_page_from_freelist+0x798/0xe30
Call Trace:
[c000000771c8b540] [c000000771c8b570] 0xc000000771c8b570 (unreliable)
[c000000771c8b5f0] [c0000000002b7738] get_page_from_freelist+0x798/0xe30
[c000000771c8b700] [c0000000002b868c] __alloc_pages_nodemask
+0x23c/0x1120
[c000000771c8b8f0] [c000000000358924] new_node_page+0x174/0x200
[c000000771c8b950] [c00000000035f230] migrate_pages+0x2d0/0x1160
[c000000771c8ba30] [c00000000035b2a4] __offline_pages.constprop.6
+0x8c4/0xa80
[c000000771c8bb70] [c0000000007e2288] memory_subsys_offline+0xa8/0x110
[c000000771c8bba0] [c0000000007b4414] device_offline+0x104/0x140
[c000000771c8bbe0] [c0000000007e207c] store_mem_state+0x17c/0x190
[c000000771c8bc20] [c0000000007aea68] dev_attr_store+0x68/0xa0
[c000000771c8bc60] [c0000000004576e0] sysfs_kf_write+0x80/0xb0
[c000000771c8bca0] [c0000000004563ec] kernfs_fop_write+0x17c/0x250
[c000000771c8bcf0] [c00000000039183c] __vfs_write+0x6c/0x230
[c000000771c8bd90] [c000000000391c50] vfs_write+0xd0/0x270
[c000000771c8bde0] [c000000000391fec] SyS_write+0x6c/0x110
[c000000771c8be30] [c00000000000b184] system_call+0x58/0x6c
Instruction dump:
39290100 7c9a482a 7d3a4a14 7fa92040 3764ffe0 419e01d8 41c201d4 3d005dea 
e8e40008 e8c40000 6108dbee 790807c6 <f8e60008> 6508f000 f8c70000
7d094378 
---[ end trace bb48ce522c150b9a ]---
INFO: rcu_sched detected stalls on CPUs/tasks: 
        2-...: (1 GPs behind) idle=80a/140000000000000/0
softirq=1760/1761 fqs=281 
        (detected by 13, t=5280 jiffies, g=3469, c=3468, q=4)

Regard's
Abdul Haleem
IBM Linux Technology Center.