Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1249742

[PATCH 3.14 25/79] mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 3.14 25/79] mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault
Date 2015-10-18 05:20 +0200
Message-ID <qkMFR-XR-53@gated-at.bofh.it> (permalink)
References <qkMw9-KI-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mel Gorman <mgorman@techsingularity.net>

commit 2f84a8990ebbe235c59716896e017c6b2ca1200f upstream.

SunDong reported the following on

  https://bugzilla.kernel.org/show_bug.cgi?id=103841

	I think I find a linux bug, I have the test cases is constructed. I
	can stable recurring problems in fedora22(4.0.4) kernel version,
	arch for x86_64.  I construct transparent huge page, when the parent
	and child process with MAP_SHARE, MAP_PRIVATE way to access the same
	huge page area, it has the opportunity to lead to huge page copy on
	write failure, and then it will munmap the child corresponding mmap
	area, but then the child mmap area with VM_MAYSHARE attributes, child
	process munmap this area can trigger VM_BUG_ON in set_vma_resv_flags
	functions (vma - > vm_flags & VM_MAYSHARE).

There were a number of problems with the report (e.g.  it's hugetlbfs that
triggers this, not transparent huge pages) but it was fundamentally
correct in that a VM_BUG_ON in set_vma_resv_flags() can be triggered that
looks like this

	 vma ffff8804651fd0d0 start 00007fc474e00000 end 00007fc475e00000
	 next ffff8804651fd018 prev ffff8804651fd188 mm ffff88046b1b1800
	 prot 8000000000000027 anon_vma           (null) vm_ops ffffffff8182a7a0
	 pgoff 0 file ffff88106bdb9800 private_data           (null)
	 flags: 0x84400fb(read|write|shared|mayread|maywrite|mayexec|mayshare|dontexpand|hugetlb)
	 ------------
	 kernel BUG at mm/hugetlb.c:462!
	 SMP
	 Modules linked in: xt_pkttype xt_LOG xt_limit [..]
	 CPU: 38 PID: 26839 Comm: map Not tainted 4.0.4-default #1
	 Hardware name: Dell Inc. PowerEdge R810/0TT6JF, BIOS 2.7.4 04/26/2012
	 set_vma_resv_flags+0x2d/0x30

The VM_BUG_ON is correct because private and shared mappings have
different reservation accounting but the warning clearly shows that the
VMA is shared.

When a private COW fails to allocate a new page then only the process
that created the VMA gets the page -- all the children unmap the page.
If the children access that data in the future then they get killed.

The problem is that the same file is mapped shared and private.  During
the COW, the allocation fails, the VMAs are traversed to unmap the other
private pages but a shared VMA is found and the bug is triggered.  This
patch identifies such VMAs and skips them.

Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Reported-by: SunDong <sund_sky@126.com>
Reviewed-by: Michal Hocko <mhocko@suse.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: David Rientjes <rientjes@google.com>
Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/hugetlb.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2615,6 +2615,14 @@ static int unmap_ref_private(struct mm_s
 			continue;
 
 		/*
+		 * Shared VMAs have their own reserves and do not affect
+		 * MAP_PRIVATE accounting but it is possible that a shared
+		 * VMA is using the same page so check and skip such VMAs.
+		 */
+		if (iter_vma->vm_flags & VM_MAYSHARE)
+			continue;
+
+		/*
 		 * Unmap the page from other VMAs without their own reserves.
 		 * They get marked to be SIGKILLed if they fault in these
 		 * areas. This is because a future no-page fault on this VMA


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 50/79] ipvs: do not use random local source address for tunnels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 69/79] vfs: Test for and handle paths that are unreachable from their mnt_root Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 38/79] netfilter: nf_conntrack: Support expectations in different zones Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 45/79] USB: whiteheat: fix potential null-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 44/79] drm: Reject DRI1 hw lock ioctl functions for kms drivers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 07/79] perf header: Fixup reading of HEADER_NRCPUS feature Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 54/79] regmap: debugfs: Ensure we dont underflow when printing access masks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 08/79] hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 46/79] usb: xhci: Clear XHCI_STATE_DYING on start Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 41/79] disabling oplocks/leases via module parm enable_oplocks broken for SMB3 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 37/79] dm raid: fix round up of default region size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 39/79] netfilter: ctnetlink: put back references to master ct and expect objects Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 63/79] staging: comedi: usbduxsigma: dont clobber ao_timer in command test Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 35/79] staging: ion: fix corruption of ion_import_dma_buf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 49/79] Initialize msg/shm IPC objects before doing ipc_addid() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 70/79] arm64: readahead: fault retry breaks mmap file read random detection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 48/79] usb: xhci: Add support for URB_ZERO_PACKET to bulk/sg transfers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 42/79] drm/qxl: only report first monitor as connected if we have no state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 52/79] cifs: use server timestamp for ntlmv2 authentication Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 68/79] dcache: Handle escaped paths in prepend_path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 65/79] powerpc/MSI: Fix race condition in tearing down MSI interrupts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:10 +0200
  [PATCH 3.14 56/79] security: fix typo in security_task_prctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 34/79] dm btree: add ref counting ops for the leaves of top level btrees Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 13/79] dmaengine: dw: properly read DWC_PARAMS register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 76/79] dm cache: fix NULL pointer when switching from cleaner policy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 36/79] USB: option: add ZTE PIDs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 62/79] staging: comedi: usbduxsigma: dont clobber ai_timer in command test Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 04/79] perf tools: Fix copying of /proc/kcore Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 30/79] ASoC: dwc: correct irq clear method Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 53/79] mtd: pxa3xx_nand: add a default chunk size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 72/79] fib_rules: Fix dump_rules() not to exit early Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 78/79] mm/slab: fix unexpected index mapping result of kmalloc_size(INDEX_NODE+1) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 06/79] perf stat: Get correct cpu id for print_aggr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 58/79] usb: Add device quirk for Logitech PTZ cameras Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 74/79] jbd2: avoid infinite loop when destroying aborted journal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 27/79] ALSA: hda - Apply SPDIF pin ctl to MacBookPro 12,1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 55/79] regmap: debugfs: Dont bother actually printing when calculating max length Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 29/79] ASoC: fix broken pxa SoC support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 59/79] USB: Add reset-resume quirk for two Plantronics usb headphones. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 33/79] Btrfs: update fix for read corruption of compressed and shared extents Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 61/79] arch,hexagon: Convert smp_mb__*() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 57/79] usb: Use the USB_SS_MULT() macro to get the burst multiplier. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 09/79] ARM: fix Thumb2 signal handling when ARMv6 is enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 77/79] staging: speakup: fix speakup-r regression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 05/79] perf hists: Update the column width for the "srcline" sort key Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 32/79] Btrfs: fix read corruption of compressed and shared extents Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 31/79] btrfs: skip waiting on ordered range for special files Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 03/79] iser-target: remove command with state ISTATE_REMOVE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 75/79] clk: ti: fix dual-registration of uart4_ick Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 25/79] mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 71/79] m68k: Define asmlinkage_protect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 60/79] MIPS: dma-default: Fix 32-bit fall back to GFP_DMA Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 28/79] ASoC: pxa: pxa2xx-ac97: fix dma requestor lines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 73/79] genirq: Fix race in register_irq_proc() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:20 +0200
  [PATCH 3.14 10/79] ARM: 8429/1: disable GCC SRA optimization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
  [PATCH 3.14 18/79] Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
  [PATCH 3.14 22/79] sched/core: Fix TASK_DEAD race in finish_task_switch() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
  [PATCH 3.14 14/79] x86/apic: Serialize LVTT and TSC_DEADLINE writes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
  [PATCH 3.14 21/79] x86/xen: Support kexec/kdump in HVM guests by doing a soft reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
  [PATCH 3.14 26/79] ALSA: synth: Fix conflicting OSS device registration on AWE32 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
  [PATCH 3.14 01/79] kvm: fix zero length mmio searching Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
  [PATCH 3.14 20/79] x86/mm: Set NX on gap between __ex_table and rodata Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
  [PATCH 3.14 12/79] ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
  [PATCH 3.14 15/79] x86/platform: Fix Geode LX timekeeping in the generic x86 build Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
  [PATCH 3.14 11/79] windfarm: decrement client count when unregistering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
  [PATCH 3.14 23/79] spi: Fix documentation of spi_alloc_master() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
  [PATCH 3.14 02/79] scsi: fix scsi_error_handler vs. scsi_host_dev_release race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
  [PATCH 3.14 17/79] x86/nmi/64: Fix a paravirt stack-clobbering bug in the NMI code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:30 +0200
  [PATCH 3.14 24/79] spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:50 +0200
  [PATCH 3.14 19/79] x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-18 05:50 +0200
  Re: [PATCH 3.14 00/79] 3.14.55-stable review Guenter Roeck <linux@roeck-us.net> - 2015-10-19 06:20 +0200
    Re: [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-19 17:20 +0200
      Re: [PATCH 3.14 00/79] 3.14.55-stable review Richard Kuo <rkuo@codeaurora.org> - 2015-10-19 21:20 +0200
        Re: [PATCH 3.14 00/79] 3.14.55-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-19 22:10 +0200
          Re: [PATCH 3.14 00/79] 3.14.55-stable review Richard Kuo <rkuo@codeaurora.org> - 2015-10-19 23:40 +0200
  Re: [PATCH 3.14 00/79] 3.14.55-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-10-19 17:30 +0200

csiph-web