Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1281228 > unrolled thread
| Started by | "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> |
|---|---|
| First post | 2015-12-01 22:30 +0100 |
| Last post | 2015-12-02 00:50 +0100 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Re: mm: kernel BUG at mm/huge_memory.c:3272! "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> - 2015-12-01 22:30 +0100
Re: mm: kernel BUG at mm/huge_memory.c:3272! Minchan Kim <minchan@kernel.org> - 2015-12-02 00:50 +0100
| From | "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> |
|---|---|
| Date | 2015-12-01 22:30 +0100 |
| Subject | Re: mm: kernel BUG at mm/huge_memory.c:3272! |
| Message-ID | <qB0EO-6zP-33@gated-at.bofh.it> |
On Mon, Nov 30, 2015 at 09:37:33AM -0500, Sasha Levin wrote:
> Hi Kirill,
>
> I've hit the following while fuzzing with trinity on the latest -next kernel:
>
> [ 321.348184] page:ffffea0011a20080 count:1 mapcount:1 mapping:ffff8802d745f601 index:0x1802
> [ 321.350607] flags: 0x320035c00040078(uptodate|dirty|lru|active|swapbacked)
> [ 321.453706] page dumped because: VM_BUG_ON_PAGE(!PageLocked(page))
> [ 321.455353] page->mem_cgroup:ffff880286620000
I think this should help:
From aadc911f047b094c68b350550556dafabf05af13 Mon Sep 17 00:00:00 2001
From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Date: Fri, 20 Nov 2015 12:20:00 +0200
Subject: [PATCH] thp: fix split_huge_page vs. deferred_split_scan race
Minchan[1] and Sasha[2] had reported crash in split_huge_page_to_list()
called from deferred_split_scan() due VM_BUG_ON_PAGE(!PageLocked(page)).
This can happen because race between deferred_split_scan() and
split_huge_page(). The result of the race is that the page can be split
under deferred_split_scan().
The patch prevents this by taking split_queue_lock in
split_huge_page_to_list() when we check if the page can be split.
If the page is suitable for splitting, we remove page from splitting
queue under the same lock, before splitting starts.
[1] http://lkml.kernel.org/g/20151117073539.GB32578@bbox
[2] http://lkml.kernel.org/g/565C5F2D.5060003@oracle.com
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reported-by: Minchan Kim <minchan@kernel.org>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
---
mm/huge_memory.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index dc2b947d4f85..7c0ad4d9110b 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -3186,13 +3186,6 @@ static void __split_huge_page(struct page *page, struct list_head *list)
spin_lock_irq(&zone->lru_lock);
lruvec = mem_cgroup_page_lruvec(head, zone);
- spin_lock(&split_queue_lock);
- if (!list_empty(page_deferred_list(head))) {
- split_queue_len--;
- list_del(page_deferred_list(head));
- }
- spin_unlock(&split_queue_lock);
-
/* complete memcg works before add pages to LRU */
mem_cgroup_split_huge_fixup(head);
@@ -3299,12 +3292,20 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
freeze_page(anon_vma, head);
VM_BUG_ON_PAGE(compound_mapcount(head), head);
+ /* Prevent deferred_split_scan() touching ->_count */
+ spin_lock(&split_queue_lock);
count = page_count(head);
mapcount = total_mapcount(head);
if (mapcount == count - 1) {
+ if (!list_empty(page_deferred_list(head))) {
+ split_queue_len--;
+ list_del(page_deferred_list(head));
+ }
+ spin_unlock(&split_queue_lock);
__split_huge_page(page, list);
ret = 0;
} else if (IS_ENABLED(CONFIG_DEBUG_VM) && mapcount > count - 1) {
+ spin_unlock(&split_queue_lock);
pr_alert("total_mapcount: %u, page_count(): %u\n",
mapcount, count);
if (PageTail(page))
@@ -3312,6 +3313,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
dump_page(page, "total_mapcount(head) > page_count(head) - 1");
BUG();
} else {
+ spin_unlock(&split_queue_lock);
unfreeze_page(anon_vma, head);
ret = -EBUSY;
}
--
2.6.2
--
Kirill A. Shutemov
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [next] | [standalone]
| From | Minchan Kim <minchan@kernel.org> |
|---|---|
| Date | 2015-12-02 00:50 +0100 |
| Message-ID | <qB2Qi-7Sl-15@gated-at.bofh.it> |
| In reply to | #1281228 |
On Tue, Dec 01, 2015 at 11:26:36PM +0200, Kirill A. Shutemov wrote: > On Mon, Nov 30, 2015 at 09:37:33AM -0500, Sasha Levin wrote: > > Hi Kirill, > > > > I've hit the following while fuzzing with trinity on the latest -next kernel: > > > > [ 321.348184] page:ffffea0011a20080 count:1 mapcount:1 mapping:ffff8802d745f601 index:0x1802 > > [ 321.350607] flags: 0x320035c00040078(uptodate|dirty|lru|active|swapbacked) > > [ 321.453706] page dumped because: VM_BUG_ON_PAGE(!PageLocked(page)) > > [ 321.455353] page->mem_cgroup:ffff880286620000 > > I think this should help: > > From aadc911f047b094c68b350550556dafabf05af13 Mon Sep 17 00:00:00 2001 > From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> > Date: Fri, 20 Nov 2015 12:20:00 +0200 > Subject: [PATCH] thp: fix split_huge_page vs. deferred_split_scan race > > Minchan[1] and Sasha[2] had reported crash in split_huge_page_to_list() > called from deferred_split_scan() due VM_BUG_ON_PAGE(!PageLocked(page)). > > This can happen because race between deferred_split_scan() and > split_huge_page(). The result of the race is that the page can be split > under deferred_split_scan(). > > The patch prevents this by taking split_queue_lock in > split_huge_page_to_list() when we check if the page can be split. > If the page is suitable for splitting, we remove page from splitting > queue under the same lock, before splitting starts. > > [1] http://lkml.kernel.org/g/20151117073539.GB32578@bbox > [2] http://lkml.kernel.org/g/565C5F2D.5060003@oracle.com > > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> > Reported-by: Minchan Kim <minchan@kernel.org> > Reported-by: Sasha Levin <sasha.levin@oracle.com> With this, I cannot reprocude the error. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web