Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1345479 > unrolled thread

[PATCH] mm: __delete_from_page_cache WARN_ON(page_mapped)

Back to article view | Back to linux.kernel

Contents

  [PATCH] mm: __delete_from_page_cache WARN_ON(page_mapped) Hugh Dickins <hughd@google.com> - 2016-02-29 05:50 +0100
    Re: [PATCH] mm: __delete_from_page_cache WARN_ON(page_mapped) Joonsoo Kim <js1304@gmail.com> - 2016-02-29 08:50 +0100
    Re: [PATCH] mm: __delete_from_page_cache WARN_ON(page_mapped) "Kirill A. Shutemov" <kirill@shutemov.name> - 2016-02-29 11:00 +0100
      Re: [PATCH] mm: __delete_from_page_cache WARN_ON(page_mapped) Hugh Dickins <hughd@google.com> - 2016-03-01 07:50 +0100
        [PATCH] mm: __delete_from_page_cache show Bad page if mapped Hugh Dickins <hughd@google.com> - 2016-03-01 07:50 +0100
          Re: [PATCH] mm: __delete_from_page_cache show Bad page if mapped "Kirill A. Shutemov" <kirill@shutemov.name> - 2016-03-01 12:20 +0100

#1345479 — [PATCH] mm: __delete_from_page_cache WARN_ON(page_mapped)

Commit e1534ae95004 ("mm: differentiate page_mapped() from page_mapcount()
for compound pages") changed the famous BUG_ON(page_mapped(page)) in
__delete_from_page_cache() to VM_BUG_ON_PAGE(page_mapped(page)): which
gives us more info when CONFIG_DEBUG_VM=y, but nothing at all when not.

Although it has not usually been very helpul, being hit long after the
error in question, we do need to know if it actually happens on users'
systems; but reinstating a crash there is likely to be opposed :)

In the non-debug case, use WARN_ON() plus dump_page() and add_taint() -
I don't really believe LOCKDEP_NOW_UNRELIABLE, but that seems to be the
standard procedure now.  Move that, or the VM_BUG_ON_PAGE(), up before
the deletion from tree: so that the unNULLified page->mapping gives a
little more information.

If the inode is being evicted (rather than truncated), it won't have
any vmas left, so it's safe(ish) to assume that the raised mapcount is
erroneous, and we can discount it from page_count to avoid leaking the
page (I'm less worried by leaking the occasional 4kB, than losing a
potential 2MB page with each 4kB page leaked).

Signed-off-by: Hugh Dickins <hughd@google.com>
---
I think this should go into v4.5, so I've written it with an atomic_sub
on page->_count; but Joonsoo will probably want some page_ref thingy.

 mm/filemap.c |   22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

--- 4.5-rc6/mm/filemap.c	2016-02-28 09:04:38.816707844 -0800
+++ linux/mm/filemap.c	2016-02-28 19:45:23.406263928 -0800
@@ -195,6 +195,27 @@ void __delete_from_page_cache(struct pag
 	else
 		cleancache_invalidate_page(mapping, page);
 
+	VM_BUG_ON_PAGE(page_mapped(page), page);
+	if (!IS_ENABLED(CONFIG_DEBUG_VM) && WARN_ON(page_mapped(page))) {
+		int mapcount;
+
+		dump_page(page, "still mapped when deleted");
+		add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
+
+		mapcount = page_mapcount(page);
+		if (mapping_exiting(mapping) &&
+		    page_count(page) >= mapcount + 2) {
+			/*
+			 * All vmas have already been torn down, so it's
+			 * a good bet that actually the page is unmapped,
+			 * and we'd prefer not to leak it: if we're wrong,
+			 * some other bad page check should catch it later.
+			 */
+			page_mapcount_reset(page);
+			atomic_sub(mapcount, &page->_count);
+		}
+	}
+
 	page_cache_tree_delete(mapping, page, shadow);
 
 	page->mapping = NULL;
@@ -205,7 +226,6 @@ void __delete_from_page_cache(struct pag
 		__dec_zone_page_state(page, NR_FILE_PAGES);
 	if (PageSwapBacked(page))
 		__dec_zone_page_state(page, NR_SHMEM);
-	VM_BUG_ON_PAGE(page_mapped(page), page);
 
 	/*
 	 * At this point page must be either written or cleaned by truncate.

[toc] | [next] | [standalone]

#1345528

2016-02-29 13:49 GMT+09:00 Hugh Dickins <hughd@google.com>:
> Commit e1534ae95004 ("mm: differentiate page_mapped() from page_mapcount()
> for compound pages") changed the famous BUG_ON(page_mapped(page)) in
> __delete_from_page_cache() to VM_BUG_ON_PAGE(page_mapped(page)): which
> gives us more info when CONFIG_DEBUG_VM=y, but nothing at all when not.
>
> Although it has not usually been very helpul, being hit long after the
> error in question, we do need to know if it actually happens on users'
> systems; but reinstating a crash there is likely to be opposed :)
>
> In the non-debug case, use WARN_ON() plus dump_page() and add_taint() -
> I don't really believe LOCKDEP_NOW_UNRELIABLE, but that seems to be the
> standard procedure now.  Move that, or the VM_BUG_ON_PAGE(), up before
> the deletion from tree: so that the unNULLified page->mapping gives a
> little more information.
>
> If the inode is being evicted (rather than truncated), it won't have
> any vmas left, so it's safe(ish) to assume that the raised mapcount is
> erroneous, and we can discount it from page_count to avoid leaking the
> page (I'm less worried by leaking the occasional 4kB, than losing a
> potential 2MB page with each 4kB page leaked).
>
> Signed-off-by: Hugh Dickins <hughd@google.com>
> ---
> I think this should go into v4.5, so I've written it with an atomic_sub
> on page->_count; but Joonsoo will probably want some page_ref thingy.

Okay. I will do it after this patch is merged.

Thanks for notification.

Thanks.

[toc] | [prev] | [next] | [standalone]

#1345615

On Sun, Feb 28, 2016 at 08:49:10PM -0800, Hugh Dickins wrote:
> Commit e1534ae95004 ("mm: differentiate page_mapped() from page_mapcount()
> for compound pages") changed the famous BUG_ON(page_mapped(page)) in
> __delete_from_page_cache() to VM_BUG_ON_PAGE(page_mapped(page)): which
> gives us more info when CONFIG_DEBUG_VM=y, but nothing at all when not.
> 
> Although it has not usually been very helpul, being hit long after the
> error in question, we do need to know if it actually happens on users'
> systems; but reinstating a crash there is likely to be opposed :)
> 
> In the non-debug case, use WARN_ON() plus dump_page() and add_taint() -
> I don't really believe LOCKDEP_NOW_UNRELIABLE, but that seems to be the
> standard procedure now.

So you put here TAINT_WARN plus TAINT_BAD_PAGE. I guess just the second
would be enough.

We can replace WARN_ON() with plain page_mapped(page), plus dump_stack()
below add_taint().

> Move that, or the VM_BUG_ON_PAGE(), up before
> the deletion from tree: so that the unNULLified page->mapping gives a
> little more information.
> 
> If the inode is being evicted (rather than truncated), it won't have
> any vmas left, so it's safe(ish) to assume that the raised mapcount is
> erroneous, and we can discount it from page_count to avoid leaking the
> page (I'm less worried by leaking the occasional 4kB, than losing a
> potential 2MB page with each 4kB page leaked).
> 
> Signed-off-by: Hugh Dickins <hughd@google.com>

Otherwise,

Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>

> ---
> I think this should go into v4.5, so I've written it with an atomic_sub
> on page->_count; but Joonsoo will probably want some page_ref thingy.
> 
>  mm/filemap.c |   22 +++++++++++++++++++++-
>  1 file changed, 21 insertions(+), 1 deletion(-)
> 
> --- 4.5-rc6/mm/filemap.c	2016-02-28 09:04:38.816707844 -0800
> +++ linux/mm/filemap.c	2016-02-28 19:45:23.406263928 -0800
> @@ -195,6 +195,27 @@ void __delete_from_page_cache(struct pag
>  	else
>  		cleancache_invalidate_page(mapping, page);
>  
> +	VM_BUG_ON_PAGE(page_mapped(page), page);
> +	if (!IS_ENABLED(CONFIG_DEBUG_VM) && WARN_ON(page_mapped(page))) {
> +		int mapcount;
> +
> +		dump_page(page, "still mapped when deleted");
> +		add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
> +
> +		mapcount = page_mapcount(page);
> +		if (mapping_exiting(mapping) &&
> +		    page_count(page) >= mapcount + 2) {
> +			/*
> +			 * All vmas have already been torn down, so it's
> +			 * a good bet that actually the page is unmapped,
> +			 * and we'd prefer not to leak it: if we're wrong,
> +			 * some other bad page check should catch it later.
> +			 */
> +			page_mapcount_reset(page);
> +			atomic_sub(mapcount, &page->_count);
> +		}
> +	}
> +
>  	page_cache_tree_delete(mapping, page, shadow);
>  
>  	page->mapping = NULL;
> @@ -205,7 +226,6 @@ void __delete_from_page_cache(struct pag
>  		__dec_zone_page_state(page, NR_FILE_PAGES);
>  	if (PageSwapBacked(page))
>  		__dec_zone_page_state(page, NR_SHMEM);
> -	VM_BUG_ON_PAGE(page_mapped(page), page);
>  
>  	/*
>  	 * At this point page must be either written or cleaned by truncate.
> 
> --
> To unsubscribe, send a message with 'unsubscribe linux-mm' in
> the body to majordomo@kvack.org.  For more info on Linux MM,
> see: http://www.linux-mm.org/ .
> Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

-- 
 Kirill A. Shutemov

[toc] | [prev] | [next] | [standalone]

#1346398

On Mon, 29 Feb 2016, Kirill A. Shutemov wrote:
> On Sun, Feb 28, 2016 at 08:49:10PM -0800, Hugh Dickins wrote:
> > Commit e1534ae95004 ("mm: differentiate page_mapped() from page_mapcount()
> > for compound pages") changed the famous BUG_ON(page_mapped(page)) in
> > __delete_from_page_cache() to VM_BUG_ON_PAGE(page_mapped(page)): which
> > gives us more info when CONFIG_DEBUG_VM=y, but nothing at all when not.
> > 
> > Although it has not usually been very helpul, being hit long after the
> > error in question, we do need to know if it actually happens on users'
> > systems; but reinstating a crash there is likely to be opposed :)
> > 
> > In the non-debug case, use WARN_ON() plus dump_page() and add_taint() -
> > I don't really believe LOCKDEP_NOW_UNRELIABLE, but that seems to be the
> > standard procedure now.
> 
> So you put here TAINT_WARN plus TAINT_BAD_PAGE. I guess just the second
> would be enough.

You're right, I hadn't thought about the over-tainting at all:
one's enough, yes.

> 
> We can replace WARN_ON() with plain page_mapped(page), plus dump_stack()
> below add_taint().

Okay, I'll post another now, but it does remind me why I used WARN_ON():
that was an easy way of printing a standard format, without having to
think too much.  Now I'm adding a "BUG: Bad page cache" header line to
make it fit in with the "Bad page map" and "Bad page state" messages.

> 
> > Move that, or the VM_BUG_ON_PAGE(), up before
> > the deletion from tree: so that the unNULLified page->mapping gives a
> > little more information.
> > 
> > If the inode is being evicted (rather than truncated), it won't have
> > any vmas left, so it's safe(ish) to assume that the raised mapcount is
> > erroneous, and we can discount it from page_count to avoid leaking the
> > page (I'm less worried by leaking the occasional 4kB, than losing a
> > potential 2MB page with each 4kB page leaked).
> > 
> > Signed-off-by: Hugh Dickins <hughd@google.com>
> 
> Otherwise,
> 
> Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>

Thank you, but since I haven't done it exactly the way you suggest,
I won't assume your Ack carries over to the "Bad page cache" version.

> 
> > ---
> > I think this should go into v4.5, so I've written it with an atomic_sub
> > on page->_count; but Joonsoo will probably want some page_ref thingy.

And thanks to Joonsoo for taking it on board.

Hugh

[toc] | [prev] | [next] | [standalone]

#1346405 — [PATCH] mm: __delete_from_page_cache show Bad page if mapped

Commit e1534ae95004 ("mm: differentiate page_mapped() from page_mapcount()
for compound pages") changed the famous BUG_ON(page_mapped(page)) in
__delete_from_page_cache() to VM_BUG_ON_PAGE(page_mapped(page)): which
gives us more info when CONFIG_DEBUG_VM=y, but nothing at all when not.

Although it has not usually been very helpul, being hit long after the
error in question, we do need to know if it actually happens on users'
systems; but reinstating a crash there is likely to be opposed :)

In the non-debug case, pr_alert("BUG: Bad page cache") plus dump_page(),
dump_stack(), add_taint() - I don't really believe LOCKDEP_NOW_UNRELIABLE,
but that seems to be the standard procedure now.  Move that, or the
VM_BUG_ON_PAGE(), up before the deletion from tree: so that the
unNULLified page->mapping gives a little more information.

If the inode is being evicted (rather than truncated), it won't have
any vmas left, so it's safe(ish) to assume that the raised mapcount is
erroneous, and we can discount it from page_count to avoid leaking the
page (I'm less worried by leaking the occasional 4kB, than losing a
potential 2MB page with each 4kB page leaked).

Signed-off-by: Hugh Dickins <hughd@google.com>
---
I think this should go into v4.5, so I've written it with an atomic_sub
on page->_count; Joonsoo has noticed, and kindly agreed to page_ref'ify
it for mmotm after it's merged.

 mm/filemap.c |   25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

--- 4.5-rc6/mm/filemap.c	2016-02-28 09:04:38.816707844 -0800
+++ linux/mm/filemap.c	2016-02-29 22:04:30.229738939 -0800
@@ -195,6 +195,30 @@ void __delete_from_page_cache(struct pag
 	else
 		cleancache_invalidate_page(mapping, page);
 
+	VM_BUG_ON_PAGE(page_mapped(page), page);
+	if (!IS_ENABLED(CONFIG_DEBUG_VM) && unlikely(page_mapped(page))) {
+		int mapcount;
+
+		pr_alert("BUG: Bad page cache in process %s  pfn:%05lx\n",
+			 current->comm, page_to_pfn(page));
+		dump_page(page, "still mapped when deleted");
+		dump_stack();
+		add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
+
+		mapcount = page_mapcount(page);
+		if (mapping_exiting(mapping) &&
+		    page_count(page) >= mapcount + 2) {
+			/*
+			 * All vmas have already been torn down, so it's
+			 * a good bet that actually the page is unmapped,
+			 * and we'd prefer not to leak it: if we're wrong,
+			 * some other bad page check should catch it later.
+			 */
+			page_mapcount_reset(page);
+			atomic_sub(mapcount, &page->_count);
+		}
+	}
+
 	page_cache_tree_delete(mapping, page, shadow);
 
 	page->mapping = NULL;
@@ -205,7 +229,6 @@ void __delete_from_page_cache(struct pag
 		__dec_zone_page_state(page, NR_FILE_PAGES);
 	if (PageSwapBacked(page))
 		__dec_zone_page_state(page, NR_SHMEM);
-	VM_BUG_ON_PAGE(page_mapped(page), page);
 
 	/*
 	 * At this point page must be either written or cleaned by truncate.

[toc] | [prev] | [next] | [standalone]

#1346534 — Re: [PATCH] mm: __delete_from_page_cache show Bad page if mapped

On Mon, Feb 29, 2016 at 10:45:59PM -0800, Hugh Dickins wrote:
> Commit e1534ae95004 ("mm: differentiate page_mapped() from page_mapcount()
> for compound pages") changed the famous BUG_ON(page_mapped(page)) in
> __delete_from_page_cache() to VM_BUG_ON_PAGE(page_mapped(page)): which
> gives us more info when CONFIG_DEBUG_VM=y, but nothing at all when not.
> 
> Although it has not usually been very helpul, being hit long after the
> error in question, we do need to know if it actually happens on users'
> systems; but reinstating a crash there is likely to be opposed :)
> 
> In the non-debug case, pr_alert("BUG: Bad page cache") plus dump_page(),
> dump_stack(), add_taint() - I don't really believe LOCKDEP_NOW_UNRELIABLE,
> but that seems to be the standard procedure now.  Move that, or the
> VM_BUG_ON_PAGE(), up before the deletion from tree: so that the
> unNULLified page->mapping gives a little more information.
> 
> If the inode is being evicted (rather than truncated), it won't have
> any vmas left, so it's safe(ish) to assume that the raised mapcount is
> erroneous, and we can discount it from page_count to avoid leaking the
> page (I'm less worried by leaking the occasional 4kB, than losing a
> potential 2MB page with each 4kB page leaked).
> 
> Signed-off-by: Hugh Dickins <hughd@google.com>

Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>

-- 
 Kirill A. Shutemov

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web