From patchwork Tue Aug 4 21:48:07 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Hubbard X-Patchwork-Id: 11701051 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4FBDC13B6 for ; Tue, 4 Aug 2020 21:48:24 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 2B0A72086A for ; Tue, 4 Aug 2020 21:48:24 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=nvidia.com header.i=@nvidia.com header.b="Tq+6LFpl" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 2B0A72086A Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=nvidia.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 12B106B0002; Tue, 4 Aug 2020 17:48:23 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 0D93D6B0005; Tue, 4 Aug 2020 17:48:23 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id F0BBA6B0006; Tue, 4 Aug 2020 17:48:22 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0171.hostedemail.com [216.40.44.171]) by kanga.kvack.org (Postfix) with ESMTP id D7EAD6B0002 for ; Tue, 4 Aug 2020 17:48:22 -0400 (EDT) Received: from smtpin04.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 8ADBE181AEF1A for ; Tue, 4 Aug 2020 21:48:22 +0000 (UTC) X-FDA: 77114225244.04.arch34_2c0caad26fa9 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin04.hostedemail.com (Postfix) with ESMTP id 5C3B0800B66C for ; Tue, 4 Aug 2020 21:48:22 +0000 (UTC) X-Spam-Summary: 1,0,0,,d41d8cd98f00b204,jhubbard@nvidia.com,,RULES_HIT:30012:30054:30064,0,RBL:216.228.121.65:@nvidia.com:.lbl8.mailshell.net-62.18.0.100 64.10.201.10;04y8yxiraf41jisgduo1y1hxje4rsycbwp4zf8oowdjqmb8fbf3grt6tdn9eit4.u8c8g4zbswwy8ks7jj1q5mbadib4q8wrqdzb9hi9aabumajkwfepc541nprxnoq.4-lbl8.mailshell.net-223.238.255.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:ft,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:35,LUA_SUMMARY:none X-HE-Tag: arch34_2c0caad26fa9 X-Filterd-Recvd-Size: 6323 Received: from hqnvemgate26.nvidia.com (hqnvemgate26.nvidia.com [216.228.121.65]) by imf45.hostedemail.com (Postfix) with ESMTP for ; Tue, 4 Aug 2020 21:48:21 +0000 (UTC) Received: from hqpgpgate101.nvidia.com (Not Verified[216.228.121.13]) by hqnvemgate26.nvidia.com (using TLS: TLSv1.2, DES-CBC3-SHA) id ; Tue, 04 Aug 2020 14:48:07 -0700 Received: from hqmail.nvidia.com ([172.20.161.6]) by hqpgpgate101.nvidia.com (PGP Universal service); Tue, 04 Aug 2020 14:48:20 -0700 X-PGP-Universal: processed; by hqpgpgate101.nvidia.com on Tue, 04 Aug 2020 14:48:20 -0700 Received: from HQMAIL109.nvidia.com (172.20.187.15) by HQMAIL107.nvidia.com (172.20.187.13) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 4 Aug 2020 21:48:17 +0000 Received: from hqnvemgw03.nvidia.com (10.124.88.68) by HQMAIL109.nvidia.com (172.20.187.15) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 4 Aug 2020 21:48:16 +0000 Received: from sandstorm.nvidia.com (Not Verified[10.2.56.157]) by hqnvemgw03.nvidia.com with Trustwave SEG (v7,5,8,10121) id ; Tue, 04 Aug 2020 14:48:16 -0700 From: John Hubbard To: Andrew Morton CC: LKML , , , , , , , , "John Hubbard" , "Kirill A . Shutemov" Subject: [PATCH v2] mm, dump_page: do not crash with bad compound_mapcount() Date: Tue, 4 Aug 2020 14:48:07 -0700 Message-ID: <20200804214807.169256-1-jhubbard@nvidia.com> X-Mailer: git-send-email 2.28.0 MIME-Version: 1.0 X-NVConfidentiality: public DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nvidia.com; s=n1; t=1596577687; bh=Ott22dEKyPzKHXaU24WZCFZK+o8PEJC4KK56yLCYqeo=; h=X-PGP-Universal:From:To:CC:Subject:Date:Message-ID:X-Mailer: MIME-Version:X-NVConfidentiality:Content-Transfer-Encoding: Content-Type; b=Tq+6LFplcMvjUhQVmrwLIXDkpFmMsjKL3HrQgxUbvOKyGQ2ZuODKRhrFEh/TF+ilr nIFCSl4VH21pJ7EGs8/im/YXpt5svwNcKq2Gzfg4F5ctdLLTVEsRroigKnKSEN2Kr7 QlKARf1YQ0Cb3ZMpBLENx98L2Nn36PAW3FaJ4LsQU7pCyibfWh+chLvLMpe1JH6cO/ Ha4yAVdj6NezDvMLXZz1qwwUg1Gz0PnAq7YE9fMyFW5d4if7i6QxIqp9vLvwhnNA/u /Xuz6KVF4Dsk+dcF2aM9NkKXqALsIdxfMSM+OE9KgG49keNmYR0i0al9U0fwYEfT6L dr2zIh3nSDQVQ== X-Rspamd-Queue-Id: 5C3B0800B66C X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam05 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: If a compound page is being split while dump_page() is being run on that page, we can end up calling compound_mapcount() on a page that is no longer compound. This leads to a crash (already seen at least once in the field), due to the VM_BUG_ON_PAGE() assertion inside compound_mapcount(). (The above is from Matthew Wilcox's analysis of Qian Cai's bug report.) A similar problem is possible, via compound_pincount() instead of compound_mapcount(). In order to avoid this kind of crash, make dump_page() slightly more robust, by providing a pair of simpler routines that don't contain assertions: head_mapcount() and head_pincount(). For debug tools, we don't want to go *too* far in this direction, but this is a simple small fix, and the crash has already been seen, so it's a good trade-off. Reported-by: Qian Cai Suggested-by: Matthew Wilcox Cc: Vlastimil Babka Cc: Kirill A. Shutemov Signed-off-by: John Hubbard Acked-by: Vlastimil Babka Signed-off-by: Vlastimil Babka --- Hi, I'm assuming that a fix is not required for -stable, but let me know if others feel differently. The dump_page() code has changed a lot in that area. Changes since v1 [1]: 1) Rebased onto mmotm 2) Used a simpler head_*count() approach. 3) Added Matthew's Suggested-by: tag 4) Support pincount as well as mapcount. [1] https://lore.kernel.org/linux-mm/20200804183943.1244828-1-jhubbard@nvidia.com/ thanks, John Hubbard include/linux/mm.h | 14 ++++++++++++-- mm/debug.c | 6 +++--- 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 4f12b2465e80..8ab941cf73f4 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -776,6 +776,11 @@ static inline void *kvcalloc(size_t n, size_t size, gfp_t flags) extern void kvfree(const void *addr); extern void kvfree_sensitive(const void *addr, size_t len); +static inline int head_mapcount(struct page *head) +{ + return atomic_read(compound_mapcount_ptr(head)) + 1; +} + /* * Mapcount of compound page as a whole, does not include mapped sub-pages. * @@ -785,7 +790,7 @@ static inline int compound_mapcount(struct page *page) { VM_BUG_ON_PAGE(!PageCompound(page), page); page = compound_head(page); - return atomic_read(compound_mapcount_ptr(page)) + 1; + return head_mapcount(page); } /* @@ -898,11 +903,16 @@ static inline bool hpage_pincount_available(struct page *page) return PageCompound(page) && compound_order(page) > 1; } +static inline int head_pincount(struct page *head) +{ + return atomic_read(compound_pincount_ptr(head)); +} + static inline int compound_pincount(struct page *page) { VM_BUG_ON_PAGE(!hpage_pincount_available(page), page); page = compound_head(page); - return atomic_read(compound_pincount_ptr(page)); + return head_pincount(page); } static inline void set_compound_order(struct page *page, unsigned int order) diff --git a/mm/debug.c b/mm/debug.c index c27fff1e3ca8..69b60637112b 100644 --- a/mm/debug.c +++ b/mm/debug.c @@ -102,12 +102,12 @@ void __dump_page(struct page *page, const char *reason) if (hpage_pincount_available(page)) { pr_warn("head:%p order:%u compound_mapcount:%d compound_pincount:%d\n", head, compound_order(head), - compound_mapcount(head), - compound_pincount(head)); + head_mapcount(head), + head_pincount(head)); } else { pr_warn("head:%p order:%u compound_mapcount:%d\n", head, compound_order(head), - compound_mapcount(head)); + head_mapcount(head)); } } if (PageKsm(page))