From patchwork Mon Apr 12 22:43:18 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Naoya Horiguchi X-Patchwork-Id: 12198985 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.5 required=3.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN, FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 30375C433ED for ; Mon, 12 Apr 2021 22:43:33 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id CBD206121E for ; Mon, 12 Apr 2021 22:43:32 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org CBD206121E Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 5EC166B006E; Mon, 12 Apr 2021 18:43:32 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 5C3576B0070; Mon, 12 Apr 2021 18:43:32 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 463CD6B0071; Mon, 12 Apr 2021 18:43:32 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0027.hostedemail.com [216.40.44.27]) by kanga.kvack.org (Postfix) with ESMTP id 2B1C26B006E for ; Mon, 12 Apr 2021 18:43:32 -0400 (EDT) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id CA5EA689C for ; Mon, 12 Apr 2021 22:43:31 +0000 (UTC) X-FDA: 78025193022.05.65F0A63 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by imf25.hostedemail.com (Postfix) with ESMTP id 48E3A600010E for ; Mon, 12 Apr 2021 22:43:29 +0000 (UTC) Received: by mail-pj1-f41.google.com with SMTP id e8-20020a17090a7288b029014e51f5a6baso2653748pjg.2 for ; Mon, 12 Apr 2021 15:43:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=JkA3Ny2V6Qq9Dk3aSySw7xYrKKcRmImrxlIoiSgIjQ0=; b=X0R7t1a+/vUebM2KusNVgIyrf8ZQZp4ygxUvDy25rGxEtvJoLMDsHRy7aV1gFRm/wk NM5SL9lNBEg7xDvdaBfI05WJqBVaArAYzFx5PMGvhQ5sEkph/y8LEjcXZStSlTqB2Xej XqaytIGgnAlq2YhnsXpj+uu0h1YWIE2qVUwrtrVWtKn9q9exriujEzk8rvqkz2mOwQuN +9mL+t1FV8qrKEJHe/TBJgLUA+fqpY6vGIjUCQULhxghq2pxhqpGoz6aPe6gILzvEIJ0 msoxnEDFV+G5c0zmVQLP3NhTVz4ca+9EmUwwP3rwHFWLzuxkbdjTnqjPGDcGuBFcDzpp E2DA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=JkA3Ny2V6Qq9Dk3aSySw7xYrKKcRmImrxlIoiSgIjQ0=; b=ldFF3XX9e6ccVDhxOV7FQ+VZ2mmruPXexrqn9tgiiDeq+xYjZO/E3RzxtMQt36x3V/ slrH+1Uz9Px7OycfAlX1ZASEW7GhOBLvAHFNHH8RBzHTGKQsMRbVWvETBBSBg7TrjZFx JQ0UoNOlI8rLVISEXHrBi+etRtZUKjGxRs7fmyUU7NtWD40n4iP8kcml7m8qR28jmc2g Nslj6WWa2yHVKzZO9iidhI4c3jiZt7QRhD3gMRx3wZguIUrcouuRMdUiKBUu2MH9OPWt a5FyES1BQlfNhJNDvD5e+Y0IItVye0b8g0tRjAn9OcPub4FFPlIcIadEHEmuNi/Qaepc Rffg== X-Gm-Message-State: AOAM531vlsV+St/P/rjIKtnN5zJKWSrXnPwZ3drqEhE/Wl5B8sJog4/u DEN2j/lFRXtOhRDKEFvqsznEO5IeNzLbP5U= X-Google-Smtp-Source: ABdhPJykwz0wDYo5DwqyUPL0KJ+J6h8Y3bmJ5iNVsNLoy4vJCeDpgEL+MWPvo4ds3wa3fN4u8f0dXA== X-Received: by 2002:a17:90b:4b8c:: with SMTP id lr12mr1556254pjb.124.1618267410185; Mon, 12 Apr 2021 15:43:30 -0700 (PDT) Received: from localhost.localdomain (h175-177-040-153.catv02.itscom.jp. [175.177.40.153]) by smtp.gmail.com with ESMTPSA id l25sm13365373pgu.72.2021.04.12.15.43.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Apr 2021 15:43:29 -0700 (PDT) From: Naoya Horiguchi To: linux-mm@kvack.org, Tony Luck , Aili Yao Cc: Andrew Morton , Oscar Salvador , David Hildenbrand , Borislav Petkov , Andy Lutomirski , Naoya Horiguchi , linux-kernel@vger.kernel.org Subject: [PATCH v1 1/3] mm/memory-failure: Use a mutex to avoid memory_failure() races Date: Tue, 13 Apr 2021 07:43:18 +0900 Message-Id: <20210412224320.1747638-2-nao.horiguchi@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210412224320.1747638-1-nao.horiguchi@gmail.com> References: <20210412224320.1747638-1-nao.horiguchi@gmail.com> MIME-Version: 1.0 X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 48E3A600010E X-Stat-Signature: 4mp5jmhod1xy9g9379h6t3fexb5y1tu9 Received-SPF: none (gmail.com>: No applicable sender policy available) receiver=imf25; identity=mailfrom; envelope-from=""; helo=mail-pj1-f41.google.com; client-ip=209.85.216.41 X-HE-DKIM-Result: pass/pass X-HE-Tag: 1618267409-62786 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Tony Luck There can be races when multiple CPUs consume poison from the same page. The first into memory_failure() atomically sets the HWPoison page flag and begins hunting for tasks that map this page. Eventually it invalidates those mappings and may send a SIGBUS to the affected tasks. But while all that work is going on, other CPUs see a "success" return code from memory_failure() and so they believe the error has been handled and continue executing. Fix by wrapping most of the internal parts of memory_failure() in a mutex. Signed-off-by: Tony Luck Signed-off-by: Naoya Horiguchi Signed-off-by: Tony Luck Signed-off-by: Naoya Horiguchi --- mm/memory-failure.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git v5.12-rc5/mm/memory-failure.c v5.12-rc5_patched/mm/memory-failure.c index 24210c9bd843..c1509f4b565e 100644 --- v5.12-rc5/mm/memory-failure.c +++ v5.12-rc5_patched/mm/memory-failure.c @@ -1381,6 +1381,8 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags, return rc; } +static DEFINE_MUTEX(mf_mutex); + /** * memory_failure - Handle memory failure of a page. * @pfn: Page Number of the corrupted page @@ -1424,12 +1426,18 @@ int memory_failure(unsigned long pfn, int flags) return -ENXIO; } + mutex_lock(&mf_mutex); + try_again: - if (PageHuge(p)) - return memory_failure_hugetlb(pfn, flags); + if (PageHuge(p)) { + res = memory_failure_hugetlb(pfn, flags); + goto out2; + } + if (TestSetPageHWPoison(p)) { pr_err("Memory failure: %#lx: already hardware poisoned\n", pfn); + mutex_unlock(&mf_mutex); return 0; } @@ -1463,9 +1471,11 @@ int memory_failure(unsigned long pfn, int flags) res = MF_FAILED; } action_result(pfn, MF_MSG_BUDDY, res); + mutex_unlock(&mf_mutex); return res == MF_RECOVERED ? 0 : -EBUSY; } else { action_result(pfn, MF_MSG_KERNEL_HIGH_ORDER, MF_IGNORED); + mutex_unlock(&mf_mutex); return -EBUSY; } } @@ -1473,6 +1483,7 @@ int memory_failure(unsigned long pfn, int flags) if (PageTransHuge(hpage)) { if (try_to_split_thp_page(p, "Memory Failure") < 0) { action_result(pfn, MF_MSG_UNSPLIT_THP, MF_IGNORED); + mutex_unlock(&mf_mutex); return -EBUSY; } VM_BUG_ON_PAGE(!page_count(p), p); @@ -1517,6 +1528,7 @@ int memory_failure(unsigned long pfn, int flags) num_poisoned_pages_dec(); unlock_page(p); put_page(p); + mutex_unlock(&mf_mutex); return 0; } if (hwpoison_filter(p)) { @@ -1524,6 +1536,7 @@ int memory_failure(unsigned long pfn, int flags) num_poisoned_pages_dec(); unlock_page(p); put_page(p); + mutex_unlock(&mf_mutex); return 0; } @@ -1559,6 +1572,8 @@ int memory_failure(unsigned long pfn, int flags) res = identify_page_state(pfn, p, page_flags); out: unlock_page(p); +out2: + mutex_unlock(&mf_mutex); return res; } EXPORT_SYMBOL_GPL(memory_failure);