From patchwork Tue May 11 15:10:15 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Naoya Horiguchi X-Patchwork-Id: 12251335 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.5 required=3.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN, FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 226C9C433ED for ; Tue, 11 May 2021 15:10:37 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id B637A61396 for ; Tue, 11 May 2021 15:10:36 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B637A61396 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 3F9E36B0072; Tue, 11 May 2021 11:10:36 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 3D0A76B0074; Tue, 11 May 2021 11:10:36 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 24B796B0075; Tue, 11 May 2021 11:10:36 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0187.hostedemail.com [216.40.44.187]) by kanga.kvack.org (Postfix) with ESMTP id 059826B0072 for ; Tue, 11 May 2021 11:10:36 -0400 (EDT) Received: from smtpin09.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id A0AAF8249980 for ; Tue, 11 May 2021 15:10:35 +0000 (UTC) X-FDA: 78129286830.09.F77849B Received: from mail-pg1-f177.google.com (mail-pg1-f177.google.com [209.85.215.177]) by imf09.hostedemail.com (Postfix) with ESMTP id 14F5160006EB for ; Tue, 11 May 2021 15:10:23 +0000 (UTC) Received: by mail-pg1-f177.google.com with SMTP id i14so15976902pgk.5 for ; Tue, 11 May 2021 08:10:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=UbtTKJ2DcWa23Eh4eF2HPJAjR+99XcZMmH1/neJWDQ8=; b=QTNSiMVFnSywFux8M9OXGZ5EQbqceGuac6FMw6rHlU9KjCFrPf0bHZ3Xr0Z04QlKTy sA3ePnvTS+Vx7qR1qZJ+iQMmxOHMiVY1GR1ZVI0GaB3Zc4qr5IXji+4iwWdg6he7JAqt FCa4lVCA9NPPBs5p7xl7LkW9z1TEfROS9Y/ncwasROYr1+luDNmk2XRfXCdU8tJFzPkY CeVS0n3O50AYYAyD9IW14nc0ZvKxpr0/GwJaat5dWo87ur9SBELo0k6Ox18m280o3Nnt xuZ0h9OUGtUmYOhT1Dge2BV/rSH1VdPdZIlmzvw0MikdDNsPZTqL0nGamvETt+gSXQUq XBdQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=UbtTKJ2DcWa23Eh4eF2HPJAjR+99XcZMmH1/neJWDQ8=; b=RpY0tTCV0p2/+pADPy9L6De8vo0N7HDGyY3PirxG3y7qvt+bQzZneJ7BKubYt+QuqT iAk5DDIGEE6nJdm/GGIvvC8HQUvM34kdHRhAXAsnAYUJ0wkpZYr5KkFFqOAYDIhFODyE tkIRLsE5MjBa20qEy9cYGGuxhTQnv3JTyH+Uh/+nFG/vFxH1tCs5aiyORKehvQj0wSpT dCldTdR51tHUylY7PUB9vJj+KeXrCGRhRBBUf7OhQ4fOVc6tc9o/Rib+va3tlj/SwEde 1zth15Gp3GVEiOELsaartI8pfO3FvwESqYgaHLDqes0ebnZ1kZZKjqgD+TkpjNT4t+jG kcxQ== X-Gm-Message-State: AOAM531GkPNpvDyCBJsFAxtffE4B6UfPDSp754z6ICijoi3o1vUP7mvC vGtyMvoYNq8ni5niq/uE2A== X-Google-Smtp-Source: ABdhPJyBocarp5TadCgoUJ4Mj42j/CEn57OApWlVWJIzIHWBYeuT8aU50JM0Z099WD8uJmDWdomLxQ== X-Received: by 2002:a63:575b:: with SMTP id h27mr31948674pgm.180.1620745834264; Tue, 11 May 2021 08:10:34 -0700 (PDT) Received: from localhost.localdomain (h175-177-040-153.catv02.itscom.jp. [175.177.40.153]) by smtp.gmail.com with ESMTPSA id a18sm14376456pgg.51.2021.05.11.08.10.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 May 2021 08:10:34 -0700 (PDT) From: Naoya Horiguchi To: Oscar Salvador , Muchun Song , linux-mm@kvack.org Cc: Andrew Morton , Mike Kravetz , Michal Hocko , Tony Luck , Naoya Horiguchi , linux-kernel@vger.kernel.org Subject: [PATCH v3 1/2] mm,hwpoison: fix race with compound page allocation Date: Wed, 12 May 2021 00:10:15 +0900 Message-Id: <20210511151016.2310627-2-nao.horiguchi@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210511151016.2310627-1-nao.horiguchi@gmail.com> References: <20210511151016.2310627-1-nao.horiguchi@gmail.com> MIME-Version: 1.0 X-Rspamd-Queue-Id: 14F5160006EB Authentication-Results: imf09.hostedemail.com; dkim=pass header.d=gmail.com header.s=20161025 header.b=QTNSiMVF; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf09.hostedemail.com: domain of naohoriguchi@gmail.com designates 209.85.215.177 as permitted sender) smtp.mailfrom=naohoriguchi@gmail.com X-Rspamd-Server: rspam03 X-Stat-Signature: nzuz4umbicjf5ei6jx4ahctgkdng1u1n Received-SPF: none (gmail.com>: No applicable sender policy available) receiver=imf09; identity=mailfrom; envelope-from=""; helo=mail-pg1-f177.google.com; client-ip=209.85.215.177 X-HE-DKIM-Result: pass/pass X-HE-Tag: 1620745823-804167 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Naoya Horiguchi When hugetlb page fault (under overcommiting situation) and memory_failure() race, VM_BUG_ON_PAGE() is triggered by the following race: CPU0: CPU1: gather_surplus_pages() page = alloc_surplus_huge_page() memory_failure_hugetlb() get_hwpoison_page(page) __get_hwpoison_page(page) get_page_unless_zero(page) zero = put_page_testzero(page) VM_BUG_ON_PAGE(!zero, page) enqueue_huge_page(h, page) put_page(page) __get_hwpoison_page() only checks page refcount before taking additional one for memory error handling, which is wrong because there's time windows where compound pages have non-zero refcount during initialization. So makes __get_hwpoison_page() check page status a bit more for a few types of compound pages. PageSlab() check is added because otherwise "non anonymous thp" path is wrongly chosen. Fixes: ead07f6a867b ("mm/memory-failure: introduce get_hwpoison_page() for consistent refcount handling") Signed-off-by: Naoya Horiguchi Reported-by: Muchun Song Cc: stable@vger.kernel.org # 5.12+ --- changelog v3: - recheck PageHuge after holding hugetlb_lock, --- mm/memory-failure.c | 55 ++++++++++++++++++++++++++++----------------- 1 file changed, 34 insertions(+), 21 deletions(-) diff --git v5.12/mm/memory-failure.c v5.12_patched/mm/memory-failure.c index a3659619d293..02668b24e512 100644 --- v5.12/mm/memory-failure.c +++ v5.12_patched/mm/memory-failure.c @@ -1095,30 +1095,43 @@ static int __get_hwpoison_page(struct page *page) { struct page *head = compound_head(page); - if (!PageHuge(head) && PageTransHuge(head)) { - /* - * Non anonymous thp exists only in allocation/free time. We - * can't handle such a case correctly, so let's give it up. - * This should be better than triggering BUG_ON when kernel - * tries to touch the "partially handled" page. - */ - if (!PageAnon(head)) { - pr_err("Memory failure: %#lx: non anonymous thp\n", - page_to_pfn(page)); - return 0; + if (PageCompound(page)) { + if (PageSlab(page)) { + return get_page_unless_zero(page); + } else if (PageHuge(head)) { + int ret = 0; + + spin_lock(&hugetlb_lock); + if (!PageHuge(head)) + ret = -EBUSY; + else if (HPageFreed(head) || HPageMigratable(head)) + ret = get_page_unless_zero(head); + spin_unlock(&hugetlb_lock); + return ret; + } else if (PageTransHuge(head)) { + /* + * Non anonymous thp exists only in allocation/free time. We + * can't handle such a case correctly, so let's give it up. + * This should be better than triggering BUG_ON when kernel + * tries to touch the "partially handled" page. + */ + if (!PageAnon(head)) { + pr_err("Memory failure: %#lx: non anonymous thp\n", + page_to_pfn(page)); + return 0; + } + if (get_page_unless_zero(head)) { + if (head == compound_head(page)) + return 1; + pr_info("Memory failure: %#lx cannot catch tail\n", + page_to_pfn(page)); + put_page(head); + } } + return 0; } - if (get_page_unless_zero(head)) { - if (head == compound_head(page)) - return 1; - - pr_info("Memory failure: %#lx cannot catch tail\n", - page_to_pfn(page)); - put_page(head); - } - - return 0; + return get_page_unless_zero(page); } /*