From patchwork Fri Nov 30 12:06:57 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Stancek X-Patchwork-Id: 10706213 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 0FB70109C for ; Fri, 30 Nov 2018 12:07:14 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EFED72FF90 for ; Fri, 30 Nov 2018 12:07:13 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E33372FFF8; Fri, 30 Nov 2018 12:07:13 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A50C22FF90 for ; Fri, 30 Nov 2018 12:07:12 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id AF46D6B581A; Fri, 30 Nov 2018 07:07:11 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id A7A606B581B; Fri, 30 Nov 2018 07:07:11 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 91A956B581C; Fri, 30 Nov 2018 07:07:11 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-qk1-f198.google.com (mail-qk1-f198.google.com [209.85.222.198]) by kanga.kvack.org (Postfix) with ESMTP id 5EEDA6B581A for ; Fri, 30 Nov 2018 07:07:11 -0500 (EST) Received: by mail-qk1-f198.google.com with SMTP id g22so5024929qke.15 for ; Fri, 30 Nov 2018 04:07:11 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:from:to:cc :subject:date:message-id:in-reply-to:references; bh=D3jwzpMoHRT+f0aB8dnx9/gOhWa3+MYaIx9PIIFmycQ=; b=VOx7Ze2TRLQso4cXmNGCVwY/Zz/Qt9lYyMHYGhGPAAT+v+9Vo1sFscHBvGJ0HdYCGY USkfCNWCHcTH5HBqFlGBU22mW09e0Upei1BajLpjLAhedtDTcQDh4hXYoCoXyX9nmUm0 kp8MYIsFhnOPguncDExIcsLhFbSGIEWYkRlN97vZz0n3up3KtZkhMYh1SdV8VCRivBgB I0E96y+u7eY3af+XDY/BdLfdWacI1mzU9/WZJPz22WuHj9tXRwBYaiy1A/PoDvuMgVrF DNe4YPocNFpouoe2e/uEXW+iuRGH9ZBvROG/O47mxPCarFdwEZWTArph81D1+xB1ERB1 IWGQ== X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of jstancek@redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=jstancek@redhat.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com X-Gm-Message-State: AA+aEWZCYnHE6GtW+ToxhKfZC++ooSZmZa9LcMQdaTdxNfcjbmYScbC1 aQjc7pFLhghm1qtn1kXHGqPMJ7GgDSPRLqQY/HHgfLcVhq99+bjl7VOUyCEiFevqPGt1TJTd3wW X5meoa9ASYq7Nm8qHQBTrIscqSeb43ydR8R54BXnUkwOF6uqNK92atlVqwNhUJTxRHg== X-Received: by 2002:ac8:2502:: with SMTP id 2mr5236986qtm.53.1543579630984; Fri, 30 Nov 2018 04:07:10 -0800 (PST) X-Google-Smtp-Source: AFSGD/Vdk+s/5gr77xrR9ZHbLYvfifOmamwJOOwMs7XEfdn3Rb8Kk+T4a73wgVSrfLpdmz5gbC6f X-Received: by 2002:ac8:2502:: with SMTP id 2mr5236945qtm.53.1543579630362; Fri, 30 Nov 2018 04:07:10 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1543579630; cv=none; d=google.com; s=arc-20160816; b=RbboVWVz7s2NLFcLhSeeH/qeVM9vS+Q2mRWP3gXFsYjsxGUnBkqAvYoMRdkn7pLU8N xLvTneWsUb16jzrxag3zR7SSObNY6yelomXLFvIc7oT8oaOv/RmBlGJbwEm4axsQd43+ 8gV5pHYI4EQ7TJizl7Q3Gm2brvcIL6wRee6GxW1Ml0fdNXqmDV+/KXy7D0RdnX5zXzVz T4TRiy8p9KRmSQ8u7kS1onv7LmzfC+vqIK6S/uyZjfTTYwz6NJoHp8g/mpMqWY1n56KK POYsdH2u0s2nD3CirQ4Na/HUjEuhk3aUDgDCx+2VRmNQ3O1KAeQxgS7nsVMQxiDsvO9q 68gw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=references:in-reply-to:message-id:date:subject:cc:to:from; bh=D3jwzpMoHRT+f0aB8dnx9/gOhWa3+MYaIx9PIIFmycQ=; b=VQob4d03RPv+jtgxPkFz/1pE+mo77K/64uUrKIPdaIj7EWt6lHhFO92FGu/zRVW4yh cAB0DTwhoBsPU1A1qx0C39Tkn4ZtdWhR2/yTwlIle4eKyibKv+o3AeDbmWBcJJYnwEy2 b/e3KUiXyF950I7gdy022wLG7ItAmeu36QLRyYiHWUGbSn+vqv4Qo4RcULU2q/bhlEMF xecXaqtstGdMrQzZWcvVmeoz0lo47UakiyFDhbMIiuahVWvU/MHYGdlcHiTc1QjtCLD2 kb1bj+/zlZIXf/sN3ilzXOVN1tje0GZodHp18k4XcumCBWdCBjG4dciOx4ka7acua7jr NTUg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of jstancek@redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=jstancek@redhat.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from mx1.redhat.com (mx1.redhat.com. [209.132.183.28]) by mx.google.com with ESMTPS id p17si3420254qvi.74.2018.11.30.04.07.10 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 30 Nov 2018 04:07:10 -0800 (PST) Received-SPF: pass (google.com: domain of jstancek@redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; Authentication-Results: mx.google.com; spf=pass (google.com: domain of jstancek@redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=jstancek@redhat.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 7BB8230025E0; Fri, 30 Nov 2018 12:07:09 +0000 (UTC) Received: from dustball.brq.redhat.com (unknown [10.43.17.9]) by smtp.corp.redhat.com (Postfix) with ESMTP id 80A3426345; Fri, 30 Nov 2018 12:07:04 +0000 (UTC) From: Jan Stancek To: linux-mm@kvack.org, lersek@redhat.com, alex.williamson@redhat.com, aarcange@redhat.com, rientjes@google.com, kirill@shutemov.name, mgorman@techsingularity.net, mhocko@suse.com, jstancek@redhat.com Cc: linux-kernel@vger.kernel.org Subject: [PATCH v2] mm: page_mapped: don't assume compound page is huge or THP Date: Fri, 30 Nov 2018 13:06:57 +0100 Message-Id: In-Reply-To: References: X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.40]); Fri, 30 Nov 2018 12:07:09 +0000 (UTC) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP LTP proc01 testcase has been observed to rarely trigger crashes on arm64: page_mapped+0x78/0xb4 stable_page_flags+0x27c/0x338 kpageflags_read+0xfc/0x164 proc_reg_read+0x7c/0xb8 __vfs_read+0x58/0x178 vfs_read+0x90/0x14c SyS_read+0x60/0xc0 Issue is that page_mapped() assumes that if compound page is not huge, then it must be THP. But if this is 'normal' compound page (COMPOUND_PAGE_DTOR), then following loop can keep running (for HPAGE_PMD_NR iterations) until it tries to read from memory that isn't mapped and triggers a panic: for (i = 0; i < hpage_nr_pages(page); i++) { if (atomic_read(&page[i]._mapcount) >= 0) return true; } I could replicate this on x86 (v4.20-rc4-98-g60b548237fed) only with a custom kernel module [1] which: - allocates compound page (PAGEC) of order 1 - allocates 2 normal pages (COPY), which are initialized to 0xff (to satisfy _mapcount >= 0) - 2 PAGEC page structs are copied to address of first COPY page - second page of COPY is marked as not present - call to page_mapped(COPY) now triggers fault on access to 2nd COPY page at offset 0x30 (_mapcount) [1] https://github.com/jstancek/reproducers/blob/master/kernel/page_mapped_crash/repro.c Fix the loop to iterate for "1 << compound_order" pages. Debugged-by: Laszlo Ersek Suggested-by: "Kirill A. Shutemov" Signed-off-by: Jan Stancek Acked-by: Michal Hocko Acked-by: Kirill A. Shutemov Reviewed-by: David Hildenbrand Reviewed-by: Andrea Arcangeli --- mm/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Changes in v2: - change the loop instead so we check also mapcount of subpages diff --git a/mm/util.c b/mm/util.c index 8bf08b5b5760..5c9c7359ee8a 100644 --- a/mm/util.c +++ b/mm/util.c @@ -478,7 +478,7 @@ bool page_mapped(struct page *page) return true; if (PageHuge(page)) return false; - for (i = 0; i < hpage_nr_pages(page); i++) { + for (i = 0; i < (1 << compound_order(page)); i++) { if (atomic_read(&page[i]._mapcount) >= 0) return true; }