From patchwork Thu Jun 29 04:31:35 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hugh Dickins X-Patchwork-Id: 13296594 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id F185BEB64D9 for ; Thu, 29 Jun 2023 04:31:48 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3E3328D0002; Thu, 29 Jun 2023 00:31:48 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 393118D0001; Thu, 29 Jun 2023 00:31:48 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 281DE8D0002; Thu, 29 Jun 2023 00:31:48 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 1523D8D0001 for ; Thu, 29 Jun 2023 00:31:48 -0400 (EDT) Received: from smtpin15.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id CE440B03FE for ; Thu, 29 Jun 2023 04:31:47 +0000 (UTC) X-FDA: 80954512254.15.4E59BD2 Received: from mail-yb1-f176.google.com (mail-yb1-f176.google.com [209.85.219.176]) by imf27.hostedemail.com (Postfix) with ESMTP id 00EB540005 for ; Thu, 29 Jun 2023 04:31:45 +0000 (UTC) Authentication-Results: imf27.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=bbjxfVxs; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf27.hostedemail.com: domain of hughd@google.com designates 209.85.219.176 as permitted sender) smtp.mailfrom=hughd@google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1688013106; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=5Z3smH8SQO2wh8AZ/tEvfhS/BICA37Ii8kaU3dG+Uuo=; b=B2Evs5ysu5hOTZt9WNjgft5Ev2W/MzlmrJ2cKYGYOeYj13yzs/gTB0WaA4tFPCClJYmp4M xt2gNxQjPda4qk7lynKHVzTq6YDnQx86Txp4LIJK9ACMDDFjLpHHyyTyQe5bbPXRQ0I8F0 syb9yqpbkAocJRnH2yt8traRTo+O+GQ= ARC-Authentication-Results: i=1; imf27.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=bbjxfVxs; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf27.hostedemail.com: domain of hughd@google.com designates 209.85.219.176 as permitted sender) smtp.mailfrom=hughd@google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1688013106; a=rsa-sha256; cv=none; b=3kKPRXZm5g+h4okxduw7MaJ/Y7mJeECCQpFfAT1ZhqG/kJ7jQXzr3tpnmRjQ2mYku8Exxa A4xLRA+iQbRf5s4q4CeT99n970NZ2LHoya2rsWp1i2y0ZeYaTb187iO60EFtF8cZ/iNkU/ Y/IfSRpQAdTmKWZy3Tl/ki0Tqk8/djE= Received: by mail-yb1-f176.google.com with SMTP id 3f1490d57ef6-bd729434fa0so272498276.1 for ; Wed, 28 Jun 2023 21:31:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1688013105; x=1690605105; h=mime-version:references:message-id:in-reply-to:subject:cc:to:from :date:from:to:cc:subject:date:message-id:reply-to; bh=5Z3smH8SQO2wh8AZ/tEvfhS/BICA37Ii8kaU3dG+Uuo=; b=bbjxfVxsRx2mupCwEXHDjFVj2n5Txwdqkw7E1M+mboYtsr47GWsQtvHBxx+Ec0rllY YKoVHhnetGKgbAvXMg/sOkN7eJk0YAt570U6ZlfyqyZlMA5Kn4GML5Y89EoW3ZsM9/Kp kAl/iH8yqdCbUJtcy7MvxVi9yq4aU5UMRrsgMk1XlAA8Z1bpcC5rW2cfJTjfP7jARDwY YCuiB9rM/Y/t1EgkEP2nhi8vG5xHXynMImoh0E/WF5bcB31LTK7tZs1UafbVVhjgOqgN +Zua8Gx7RDK571uBCTwiCpDX6As9jJt1z8ZpBFPNpMsqvPYi9iWfBwz89FTJyRLUrdrr vxxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1688013105; x=1690605105; h=mime-version:references:message-id:in-reply-to:subject:cc:to:from :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=5Z3smH8SQO2wh8AZ/tEvfhS/BICA37Ii8kaU3dG+Uuo=; b=jr+UaemEDcwgOlcR0vA8dndrXDKC390Z1WRopUCCZADabu8pJKHr/UXrRYKKZqNFZ+ 8HUTVgN1oXtSJiKYVtHO5xuGaEpy20/K4314m0u1ewZgR5ChlNzAWeP2cKZN2eIflLwW wvicJW00uzqQWTk0KMxLF2xTDGm7oTZJ4lKZOK+CaOkDBxBijr1un/y8TgRdDaIux9Ng qFHpz7Uz946e6Ex9o48+7rlHr4ARfdB+Vsya6GHtJWyaxZpVZ5HRGgJTUbS11h5NHCj9 Lr51r9xZwRPlS7ZnEJFCr1w/Y0TpidSQ2ZS78uDciSxKFQQ9/8PA/lXffq39N/5OJvef HtSw== X-Gm-Message-State: AC+VfDyAbvIMxoIp+co5K0/EDdDB8XHx1IDSCyi00Zgpvb+AGSmdQEzl uzDrOw64OfAGyL5LoMOZl4P3Rg== X-Google-Smtp-Source: ACHHUZ4EVD+2CjOf5QXl5EbRGAgOpPEe1F0AFrSkRRhfxSjfgcG8pZbY7ACf6AweRR0B41j5ZrrypA== X-Received: by 2002:a25:bf8b:0:b0:c2c:c280:83be with SMTP id l11-20020a25bf8b000000b00c2cc28083bemr8954521ybk.8.1688013104949; Wed, 28 Jun 2023 21:31:44 -0700 (PDT) Received: from ripple.attlocal.net (172-10-233-147.lightspeed.sntcca.sbcglobal.net. [172.10.233.147]) by smtp.gmail.com with ESMTPSA id k81-20020a252454000000b00bad03cb9325sm2389365ybk.32.2023.06.28.21.31.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Jun 2023 21:31:44 -0700 (PDT) Date: Wed, 28 Jun 2023 21:31:35 -0700 (PDT) From: Hugh Dickins X-X-Sender: hugh@ripple.attlocal.net To: Andrew Morton cc: Matthew Wilcox , Linus Torvalds , Hugh Dickins , David Stevens , Peter Xu , "Kirill A . Shutemov" , Yang Shi , David Hildenbrand , Jiaqi Yan , linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH hotfix] mm/khugepaged: fix regression in collapse_file() In-Reply-To: Message-ID: References: <20230607053135.2087354-1-stevensd@google.com> <8ef3ee-ba41-8e9e-4453-73736ff27783@google.com> MIME-Version: 1.0 X-Rspam-User: X-Stat-Signature: xpzfm9kaahih7e8rwxk4c4ahf64cdgk8 X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 00EB540005 X-HE-Tag: 1688013105-974969 X-HE-Meta: U2FsdGVkX1/1eoLQtLnv4HL6I2gUiY2+k9ojrhx9JvOI5SEekD3yi410L1n4UvZYX71Wm1Y6hrpWxKUauT8iJA87VAe577j6XXe7kttEF7YrkjXYPaz3nRlUWDY8B+bO63rEHlgaltkANAjyb7HhvbvnAjOB/fY0el9iyKZgY7L8cKkUHvhdz+brWrwYdp+LaIFtepdvSiRoyeGTf9atGRN4f0d/MLCs/9jqjz/OEEwwx3ktm2QVX4AH+4IpIpr1o/2Hn1W8igNa5d2Gwrf40/CusL32teEv4GGEE66A0l6ZC2wjEI58jeGzMPdzup+7oTBdN3LjEmgt6+7umPkggXYbJQE1qx3M9H/iCgXHRrMOV9id3Pw5lb75EQstP2Da1Uz6l5k30RbuDWfpGaMeqQkw7q/qUmOsHYpvY2HxcitO5cRuH/3sWnJeDPCXd+T3SMSVBrtZWL/8xGVCYUqvK3CctziHLmjO8QovxXDjZU+TEaM3swrw6aSaEGS6pZ1LU75b7lAXqGw0GExDrXEKf+A3jS3QJmigyBayCMvbPkk39VXChvpn54JpbzsfYGwHQrOLtf3ABUFZG21ljaLbgbiZlSd//8RUDOeoKrPzSPkoZBzBizA9QTCsXkUVnJ8S8NkD/O+rhizcjqVDvDhL09qv+wbZDAEmBEz9zVFG5EG5x7YXuIMjIQj/diFyYT8Eyl77ma9cec6F5PIMXo+xGRwFVO5+bmU0YZEmY/WVlMIhwL6tGzdunlAU0/GiNWtwZTt0D895Rjqd12vX1l3RDR5qT56nZodDmVpgRvxtilnrMOvDNtUUu4soHSE6hPDsRv5Xp+8dANGPWLoMVzvOV7WjAFgYszZK7S7mNvPF57EHzCtgeC9NgvJ4n706ALbuZe1ys1/LBRyP1AHKkJ2HrBIe69J0GVr7nXtuYvma7k7huU9SwNariEmTalOgWpgPnCOZCEyVSD1TbeBqyu6 h7H5tuad LXezug107eTss3C++OK8R9iqT4i3QfDNZ3xL/P0IGGQO5F2cMAfAYNy9rtfsz9Xkd+3UcnSReYp+k82Az0NUrPCYLYOLViJPrat6pV1tFONwkELK6fdzjhEUyinGbI0u2cRycbtwlP5CXAUyu71sdieOroghjvSpdMgWQ6RelLDHKz6kXfRH6eGbbvJ8S134AzPVTCvBH1NBAyUaGPbYk+A0G6/f/CBfc8G4KWaR+1fIjSDoTGh1trHMQMRksiBmoORO5dAWhQ98s9PRbEHEfChNH90nxwFXTxIu9uOOlaEXXop7urNgmU4P1KG+Wokp4K/RXSnSAtBMF3d6Sv0wOEY7FdIJ1jQvPouvpa4AsL5KcTuyBlIPPl8Yz5Rb5RT7C9CbMLgmMfJ5mKw7Dg0qZ39QsG0GkZnx4HoA4gz1ZpWEPnd7SNT7iI9c6c/q/nu0N5JwCsHkkeUqYXHcgLkBmXxVJv46aDWKZq2OiKzTr/QO7UKs= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: There is no xas_pause(&xas) in collapse_file()'s main loop, at the points where it does xas_unlock_irq(&xas) and then continues. That would explain why, once two weeks ago and twice yesterday, I have hit the VM_BUG_ON_PAGE(page != xas_load(&xas), page) since "mm/khugepaged: fix iteration in collapse_file" removed the xas_set(&xas, index) just before it: xas.xa_node could be left pointing to a stale node, if there was concurrent activity on the file which transformed its xarray. I tried inserting xas_pause()s, but then even bootup crashed on that VM_BUG_ON_PAGE(): there appears to be a subtle "nextness" implicit in xas_pause(). xas_next() and xas_pause() are good for use in simple loops, but not in this one: xas_set() worked well until now, so use xas_set(&xas, index) explicitly at the head of the loop; and change that VM_BUG_ON_PAGE() not to need its own xas_set(), and not to interfere with the xa_state (which would probably stop the crashes from xas_pause(), but I trust that less). The user-visible effects of this bug (if VM_BUG_ONs are configured out) would be data loss and data leak - potentially - though in practice I expect it is more likely that a subsequent check (e.g. on mapping or on nr_none) would notice an inconsistency, and just abandon the collapse. Link: https://lore.kernel.org/linux-mm/f18e4b64-3f88-a8ab-56cc-d1f5f9c58d4@google.com/ Fixes: c8a8f3b4a95a ("mm/khugepaged: fix iteration in collapse_file") Signed-off-by: Hugh Dickins Cc: --- mm/khugepaged.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 3beb4ad2ee5e..78c8d5d8b628 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -1937,9 +1937,9 @@ static int collapse_file(struct mm_struct *mm, unsigned long addr, } } while (1); - xas_set(&xas, start); for (index = start; index < end; index++) { - page = xas_next(&xas); + xas_set(&xas, index); + page = xas_load(&xas); VM_BUG_ON(index != xas.xa_index); if (is_shmem) { @@ -1954,7 +1954,6 @@ static int collapse_file(struct mm_struct *mm, unsigned long addr, result = SCAN_TRUNCATED; goto xa_locked; } - xas_set(&xas, index + 1); } if (!shmem_charge(mapping->host, 1)) { result = SCAN_FAIL; @@ -2090,7 +2089,7 @@ static int collapse_file(struct mm_struct *mm, unsigned long addr, xas_lock_irq(&xas); - VM_BUG_ON_PAGE(page != xas_load(&xas), page); + VM_BUG_ON_PAGE(page != xa_load(xas.xa, index), page); /* * We control three references to the page: