From patchwork Sat Jan 11 03:45:11 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Liu Shixin X-Patchwork-Id: 13935763 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03CDBE7719A for ; Sat, 11 Jan 2025 03:49:52 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 773F36B0089; Fri, 10 Jan 2025 22:49:52 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 723C76B008C; Fri, 10 Jan 2025 22:49:52 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5EB626B0092; Fri, 10 Jan 2025 22:49:52 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 3CE216B0089 for ; Fri, 10 Jan 2025 22:49:52 -0500 (EST) Received: from smtpin28.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id B441B121027 for ; Sat, 11 Jan 2025 03:49:51 +0000 (UTC) X-FDA: 82993792182.28.F23C909 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by imf05.hostedemail.com (Postfix) with ESMTP id 74AFA10000B for ; Sat, 11 Jan 2025 03:49:48 +0000 (UTC) Authentication-Results: imf05.hostedemail.com; dkim=none; dmarc=pass (policy=quarantine) header.from=huawei.com; spf=pass (imf05.hostedemail.com: domain of liushixin2@huawei.com designates 45.249.212.189 as permitted sender) smtp.mailfrom=liushixin2@huawei.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1736567390; a=rsa-sha256; cv=none; b=w/QB+4N2NzFqMGF53Zk7eBc6rFXClB1d9ztz7DCzDqr+p2H7TKZfJvc6OPPaKeHIYVIr23 70GOEsEEeZ32ksBD0lrjPWwFlv12ger5eI2i+gm+GgHf2XvuHQQa7zEIDcnjJNlH5MPj2C qD0OKnXMAm+vdiRuyBW+CqbPKv2NNYc= ARC-Authentication-Results: i=1; imf05.hostedemail.com; dkim=none; dmarc=pass (policy=quarantine) header.from=huawei.com; spf=pass (imf05.hostedemail.com: domain of liushixin2@huawei.com designates 45.249.212.189 as permitted sender) smtp.mailfrom=liushixin2@huawei.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1736567390; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references; bh=uoyVsnMd7/CCEYIQuAk69CuaYX0MI/8IeQRE6fMfQKU=; b=pAnuGUXJd7Loqw/Vp+i1GxvZ6ATgSS9+cqdDQTdSSYtJ1c1cQhJ5/2XObBK8FNHy+8X1Ns y05UVRnmjthUPxcDJ1nvi4S+oSOS48i4DjJ58rDZAy1VDulQFbukGsmnVVoPqYdLyKhDUj gRBFXb3REMbj9fQdLndE4hr585eiMks= Received: from mail.maildlp.com (unknown [172.19.162.254]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4YVPbx5xFbzRkMq; Sat, 11 Jan 2025 11:47:25 +0800 (CST) Received: from kwepemg200013.china.huawei.com (unknown [7.202.181.64]) by mail.maildlp.com (Postfix) with ESMTPS id 0BB61180105; Sat, 11 Jan 2025 11:49:44 +0800 (CST) Received: from huawei.com (10.175.113.32) by kwepemg200013.china.huawei.com (7.202.181.64) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Sat, 11 Jan 2025 11:49:42 +0800 From: Liu Shixin To: Andrew Morton , Chengming Zhou , Matthew Wilcox , Kefeng Wang , Nanyong Sun , Muchun Song , Qi Zheng , Johannes Weiner , Yang Shi CC: , , Liu Shixin Subject: [PATCH v2] mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma Date: Sat, 11 Jan 2025 11:45:11 +0800 Message-ID: <20250111034511.2223353-1-liushixin2@huawei.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Originating-IP: [10.175.113.32] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To kwepemg200013.china.huawei.com (7.202.181.64) X-Stat-Signature: s7e9fixr4zrjk7xeb86hepfrjk64nnaf X-Rspam-User: X-Rspamd-Queue-Id: 74AFA10000B X-Rspamd-Server: rspam08 X-HE-Tag: 1736567388-585792 X-HE-Meta: U2FsdGVkX1/zt2rDtRGDBfnDRdTJnVjRoofHbX/Q25ljcI1b94g//JmZ7D2xV3Hz07fR7PiDf/KaNe6rLRTlarclNsAkx/MDb132m95x1vEHTloT4np5u8Bw2AXqZ786649Q1c+ubU8PD7EF4gIpeEeDevpDKvMB8ZI2c3Mv8HrmzGcz16a1/kqg+j/rKnPUP8TbNhDOho9ITH/yL+BjCd5ZtfTb/A6ZPGk4eLYjAMnoj2kfwqg3rwC3ufqfg9cY0OENrZwk1Yu/+1HqEXbyJRNg1XXaZ1ZrrT/QtIASF9MBbH1Qlnw0f5QH0htbKwZROqHy0yFl/0Pm2i0qcQ+cdV59cWdEQd0tNPAR4gcyW5LQO9soh3G9S1hee87yBTFIR7/pze+DX1j6ZqQOGqV3XTxFfnYyK76nvdXXrsoBZNFDtSUFsQQviSbT8rkkZNA8QQhXvJmIQamgW2spC4UDyxgbnehRKmeNX38RJpMFPHODdrW0qMggwR4VS92ynUiW4bk29ScM8AfEAwMonC8f/d7bRV5PmTyvEmWhnBW3VuvEAhKn2R12GwMU4Re4qOhsbDH7ytjD4/6i5xseHq9OYsW9d3YKb7UvUYDmgO+olQVV9Pp/1qqKyFD4nMjevpiBo9dJ2bNe0xdPDhkvEmcNHlhW+dp7I3flFnKlKfkruW5VDRs+8w347iiSjgKNhRsYyBHRkrI/jH4qU3Rl8SYZR0d57WG/2tS2hEgCs1bZrCaN64w/5Tez0L7NEGEIZVX73KSTYiSzHso3BHAVFSXKsHYsVYh0xPRArCc8ZTm6IafPP6t9eWkd/+aByAxpeStArwcV/djfNnI2vyyUc8MGF7ENNHB8tr2Y5M/RAA/RATHwiLnvlMU3BzbZyxMCwYXjRROGE4M9cLBkm3iDorGWps9lxUn83nZEAR/tpSl3+2g7Ullrx0KuMBh9IQgKSNM/RTJ49EkvG9v7xQF+q/X 8U2Wo8Nz 0Tek5WGoW/ZL5wJ0VK2a4H8hyX1f3suDrsKg81rgmiodoCWnSuQ3KYt0o3oZ+QneLkK+qQ8lGXDfFRh6wioTgAjIdDdboKUNRdY0pFNlPxHPWy+7XhKnt+UI6J8NKqS+nFQDiuQ2qnKQVen9tbEE+5APKPE5kaHhU+MKgmgwUeNbv667YyguAtBbJWtqgvJH8gN5D X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: syzkaller reported such a BUG_ON(): ------------[ cut here ]------------ kernel BUG at mm/khugepaged.c:1835! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP ... CPU: 6 UID: 0 PID: 8009 Comm: syz.15.106 Kdump: loaded Tainted: G W 6.13.0-rc6 #22 Tainted: [W]=WARN Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : collapse_file+0xa44/0x1400 lr : collapse_file+0x88/0x1400 sp : ffff80008afe3a60 ... Call trace: collapse_file+0xa44/0x1400 (P) hpage_collapse_scan_file+0x278/0x400 madvise_collapse+0x1bc/0x678 madvise_vma_behavior+0x32c/0x448 madvise_walk_vmas.constprop.0+0xbc/0x140 do_madvise.part.0+0xdc/0x2c8 __arm64_sys_madvise+0x68/0x88 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x34/0x128 el0t_64_sync_handler+0xc8/0xd0 el0t_64_sync+0x190/0x198 This indicates that the pgoff is unaligned. After analysis, I confirm the vma is mapped to /dev/zero. Such a vma certainly has vm_file, but it is set to anonymous by mmap_zero(). So even if it's mmapped by 2m-unaligned, it can pass the check in thp_vma_allowable_order() as it is an anonymous-mmap, but then be collapsed as a file-mmap. It seems the problem has existed for a long time, but actually, since we have khugepaged_max_ptes_none check before, we will skip collapse it as it is /dev/zero and so has no present page. But commit d8ea7cc8547c limit the check for only khugepaged, so the BUG_ON() can be triggered by madvise_collapse(). Add vma_is_anonymous() check to make such vma be processed by hpage_collapse_scan_pmd(). Fixes: d8ea7cc8547c ("mm/khugepaged: add flag to predicate khugepaged-only behavior") Signed-off-by: Liu Shixin --- v1->v2: Remove the redundant vm_file check, suggested by Matthew Wilcox. mm/khugepaged.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 653dbb1ff05c..bad1e130eda8 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -2422,7 +2422,7 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages, int *result, VM_BUG_ON(khugepaged_scan.address < hstart || khugepaged_scan.address + HPAGE_PMD_SIZE > hend); - if (IS_ENABLED(CONFIG_SHMEM) && vma->vm_file) { + if (IS_ENABLED(CONFIG_SHMEM) && !vma_is_anonymous(vma)) { struct file *file = get_file(vma->vm_file); pgoff_t pgoff = linear_page_index(vma, khugepaged_scan.address); @@ -2768,7 +2768,7 @@ int madvise_collapse(struct vm_area_struct *vma, struct vm_area_struct **prev, mmap_assert_locked(mm); memset(cc->node_load, 0, sizeof(cc->node_load)); nodes_clear(cc->alloc_nmask); - if (IS_ENABLED(CONFIG_SHMEM) && vma->vm_file) { + if (IS_ENABLED(CONFIG_SHMEM) && !vma_is_anonymous(vma)) { struct file *file = get_file(vma->vm_file); pgoff_t pgoff = linear_page_index(vma, addr);