From patchwork Sun Jun 3 05:23:31 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Williams X-Patchwork-Id: 10445199 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E9E9F60234 for ; Sun, 3 Jun 2018 05:33:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DB59B27E63 for ; Sun, 3 Jun 2018 05:33:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D052F289E4; Sun, 3 Jun 2018 05:33:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 611D227E63 for ; Sun, 3 Jun 2018 05:33:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751062AbeFCFd3 (ORCPT ); Sun, 3 Jun 2018 01:33:29 -0400 Received: from mga14.intel.com ([192.55.52.115]:41084 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751048AbeFCFd2 (ORCPT ); Sun, 3 Jun 2018 01:33:28 -0400 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga006.jf.intel.com ([10.7.209.51]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 02 Jun 2018 22:33:28 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.49,472,1520924400"; d="scan'208";a="46863507" Received: from dwillia2-desk3.jf.intel.com (HELO dwillia2-desk3.amr.corp.intel.com) ([10.54.39.16]) by orsmga006.jf.intel.com with ESMTP; 02 Jun 2018 22:33:27 -0700 Subject: [PATCH v2 09/11] mm, memory_failure: Fix page->mapping assumptions relative to the page lock From: Dan Williams To: linux-nvdimm@lists.01.org Cc: hch@lst.de, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, jack@suse.cz Date: Sat, 02 Jun 2018 22:23:31 -0700 Message-ID: <152800341110.17112.2806198295112832622.stgit@dwillia2-desk3.amr.corp.intel.com> In-Reply-To: <152800336321.17112.3300876636370683279.stgit@dwillia2-desk3.amr.corp.intel.com> References: <152800336321.17112.3300876636370683279.stgit@dwillia2-desk3.amr.corp.intel.com> User-Agent: StGit/0.18-2-gc94f MIME-Version: 1.0 Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The current memory_failure() implementation assumes that lock_page() is sufficient for stabilizing page->mapping and that ->mapping->host will not be freed. The dax implementation, on the other hand, relies on xa_lock_irq() for stabilizing the page->mapping relationship and it is not possible to hold the lock over current routines in the memory_failure() path that run under lock_page(). Teach the various memory_failure() helpers to pin the address_space and revalidate page->mapping under xa_lock_irq(mapping->i_pages). Signed-off-by: Dan Williams --- mm/memory-failure.c | 56 +++++++++++++++++++++++++++++++++++---------------- 1 file changed, 38 insertions(+), 18 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 42a193ee14d3..b6efb78ba49b 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -179,12 +179,20 @@ EXPORT_SYMBOL_GPL(hwpoison_filter); * ``action required'' if error happened in current execution context */ static int kill_proc(struct task_struct *t, unsigned long addr, - unsigned long pfn, unsigned size_shift, int flags) + struct address_space *mapping, struct page *page, + unsigned size_shift, int flags) { - int ret; + int ret = 0; + + /* revalidate the page before killing the process */ + xa_lock_irq(&mapping->i_pages); + if (page->mapping != mapping) { + xa_unlock_irq(&mapping->i_pages); + return 0; + } pr_err("Memory failure: %#lx: Killing %s:%d due to hardware memory corruption\n", - pfn, t->comm, t->pid); + page_to_pfn(page), t->comm, t->pid); if ((flags & MF_ACTION_REQUIRED) && t->mm == current->mm) { ret = force_sig_mceerr(BUS_MCEERR_AR, (void __user *)addr, @@ -199,6 +207,7 @@ static int kill_proc(struct task_struct *t, unsigned long addr, ret = send_sig_mceerr(BUS_MCEERR_AO, (void __user *)addr, size_shift, t); /* synchronous? */ } + xa_unlock_irq(&mapping->i_pages); if (ret < 0) pr_info("Memory failure: Error sending signal to %s:%d: %d\n", t->comm, t->pid, ret); @@ -316,8 +325,8 @@ static void add_to_kill(struct task_struct *tsk, struct page *p, * wrong earlier. */ static void kill_procs(struct list_head *to_kill, int forcekill, - bool fail, unsigned size_shift, unsigned long pfn, - int flags) + bool fail, unsigned size_shift, struct address_space *mapping, + struct page *page, int flags) { struct to_kill *tk, *next; @@ -330,7 +339,8 @@ static void kill_procs(struct list_head *to_kill, int forcekill, */ if (fail || tk->addr_valid == 0) { pr_err("Memory failure: %#lx: forcibly killing %s:%d because of failure to unmap corrupted page\n", - pfn, tk->tsk->comm, tk->tsk->pid); + page_to_pfn(page), tk->tsk->comm, + tk->tsk->pid); force_sig(SIGKILL, tk->tsk); } @@ -341,9 +351,10 @@ static void kill_procs(struct list_head *to_kill, int forcekill, * process anyways. */ else if (kill_proc(tk->tsk, tk->addr, - pfn, size_shift, flags) < 0) + mapping, page, size_shift, flags) < 0) pr_err("Memory failure: %#lx: Cannot send advisory machine check signal to %s:%d\n", - pfn, tk->tsk->comm, tk->tsk->pid); + page_to_pfn(page), tk->tsk->comm, + tk->tsk->pid); } put_task_struct(tk->tsk); kfree(tk); @@ -429,21 +440,27 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill, /* * Collect processes when the error hit a file mapped page. */ -static void collect_procs_file(struct page *page, struct list_head *to_kill, - struct to_kill **tkc, int force_early) +static void collect_procs_file(struct address_space *mapping, struct page *page, + struct list_head *to_kill, struct to_kill **tkc, + int force_early) { struct vm_area_struct *vma; struct task_struct *tsk; - struct address_space *mapping = page->mapping; i_mmap_lock_read(mapping); read_lock(&tasklist_lock); for_each_process(tsk) { - pgoff_t pgoff = page_to_pgoff(page); + pgoff_t pgoff; struct task_struct *t = task_early_kill(tsk, force_early); if (!t) continue; + xa_lock_irq(&mapping->i_pages); + if (page->mapping != mapping) { + xa_unlock_irq(&mapping->i_pages); + break; + } + pgoff = page_to_pgoff(page); vma_interval_tree_foreach(vma, &mapping->i_mmap, pgoff, pgoff) { /* @@ -456,6 +473,7 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill, if (vma->vm_mm == t->mm) add_to_kill(t, page, vma, to_kill, tkc); } + xa_unlock_irq(&mapping->i_pages); } read_unlock(&tasklist_lock); i_mmap_unlock_read(mapping); @@ -467,12 +485,12 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill, * First preallocate one tokill structure outside the spin locks, * so that we can kill at least one process reasonably reliable. */ -static void collect_procs(struct page *page, struct list_head *tokill, - int force_early) +static void collect_procs(struct address_space *mapping, struct page *page, + struct list_head *tokill, int force_early) { struct to_kill *tk; - if (!page->mapping) + if (!mapping) return; tk = kmalloc(sizeof(struct to_kill), GFP_NOIO); @@ -481,7 +499,7 @@ static void collect_procs(struct page *page, struct list_head *tokill, if (PageAnon(page)) collect_procs_anon(page, tokill, &tk, force_early); else - collect_procs_file(page, tokill, &tk, force_early); + collect_procs_file(mapping, page, tokill, &tk, force_early); kfree(tk); } @@ -986,7 +1004,8 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn, * there's nothing that can be done. */ if (kill) - collect_procs(hpage, &tokill, flags & MF_ACTION_REQUIRED); + collect_procs(mapping, hpage, &tokill, + flags & MF_ACTION_REQUIRED); unmap_success = try_to_unmap(hpage, ttu); if (!unmap_success) @@ -1012,7 +1031,8 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn, */ forcekill = PageDirty(hpage) || (flags & MF_MUST_KILL); size_shift = compound_order(compound_head(p)) + PAGE_SHIFT; - kill_procs(&tokill, forcekill, !unmap_success, size_shift, pfn, flags); + kill_procs(&tokill, forcekill, !unmap_success, size_shift, mapping, + hpage, flags); return unmap_success; }