From patchwork Tue Feb 18 12:10:25 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Longpeng(Mike)" X-Patchwork-Id: 11388309 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 69361924 for ; Tue, 18 Feb 2020 12:11:00 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 3F8F820675 for ; Tue, 18 Feb 2020 12:11:00 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3F8F820675 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=huawei.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 5599C6B0003; Tue, 18 Feb 2020 07:10:59 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 50D116B0006; Tue, 18 Feb 2020 07:10:59 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4207C6B0007; Tue, 18 Feb 2020 07:10:59 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0206.hostedemail.com [216.40.44.206]) by kanga.kvack.org (Postfix) with ESMTP id 271756B0003 for ; Tue, 18 Feb 2020 07:10:59 -0500 (EST) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id D8B31824805A for ; Tue, 18 Feb 2020 12:10:58 +0000 (UTC) X-FDA: 76503131796.05.jump15_7cccedc82f920 X-Spam-Summary: 1,0,0,,d41d8cd98f00b204,longpeng2@huawei.com,:mike.kravetz@oracle.com:akpm@linux-foundation.org:longpeng2@huawei.com::linux-kernel@vger.kernel.org:arei.gonglei@huawei.com:weidong.huang@huawei.com:weifuqiang@huawei.com:kvm@vger.kernel.org,RULES_HIT:30012:30054:30070:30090,0,RBL:45.249.212.191:@huawei.com:.lbl8.mailshell.net-62.18.2.100 64.95.201.95,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:23,LUA_SUMMARY:none X-HE-Tag: jump15_7cccedc82f920 X-Filterd-Recvd-Size: 6231 Received: from huawei.com (szxga05-in.huawei.com [45.249.212.191]) by imf22.hostedemail.com (Postfix) with ESMTP for ; Tue, 18 Feb 2020 12:10:57 +0000 (UTC) Received: from DGGEMS403-HUB.china.huawei.com (unknown [172.30.72.59]) by Forcepoint Email with ESMTP id E589135BE54F3A0B3135; Tue, 18 Feb 2020 20:10:47 +0800 (CST) Received: from localhost (10.177.246.209) by DGGEMS403-HUB.china.huawei.com (10.3.19.203) with Microsoft SMTP Server id 14.3.439.0; Tue, 18 Feb 2020 20:10:39 +0800 From: "Longpeng(Mike)" To: , CC: , , , , , , Subject: [PATCH] mm/hugetlb: avoid get wrong ptep caused by race Date: Tue, 18 Feb 2020 20:10:25 +0800 Message-ID: <1582027825-112728-1-git-send-email-longpeng2@huawei.com> X-Mailer: git-send-email 1.8.4.msysgit.0 MIME-Version: 1.0 X-Originating-IP: [10.177.246.209] X-CFilter-Loop: Reflected X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Our machine encountered a panic after run for a long time and the calltrace is: RIP: 0010:[] [] hugetlb_fault+0x307/0xbe0 RSP: 0018:ffff9567fc27f808 EFLAGS: 00010286 RAX: e800c03ff1258d48 RBX: ffffd3bb003b69c0 RCX: e800c03ff1258d48 RDX: 17ff3fc00eda72b7 RSI: 00003ffffffff000 RDI: e800c03ff1258d48 RBP: ffff9567fc27f8c8 R08: e800c03ff1258d48 R09: 0000000000000080 R10: ffffaba0704c22a8 R11: 0000000000000001 R12: ffff95c87b4b60d8 R13: 00005fff00000000 R14: 0000000000000000 R15: ffff9567face8074 FS: 00007fe2d9ffb700(0000) GS:ffff956900e40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffd3bb003b69c0 CR3: 000000be67374000 CR4: 00000000003627e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: [] ? unlock_page+0x2b/0x30 [] ? hugetlb_fault+0x222/0xbe0 [] follow_hugetlb_page+0x175/0x540 [] ? cpumask_next_and+0x35/0x50 [] __get_user_pages+0x2a0/0x7e0 [] __get_user_pages_unlocked+0x15d/0x210 [] __gfn_to_pfn_memslot+0x3c5/0x460 [kvm] [] try_async_pf+0x6e/0x2a0 [kvm] [] tdp_page_fault+0x151/0x2d0 [kvm] [] ? vmx_vcpu_run+0x2ec/0xc80 [kvm_intel] [] ? vmx_vcpu_run+0x2f8/0xc80 [kvm_intel] [] kvm_mmu_page_fault+0x31/0x140 [kvm] [] handle_ept_violation+0x9e/0x170 [kvm_intel] [] vmx_handle_exit+0x2bc/0xc70 [kvm_intel] [] ? __vmx_complete_interrupts.part.73+0x80/0xd0 [kvm_intel] [] ? vmx_vcpu_run+0x490/0xc80 [kvm_intel] [] vcpu_enter_guest+0x7be/0x13a0 [kvm] [] ? kvm_check_async_pf_completion+0x8e/0xb0 [kvm] [] kvm_arch_vcpu_ioctl_run+0x330/0x490 [kvm] [] kvm_vcpu_ioctl+0x309/0x6d0 [kvm] [] ? dequeue_signal+0x32/0x180 [] ? do_sigtimedwait+0xcd/0x230 [] do_vfs_ioctl+0x3f0/0x540 [] SyS_ioctl+0xa1/0xc0 [] system_call_fastpath+0x22/0x27 ( The kernel we used is older, but we think the latest kernel also has this bug after dig into this problem. ) For 1G hugepages, huge_pte_offset() wants to return NULL or pudp, but it may return a wrong 'pmdp' if there is a race. Please look at the following code snippet: ... pud = pud_offset(p4d, addr); if (sz != PUD_SIZE && pud_none(*pud)) return NULL; /* hugepage or swap? */ if (pud_huge(*pud) || !pud_present(*pud)) return (pte_t *)pud; pmd = pmd_offset(pud, addr); if (sz != PMD_SIZE && pmd_none(*pmd)) return NULL; /* hugepage or swap? */ if (pmd_huge(*pmd) || !pmd_present(*pmd)) return (pte_t *)pmd; ... The following sequence would trigger this bug: 1. CPU0: sz = PUD_SIZE and *pud = 0 , continue 1. CPU0: "pud_huge(*pud)" is false 2. CPU1: calling hugetlb_no_page and set *pud to xxxx8e7(PRESENT) 3. CPU0: "!pud_present(*pud)" is false, continue 4. CPU0: pmd = pmd_offset(pud, addr) and maybe return a wrong pmdp However, we want CPU0 to return NULL or pudp. We can avoid this race by read the pud only once. Signed-off-by: Longpeng(Mike) --- mm/hugetlb.c | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index dd8737a..3bde229 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -4908,31 +4908,33 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr, unsigned long sz) { - pgd_t *pgd; - p4d_t *p4d; - pud_t *pud; - pmd_t *pmd; + pgd_t *pgdp; + p4d_t *p4dp; + pud_t *pudp, pud; + pmd_t *pmdp, pmd; - pgd = pgd_offset(mm, addr); - if (!pgd_present(*pgd)) + pgdp = pgd_offset(mm, addr); + if (!pgd_present(*pgdp)) return NULL; - p4d = p4d_offset(pgd, addr); - if (!p4d_present(*p4d)) + p4dp = p4d_offset(pgdp, addr); + if (!p4d_present(*p4dp)) return NULL; - pud = pud_offset(p4d, addr); - if (sz != PUD_SIZE && pud_none(*pud)) + pudp = pud_offset(p4dp, addr); + pud = READ_ONCE(*pudp); + if (sz != PUD_SIZE && pud_none(pud)) return NULL; /* hugepage or swap? */ - if (pud_huge(*pud) || !pud_present(*pud)) - return (pte_t *)pud; + if (pud_huge(pud) || !pud_present(pud)) + return (pte_t *)pudp; - pmd = pmd_offset(pud, addr); - if (sz != PMD_SIZE && pmd_none(*pmd)) + pmdp = pmd_offset(pudp, addr); + pmd = READ_ONCE(*pmdp); + if (sz != PMD_SIZE && pmd_none(pmd)) return NULL; /* hugepage or swap? */ - if (pmd_huge(*pmd) || !pmd_present(*pmd)) - return (pte_t *)pmd; + if (pmd_huge(pmd) || !pmd_present(pmd)) + return (pte_t *)pmdp; return NULL; }