From patchwork Fri Dec 11 21:36:53 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Morton X-Patchwork-Id: 11969503 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 584DFC4361B for ; Fri, 11 Dec 2020 21:36:57 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id BC3D323EF2 for ; Fri, 11 Dec 2020 21:36:56 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org BC3D323EF2 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux-foundation.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 4E71F6B0074; Fri, 11 Dec 2020 16:36:56 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 495AA6B0075; Fri, 11 Dec 2020 16:36:56 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3D4E56B0078; Fri, 11 Dec 2020 16:36:56 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0080.hostedemail.com [216.40.44.80]) by kanga.kvack.org (Postfix) with ESMTP id 276456B0074 for ; Fri, 11 Dec 2020 16:36:56 -0500 (EST) Received: from smtpin28.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id E4A23363C for ; Fri, 11 Dec 2020 21:36:55 +0000 (UTC) X-FDA: 77582311590.28.rain54_0e1801127404 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin28.hostedemail.com (Postfix) with ESMTP id BE1A36C3C for ; Fri, 11 Dec 2020 21:36:55 +0000 (UTC) X-HE-Tag: rain54_0e1801127404 X-Filterd-Recvd-Size: 4390 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf27.hostedemail.com (Postfix) with ESMTP for ; Fri, 11 Dec 2020 21:36:55 +0000 (UTC) Date: Fri, 11 Dec 2020 13:36:53 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1607722614; bh=OxdipKPcakqLS2jEp2iuR0I4YoCZzTg0P1U6jh4HFTI=; h=From:To:Subject:In-Reply-To:From; b=aSbcu6pxg0wzXGy/eiBWFCK5x3J4TSkGbtiLXiaKx5QDoj4+k0A2q+PP4vGSByjYv oxp7w5K9QyZBPXNFeqqqGwIIfATiqvJecR4hmdwUZvmRIOWqetFxRwTsVZc7yttcd6 RSMAypTrSRXiO7uCUNXcY9l2r9IlExXvw5DQQ9vw= From: Andrew Morton To: akpm@linux-foundation.org, borntraeger@de.ibm.com, gerald.schaefer@linux.ibm.com, linux-mm@kvack.org, mike.kravetz@oracle.com, mm-commits@vger.kernel.org, stable@vger.kernel.org, torvalds@linux-foundation.org, willy@infradead.org Subject: [patch 8/8] mm/hugetlb: clear compound_nr before freeing gigantic pages Message-ID: <20201211213653.AWzFNUbZK%akpm@linux-foundation.org> In-Reply-To: <20201211133555.88407977f082963499ed343c@linux-foundation.org> User-Agent: s-nail v14.8.16 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Gerald Schaefer Subject: mm/hugetlb: clear compound_nr before freeing gigantic pages Commit 1378a5ee451a ("mm: store compound_nr as well as compound_order") added compound_nr counter to first tail struct page, overlaying with page->mapping. The overlay itself is fine, but while freeing gigantic hugepages via free_contig_range(), a "bad page" check will trigger for non-NULL page->mapping on the first tail page: [ 276.681603] BUG: Bad page state in process bash pfn:380001 [ 276.681614] page:00000000c35f0856 refcount:0 mapcount:0 mapping:00000000126b68aa index:0x0 pfn:0x380001 [ 276.681620] aops:0x0 [ 276.681622] flags: 0x3ffff00000000000() [ 276.681626] raw: 3ffff00000000000 0000000000000100 0000000000000122 0000000100000000 [ 276.681628] raw: 0000000000000000 0000000000000000 ffffffff00000000 0000000000000000 [ 276.681630] page dumped because: non-NULL mapping [ 276.681632] Modules linked in: [ 276.681637] CPU: 6 PID: 616 Comm: bash Not tainted 5.10.0-rc7-next-20201208 #1 [ 276.681639] Hardware name: IBM 3906 M03 703 (LPAR) [ 276.681641] Call Trace: [ 276.681648] [<0000000458c252b6>] show_stack+0x6e/0xe8 [ 276.681652] [<000000045971cf60>] dump_stack+0x90/0xc8 [ 276.681656] [<0000000458e8b186>] bad_page+0xd6/0x130 [ 276.681658] [<0000000458e8cdea>] free_pcppages_bulk+0x26a/0x800 [ 276.681661] [<0000000458e8e67e>] free_unref_page+0x6e/0x90 [ 276.681663] [<0000000458e8ea6c>] free_contig_range+0x94/0xe8 [ 276.681666] [<0000000458ea5e54>] update_and_free_page+0x1c4/0x2c8 [ 276.681669] [<0000000458ea784e>] free_pool_huge_page+0x11e/0x138 [ 276.681671] [<0000000458ea8530>] set_max_huge_pages+0x228/0x300 [ 276.681673] [<0000000458ea86c0>] nr_hugepages_store_common+0xb8/0x130 [ 276.681678] [<0000000458fd5b6a>] kernfs_fop_write+0xd2/0x218 [ 276.681681] [<0000000458ef9da0>] vfs_write+0xb0/0x2b8 [ 276.681684] [<0000000458efa15c>] ksys_write+0xac/0xe0 [ 276.681687] [<000000045972c5ca>] system_call+0xe6/0x288 [ 276.681730] Disabling lock debugging due to kernel taint This is because only the compound_order is cleared in destroy_compound_gigantic_page(), and compound_nr is set to 1U << order == 1 for order 0 in set_compound_order(page, 0). Fix this by explicitly clearing compound_nr for first tail page after calling set_compound_order(page, 0). Link: https://lkml.kernel.org/r/20201208182813.66391-2-gerald.schaefer@linux.ibm.com Fixes: 1378a5ee451a ("mm: store compound_nr as well as compound_order") Signed-off-by: Gerald Schaefer Reviewed-by: Matthew Wilcox (Oracle) Cc: Mike Kravetz Cc: Christian Borntraeger Cc; Heiko Carstens Cc: [5.9+] Signed-off-by: Andrew Morton --- mm/hugetlb.c | 1 + 1 file changed, 1 insertion(+) --- a/mm/hugetlb.c~mm-hugetlb-clear-compound_nr-before-freeing-gigantic-pages +++ a/mm/hugetlb.c @@ -1216,6 +1216,7 @@ static void destroy_compound_gigantic_pa } set_compound_order(page, 0); + page[1].compound_nr = 0; __ClearPageHead(page); }