From patchwork Mon May 17 04:54:00 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Naoya Horiguchi X-Patchwork-Id: 12260827 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.5 required=3.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN, FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61C35C433ED for ; Mon, 17 May 2021 04:54:13 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id E0DD66113C for ; Mon, 17 May 2021 04:54:12 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E0DD66113C Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 83F7D6B006E; Mon, 17 May 2021 00:54:12 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 77B2C6B0070; Mon, 17 May 2021 00:54:12 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 61C9D6B0071; Mon, 17 May 2021 00:54:12 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0141.hostedemail.com [216.40.44.141]) by kanga.kvack.org (Postfix) with ESMTP id 2B0D16B006E for ; Mon, 17 May 2021 00:54:12 -0400 (EDT) Received: from smtpin28.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id C5F7D9991 for ; Mon, 17 May 2021 04:54:11 +0000 (UTC) X-FDA: 78149506302.28.1827BD3 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) by imf19.hostedemail.com (Postfix) with ESMTP id 3300D90009E8 for ; Mon, 17 May 2021 04:54:10 +0000 (UTC) Received: by mail-pj1-f53.google.com with SMTP id gc22-20020a17090b3116b02901558435aec1so2983581pjb.4 for ; Sun, 16 May 2021 21:54:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Wv9HmEbNzXquV71c2I1HoKTY3dM9rr3O2ebUyy9oJlA=; b=J3O71pOfBC4c67/UCF1GYqUXtR5/eWHqt4hyfGm49iNpD/8JW8r9V4JfzVONbW/Rw1 +Ne7KuuufvOrCP8dFI0DzQVTPzJ8EZFnn1pFgZXRhdg92Ko8L02es1+iKLQKjQ1fO1jO P2xr4Ox+ZApexHrUA8b9s9wKPZ2VANWuIsjqdRxRwMRfTMiGD1r5qXsxmAn+C7rYhN3o iyxNtTI9wuZTFEbbGF8pZyfycFGTXHYmXBO3AFBdXc22t9eP5jszvMOioXqbSyEyWSjw QDoruDTCzwEvi7e4IheT+MPQtlzPX+CVFbHGA7twyvPYhYDSfxBNCAlgPv2/XjX6ToAO dcxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Wv9HmEbNzXquV71c2I1HoKTY3dM9rr3O2ebUyy9oJlA=; b=kFnaXAWtNUw0rvIsztIhQ2PaDJiMIkj+QuxcqJ6sCPzuYtJGh/hHOhRf+EM+EjQjob RxxT63FeUaUrgPCw9qdW3HQGUzVO6+8Wn2TlmpFeIqkE7i32l6fwaxria0CbyE3gmcm7 GHoR/ExERXxfApUeLHgIitpx3VCYvXo3K9x+iIGAPPpqqx2oVZdhlbQbjLL8qLuG+p0K wh8KyPsgAJP+cR0+jfmxPZA/rBXoK+Ux2HjsD4HZ3dsF43ana0l4nRwDR9A2EG+TUIw/ VVrjjHcT/0DofsDtAwRXrKghXvShIH9GCq6YCncGOSAi9NVd6OPHfe7FKT4xpkAIrvKz Go1Q== X-Gm-Message-State: AOAM531N0BA9Nip8g0eoAlV3lAKUzr4xPa7vy1iM54OqYFQ4n4R0Iod+ VgNdTAYcW3QnAzXIa8hhow== X-Google-Smtp-Source: ABdhPJyxCSt0gPoL3zDCxj/Lgxk1wqc86x5Lgwrtz6EXekFEtEzmYEAhJFBEvTXHIkXT0eyiA3gKww== X-Received: by 2002:a17:90a:da06:: with SMTP id e6mr24442241pjv.183.1621227250533; Sun, 16 May 2021 21:54:10 -0700 (PDT) Received: from localhost.localdomain (h175-177-040-153.catv02.itscom.jp. [175.177.40.153]) by smtp.gmail.com with ESMTPSA id j29sm9439038pgl.30.2021.05.16.21.54.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 16 May 2021 21:54:10 -0700 (PDT) From: Naoya Horiguchi To: Oscar Salvador , Muchun Song , linux-mm@kvack.org Cc: Andrew Morton , Mike Kravetz , Michal Hocko , Tony Luck , Naoya Horiguchi , linux-kernel@vger.kernel.org Subject: [PATCH v4 1/2] mm,hwpoison: fix race with compound page allocation Date: Mon, 17 May 2021 13:54:00 +0900 Message-Id: <20210517045401.2506032-2-nao.horiguchi@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210517045401.2506032-1-nao.horiguchi@gmail.com> References: <20210517045401.2506032-1-nao.horiguchi@gmail.com> MIME-Version: 1.0 Authentication-Results: imf19.hostedemail.com; dkim=pass header.d=gmail.com header.s=20161025 header.b=J3O71pOf; spf=pass (imf19.hostedemail.com: domain of naohoriguchi@gmail.com designates 209.85.216.53 as permitted sender) smtp.mailfrom=naohoriguchi@gmail.com; dmarc=pass (policy=none) header.from=gmail.com X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: 3300D90009E8 X-Stat-Signature: ftxwox6xznntqedk7xgyxew57dzioa3c X-HE-Tag: 1621227250-445621 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Naoya Horiguchi When hugetlb page fault (under overcommitting situation) and memory_failure() race, VM_BUG_ON_PAGE() is triggered by the following race: CPU0: CPU1: gather_surplus_pages() page = alloc_surplus_huge_page() memory_failure_hugetlb() get_hwpoison_page(page) __get_hwpoison_page(page) get_page_unless_zero(page) zero = put_page_testzero(page) VM_BUG_ON_PAGE(!zero, page) enqueue_huge_page(h, page) put_page(page) __get_hwpoison_page() only checks page refcount before taking additional one for memory error handling, which is wrong because there's a time window where compound pages have non-zero refcount during initialization. So makes __get_hwpoison_page() check page status a bit more for a few types of compound pages. PageSlab() check is added because otherwise "non anonymous thp" path is wrongly chosen. Fixes: ead07f6a867b ("mm/memory-failure: introduce get_hwpoison_page() for consistent refcount handling") Signed-off-by: Naoya Horiguchi Reported-by: Muchun Song Cc: stable@vger.kernel.org # 5.12+ --- ChangeLog v4: - all hugetlb related check in hugetlb_lock, - fix build error with #ifdef CONFIG_HUGETLB_PAGE --- mm/memory-failure.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git v5.12/mm/memory-failure.c v5.12_patched/mm/memory-failure.c index a3659619d293..761f982b6d7b 100644 --- v5.12/mm/memory-failure.c +++ v5.12_patched/mm/memory-failure.c @@ -1094,6 +1094,16 @@ static int page_action(struct page_state *ps, struct page *p, static int __get_hwpoison_page(struct page *page) { struct page *head = compound_head(page); + int ret = 0; + +#ifdef CONFIG_HUGETLB_PAGE + spin_lock(&hugetlb_lock); + if (PageHuge(head) && (HPageFreed(head) || HPageMigratable(head))) + ret = get_page_unless_zero(head); + spin_unlock(&hugetlb_lock); + if (ret > 0) + return ret; +#endif if (!PageHuge(head) && PageTransHuge(head)) { /*