From patchwork Wed Mar 18 23:19:42 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yang Shi X-Patchwork-Id: 11446285 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C47BC92A for ; Wed, 18 Mar 2020 23:19:55 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 9C75A2076F for ; Wed, 18 Mar 2020 23:19:55 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 9C75A2076F Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id D30CB6B00B8; Wed, 18 Mar 2020 19:19:54 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id CE07D6B00B9; Wed, 18 Mar 2020 19:19:54 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C1D046B00BA; Wed, 18 Mar 2020 19:19:54 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0220.hostedemail.com [216.40.44.220]) by kanga.kvack.org (Postfix) with ESMTP id AAF9D6B00B8 for ; Wed, 18 Mar 2020 19:19:54 -0400 (EDT) Received: from smtpin19.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 63837629 for ; Wed, 18 Mar 2020 23:19:54 +0000 (UTC) X-FDA: 76610052708.19.fowl12_5660057624542 X-Spam-Summary: 2,0,0,4c1d001a8db727d9,d41d8cd98f00b204,yang.shi@linux.alibaba.com,,RULES_HIT:41:355:379:541:800:960:966:968:973:988:989:1260:1261:1345:1431:1437:1534:1542:1711:1730:1747:1777:1792:2196:2199:2393:2553:2559:2562:2895:3138:3139:3140:3141:3142:3352:3865:3866:3867:3868:3870:3871:3872:4250:4385:5007:6119:6261:7875:7903:8784:8957:10004:11026:11473:11658:11914:12043:12048:12295:12297:12438:12555:12679:12895:13161:13211:13229:14096:14181:14394:14721:21060:21080:21451:21627:21966:21987:30003:30045:30054:30056:30070:30090,0,RBL:115.124.30.42:@linux.alibaba.com:.lbl8.mailshell.net-64.201.201.201 62.20.2.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:none,Custom_rules:0:0:0,LFtime:24,LUA_SUMMARY:none X-HE-Tag: fowl12_5660057624542 X-Filterd-Recvd-Size: 3542 Received: from out30-42.freemail.mail.aliyun.com (out30-42.freemail.mail.aliyun.com [115.124.30.42]) by imf10.hostedemail.com (Postfix) with ESMTP for ; Wed, 18 Mar 2020 23:19:53 +0000 (UTC) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R201e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=e01f04452;MF=yang.shi@linux.alibaba.com;NM=1;PH=DS;RN=7;SR=0;TI=SMTPD_---0Tt-L-mT_1584573582; Received: from localhost(mailfrom:yang.shi@linux.alibaba.com fp:SMTPD_---0Tt-L-mT_1584573582) by smtp.aliyun-inc.com(127.0.0.1); Thu, 19 Mar 2020 07:19:49 +0800 From: Yang Shi To: kirill.shutemov@linux.intel.com, hughd@google.com, aarcange@redhat.com, akpm@linux-foundation.org Cc: yang.shi@linux.alibaba.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH] mm: khugepaged: fix potential page state corruption Date: Thu, 19 Mar 2020 07:19:42 +0800 Message-Id: <1584573582-116702-1-git-send-email-yang.shi@linux.alibaba.com> X-Mailer: git-send-email 1.8.3.1 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: When khugepaged collapses anonymous pages, the base pages would be freed via pagevec or free_page_and_swap_cache(). But, the anonymous page may be added back to LRU, then it might result in the below race: CPU A CPU B khugepaged: unlock page putback_lru_page add to lru page reclaim: isolate this page try_to_unmap page_remove_rmap <-- corrupt _mapcount It looks nothing would prevent the pages from isolating by reclaimer. The other problem is the page's active or unevictable flag might be still set when freeing the page via free_page_and_swap_cache(). The putback_lru_page() would not clear those two flags if the pages are released via pagevec, it sounds nothing prevents from isolating active or unevictable pages. However I didn't really run into these problems, just in theory by visual inspection. And, it also seems unnecessary to have the pages add back to LRU again since they are about to be freed when reaching this point. So, clearing active and unevictable flags, unlocking and dropping refcount from isolate instead of calling putback_lru_page() as what page cache collapse does. Cc: Kirill A. Shutemov Cc: Hugh Dickins Cc: Andrea Arcangeli Signed-off-by: Yang Shi --- mm/khugepaged.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index b679908..f42fa4e 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -673,7 +673,6 @@ static void __collapse_huge_page_copy(pte_t *pte, struct page *page, src_page = pte_page(pteval); copy_user_highpage(page, src_page, address, vma); VM_BUG_ON_PAGE(page_mapcount(src_page) != 1, src_page); - release_pte_page(src_page); /* * ptl mostly unnecessary, but preempt has to * be disabled to update the per-cpu stats @@ -687,6 +686,15 @@ static void __collapse_huge_page_copy(pte_t *pte, struct page *page, pte_clear(vma->vm_mm, address, _pte); page_remove_rmap(src_page, false); spin_unlock(ptl); + + dec_node_page_state(src_page, + NR_ISOLATED_ANON + page_is_file_cache(src_page)); + ClearPageActive(src_page); + ClearPageUnevictable(src_page); + unlock_page(src_page); + /* Drop refcount from isolate */ + put_page(src_page); + free_page_and_swap_cache(src_page); } }