lkml.org 
[lkml]   [2020]   [Jun]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 39/48] mm: remove VM_BUG_ON(PageSlab()) from page_mapcount()
    Date
    From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>

    commit 6988f31d558aa8c744464a7f6d91d34ada48ad12 upstream.

    Replace superfluous VM_BUG_ON() with comment about correct usage.

    Technically reverts commit 1d148e218a0d ("mm: add VM_BUG_ON_PAGE() to
    page_mapcount()"), but context lines have changed.

    Function isolate_migratepages_block() runs some checks out of lru_lock
    when choose pages for migration. After checking PageLRU() it checks
    extra page references by comparing page_count() and page_mapcount().
    Between these two checks page could be removed from lru, freed and taken
    by slab.

    As a result this race triggers VM_BUG_ON(PageSlab()) in page_mapcount().
    Race window is tiny. For certain workload this happens around once a
    year.

    page:ffffea0105ca9380 count:1 mapcount:0 mapping:ffff88ff7712c180 index:0x0 compound_mapcount: 0
    flags: 0x500000000008100(slab|head)
    raw: 0500000000008100 dead000000000100 dead000000000200 ffff88ff7712c180
    raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
    page dumped because: VM_BUG_ON_PAGE(PageSlab(page))
    ------------[ cut here ]------------
    kernel BUG at ./include/linux/mm.h:628!
    invalid opcode: 0000 [#1] SMP NOPTI
    CPU: 77 PID: 504 Comm: kcompactd1 Tainted: G W 4.19.109-27 #1
    Hardware name: Yandex T175-N41-Y3N/MY81-EX0-Y3N, BIOS R05 06/20/2019
    RIP: 0010:isolate_migratepages_block+0x986/0x9b0

    The code in isolate_migratepages_block() was added in commit
    119d6d59dcc0 ("mm, compaction: avoid isolating pinned pages") before
    adding VM_BUG_ON into page_mapcount().

    This race has been predicted in 2015 by Vlastimil Babka (see link
    below).

    [akpm@linux-foundation.org: comment tweaks, per Hugh]
    Fixes: 1d148e218a0d ("mm: add VM_BUG_ON_PAGE() to page_mapcount()")
    Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Acked-by: Hugh Dickins <hughd@google.com>
    Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Acked-by: Vlastimil Babka <vbabka@suse.cz>
    Cc: David Rientjes <rientjes@google.com>
    Cc: <stable@vger.kernel.org>
    Link: http://lkml.kernel.org/r/159032779896.957378.7852761411265662220.stgit@buzz
    Link: https://lore.kernel.org/lkml/557710E1.6060103@suse.cz/
    Link: https://lore.kernel.org/linux-mm/158937872515.474360.5066096871639561424.stgit@buzz/T/ (v1)
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    include/linux/mm.h | 1 -
    1 file changed, 1 deletion(-)

    --- a/include/linux/mm.h
    +++ b/include/linux/mm.h
    @@ -446,7 +446,6 @@ static inline void page_mapcount_reset(s

    static inline int page_mapcount(struct page *page)
    {
    - VM_BUG_ON_PAGE(PageSlab(page), page);
    return atomic_read(&page->_mapcount) + 1;
    }


    \
     
     \ /
      Last update: 2020-06-01 19:58    [W:2.164 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site