Messages in this thread | | | From | Yang Shi <> | Date | Tue, 21 Dec 2021 11:07:03 -0800 | Subject | Re: [syzbot] kernel BUG in __page_mapcount |
| |
On Tue, Dec 21, 2021 at 10:40 AM Matthew Wilcox <willy@infradead.org> wrote: > > On Tue, Dec 21, 2021 at 10:24:27AM -0800, Yang Shi wrote: > > It seems the THP is split during smaps walk. The reproducer does call > > MADV_FREE on partial THP which may split the huge page. > > > > The below fix (untested) should be able to fix it. > > Did you read the rest of the thread on this? If the page is being > migrated, we should still account it ... also, you've changed the
Yes, the being migrated pages may be skipped. We should be able to add a new flag to smaps_account() to indicate this is a migration entry then don't elevate the page count.
> refcount, so this: > > if (page_count(page) == 1) { > smaps_page_accumulate(mss, page, size, size << PSS_SHIFT, dirty, > locked, true); > return; > } > > will never trigger.
The get_page_unless_zero() is called after this block.
| |