Messages in this thread | | | Date | Tue, 15 Aug 2023 09:11:15 +0200 | Subject | Re: [BUG] Re: [PATCH v3 10/13] mm/khugepaged: collapse_pte_mapped_thp() with mmap_read_lock() | From | David Hildenbrand <> |
| |
On 15.08.23 08:34, Hugh Dickins wrote: > On Mon, 14 Aug 2023, Jann Horn wrote: >> On Wed, Jul 12, 2023 at 6:42 AM Hugh Dickins <hughd@google.com> wrote: >>> Bring collapse_and_free_pmd() back into collapse_pte_mapped_thp(). >>> It does need mmap_read_lock(), but it does not need mmap_write_lock(), >>> nor vma_start_write() nor i_mmap lock nor anon_vma lock. All racing >>> paths are relying on pte_offset_map_lock() and pmd_lock(), so use those. >> >> We can still have a racing userfaultfd operation at the "/* step 4: >> remove page table */" point that installs a new PTE before the page >> table is removed. >> >> To reproduce, patch a delay into the kernel like this: >> >> >> diff --git a/mm/khugepaged.c b/mm/khugepaged.c >> index 9a6e0d507759..27cc8dfbf3a7 100644 >> --- a/mm/khugepaged.c >> +++ b/mm/khugepaged.c >> @@ -20,6 +20,7 @@ >> #include <linux/swapops.h> >> #include <linux/shmem_fs.h> >> #include <linux/ksm.h> >> +#include <linux/delay.h> >> >> #include <asm/tlb.h> >> #include <asm/pgalloc.h> >> @@ -1617,6 +1618,11 @@ int collapse_pte_mapped_thp(struct mm_struct >> *mm, unsigned long addr, >> } >> >> /* step 4: remove page table */ >> + if (strcmp(current->comm, "DELAYME") == 0) { >> + pr_warn("%s: BEGIN DELAY INJECTION\n", __func__); >> + mdelay(5000); >> + pr_warn("%s: END DELAY INJECTION\n", __func__); >> + } >> >> /* Huge page lock is still held, so page table must remain empty */ >> pml = pmd_lock(mm, pmd); >> >> >> And then run the attached reproducer against mm/mm-everything. You >> should get this in dmesg: >> >> [ 206.578096] BUG: Bad rss-counter state mm:000000000942ebea >> type:MM_ANONPAGES val:1 > > Thanks a lot, Jann. I haven't thought about it at all yet; and just > tried to reproduce, but haven't yet got the "BUG: Bad rss-counter": > just see "Invalid argument" on the UFFDIO_COPY ioctl. > Will investigate tomorrow.
Maybe you're missing a fixup:
https://lkml.kernel.org/r/20230810192128.1855570-1-axelrasmussen@google.com
When the src address is not page aligned, UFFDIO_COPY in mm-unstable would erroneously fail.
-- Cheers,
David / dhildenb
| |