Re: [PATCH 2/4] thp: fix regression in handling mlocked pages in __split_huge_pmd()

["Kirill A. Shutemov" <kirill@shutemov.name>]

On Thu, Dec 24, 2015 at 10:51:43AM -0800, Dan Williams wrote:
> On Thu, Dec 24, 2015 at 3:51 AM, Kirill A. Shutemov
> <kirill.shutemov@linux.intel.com> wrote:
> > This patch fixes regression caused by patch
> >  "mm, dax: dax-pmd vs thp-pmd vs hugetlbfs-pmd"
> >
> > The patch makes pmd_trans_huge() check and "page = pmd_page(*pmd)" after
> > __split_huge_pmd_locked(). It can never succeed, since the pmd already
> > points to a page table. As result the page is never get munlocked.
> >
> > It causes crashes like this:
> >  http://lkml.kernel.org/r/5661FBB6.6050307@oracle.com
> >
> > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> > Reported-by: Sasha Levin <sasha.levin@oracle.com>
> > Cc: Dan Williams <dan.j.williams@intel.com>
> > ---
> >  mm/huge_memory.c | 8 +++-----
> >  1 file changed, 3 insertions(+), 5 deletions(-)
> >
> > diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> > index 99f2a0ecb621..1a988d9b86ef 100644
> > --- a/mm/huge_memory.c
> > +++ b/mm/huge_memory.c
> > @@ -3024,14 +3024,12 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
> >         ptl = pmd_lock(mm, pmd);
> >         if (unlikely(!pmd_trans_huge(*pmd) && !pmd_devmap(*pmd)))
> >                 goto out;
> > -       __split_huge_pmd_locked(vma, pmd, haddr, false);
> > -
> > -       if (pmd_trans_huge(*pmd))
> > -               page = pmd_page(*pmd);
> > -       if (page && PageMlocked(page))
> > +       page = pmd_page(*pmd);
> > +       if (PageMlocked(page))
> >                 get_page(page);
> >         else
> >                 page = NULL;
> > +       __split_huge_pmd_locked(vma, pmd, haddr, false);
> 
> Since dax pmd mappings may not have a backing struct page I think this
> additionally needs the following:
> 
> 8<-----
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 4eae97325e95..c4eccfa836f4 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -3025,11 +3025,13 @@ void __split_huge_pmd(struct vm_area_struct
> *vma, pmd_t *pmd,
>        ptl = pmd_lock(mm, pmd);
>        if (unlikely(!pmd_trans_huge(*pmd) && !pmd_devmap(*pmd)))
>                goto out;
> -       page = pmd_page(*pmd);
> -       if (PageMlocked(page))
> -               get_page(page);
> -       else
> -               page = NULL;
> +       else if (pmd_trans_huge(*pmd)) {
> +               page = pmd_page(*pmd);
> +               if (PageMlocked(page))
> +                       get_page(page);
> +               else
> +                       page = NULL;
> +       }
>        __split_huge_pmd_locked(vma, pmd, haddr, false);
> out:
>        spin_unlock(ptl);
> 

Right, I've missed that. Here's updated patch.