[Question] race condition in mm/page_alloc.c regarding page->lru?

[minchan.kim@gmail.com (Minchan Kim)]

On Fri, Apr 2, 2010 at 4:00 PM, TAO HU <tghk48@motorola.com> wrote:
> Hi, kamezawa hiroyu
>
> Thanks for the hint!
>
> Hi, Minchan Kim
>
> Sorry. Not exactly sure your idea about <grep "page handling">.
> Below is a result of $ grep -n -r "list_del(&page->lru)" * in our src tree

It's not enough.
Maybe you have to review your's patches based on mainline.

>
> arch/s390/mm/pgtable.c:83: ? ? ?list_del(&page->lru);
> arch/s390/mm/pgtable.c:226: ? ? ? ? ? ? list_del(&page->lru);
> arch/x86/mm/pgtable.c:60: ? ? ? list_del(&page->lru);
> drivers/xen/balloon.c:154: ? ? ?list_del(&page->lru);
> drivers/virtio/virtio_balloon.c:143: ? ? ? ? ? ?list_del(&page->lru);
> fs/cifs/file.c:1780: ? ? ? ? ? ?list_del(&page->lru);
> fs/btrfs/extent_io.c:2584: ? ? ? ? ? ? ?list_del(&page->lru);
> fs/mpage.c:388: ? ? ? ? list_del(&page->lru);
> include/linux/mm_inline.h:37: ? list_del(&page->lru);
> include/linux/mm_inline.h:47: ? list_del(&page->lru);
> kernel/kexec.c:391: ? ? ? ? ? ? list_del(&page->lru);
> kernel/kexec.c:711: ? ? ? ? ? ? ? ? ? ? list_del(&page->lru);
> mm/migrate.c:69: ? ? ? ? ? ? ? ?list_del(&page->lru);
> mm/migrate.c:695: ? ? ? ? ? ? ? list_del(&page->lru);
> mm/hugetlb.c:467: ? ? ? ? ? ? ? ? ? ? ? list_del(&page->lru);
> mm/hugetlb.c:509: ? ? ? ? ? ? ? ? ? ? ? list_del(&page->lru);
> mm/hugetlb.c:836: ? ? ? ? ? ? ? list_del(&page->lru);
> mm/hugetlb.c:844: ? ? ? ? ? ? ? ? ? ? ? list_del(&page->lru);
> mm/hugetlb.c:900: ? ? ? ? ? ? ? ? ? ? ? list_del(&page->lru);
> mm/hugetlb.c:1130: ? ? ? ? ? ? ? ? ? ? ?list_del(&page->lru);
> mm/hugetlb.c:1809: ? ? ? ? ? ? ?list_del(&page->lru);
> mm/vmscan.c:597: ? ? ? ? ? ? ? ?list_del(&page->lru);
> mm/vmscan.c:1148: ? ? ? ? ? ? ? ? ? ? ? list_del(&page->lru);
> mm/vmscan.c:1246: ? ? ? ? ? ? ? list_del(&page->lru);
> mm/slub.c:827: ?list_del(&page->lru);
> mm/slub.c:1249: list_del(&page->lru);
> mm/slub.c:1263: ? ? ? ? list_del(&page->lru);
> mm/slub.c:2419: ? ? ? ? ? ? ? ? list_del(&page->lru);
> mm/slub.c:2809: ? ? ? ? ? ? ? ? ? ? ? ? list_del(&page->lru);
> mm/readahead.c:65: ? ? ? ? ? ? ?list_del(&page->lru);
> mm/readahead.c:100: ? ? ? ? ? ? list_del(&page->lru);
> mm/page_alloc.c:532: ? ? ? ? ? ?list_del(&page->lru);
> mm/page_alloc.c:679: ? ? ? ? ? ?list_del(&page->lru);
> mm/page_alloc.c:741: ? ? ? ? ? ?list_del(&page->lru);
> mm/page_alloc.c:820: ? ? ? ? ? ? ? ? ? ?list_del(&page->lru);
> mm/page_alloc.c:1107: ? ? ? ? ? list_del(&page->lru);
> mm/page_alloc.c:4784: ? ? ? ? ? list_del(&page->lru);
>
There are normal caller.
I expected some bogus driver of out-of-mainline uses page directly
without enough review.

Is your kernel working well except this bug?
Do you see same oops call trace(about page-allocator) whenever kernel
panic happens?

I mean if something not page-allocadtor breaks memory, you can see
other symptoms. so we can doubt others(H/W, other subsystem).

-- 
Kind regards,
Minchan Kim