RE: [PATCH 2/3] hugetlb: fix prio_tree unit

Chen, Kenneth W
2006-10-25T23:49:29Z

[-- Attachment #1: Type: text/plain, Size: 1354 bytes --]

Hugh Dickins wrote on Wednesday, October 25, 2006 12:41 AM
> On Wed, 25 Oct 2006, David Gibson wrote:
> >
> > Hugh, I'd like to add a testcase to the libhugetlbfs testsuite which
> > will trigger this bug, but from the description above I'm not sure
> > exactly how to tickle it. Can you give some more details of what
> > sequence of calls will cause the BUG_ON() to be called.
> >
> > I've attached the skeleton test I have now, but I'm not sure if it's
> > even close to what's really required for this.
>
> I'll take a look, or reconstruct my own sequence, later on today and
> send it just to you. The BUG_ON was not at all what I was expecting,
> and I spent quite a while working out how it came about (v_offset
> wrapped, so vm_start + v_offset less than vm_start, so the huge unmap
> applied to a non-huge vma before it). Though I'm dubious whether it's
> really worthwhile devising such a test now.

It's fairly easy to reproduce. I got a test cases that easily trigger
kernel oops and even got a sequence to screw up hugepage_rsvd count.
All I have to do is to place vm_start high enough and combined with large
enough v_offset, the add "vma->vm_start + v_offset" will overflow. It
doesn't even need to be over 4GB.

Hugh, if you haven't got time to reconstruct the bug sequence, don't
bother. I'll give my test cases to David.

- Ken

[-- Attachment #2: case2.c --]
[-- Type: application/octet-stream, Size: 1296 bytes --]

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <fcntl.h>

#define FILE_NAME "/mnt/htlb/junk"
#define HPAGE_SIZE (4*1024*1024)
#define LENGTH (16UL*1024*1024)
#define TRUNCATE (0x60000000)
#define PROTECTION (PROT_READ | PROT_WRITE)
#define ADDR (void *)(0xa0000000UL)
#define FLAGS (MAP_PRIVATE)

int main(void)
{
char *addr;
int fd;
char s;
unsigned long i;

fd = open(FILE_NAME, O_CREAT | O_RDWR, 0755);
if (fd < 0) {
perror("Open failed");
exit(1);
}

addr = mmap(0, LENGTH+TRUNCATE, PROTECTION, FLAGS, fd, 0);
if (addr == MAP_FAILED) {
perror("first mmap");
unlink(FILE_NAME);
exit(1);
}
munmap(addr, LENGTH+TRUNCATE);

addr = mmap(ADDR, LENGTH, PROTECTION, FLAGS, fd, 0);
if (addr == MAP_FAILED) {
perror("secound mmap");
unlink(FILE_NAME);
exit(1);
}

for (i = 0; i < LENGTH; i+= HPAGE_SIZE)
addr[i] = 1;
printf("addr = %lx\n", addr);

ftruncate(fd, TRUNCATE);

s = addr[0];

close(fd);
unlink(FILE_NAME);

return s;
}

[-- Attachment #3: case1.c --]
[-- Type: application/octet-stream, Size: 1024 bytes --]

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <fcntl.h>

#define FILE_NAME "/mnt/htlb/junk"
#define HPAGE_SIZE (4*1024*1024)
#define LENGTH (16UL*1024*1024)
#define TRUNCATE (8UL*1024*1024)
#define PROTECTION (PROT_READ | PROT_WRITE)
#define ADDR (void *)(0xa0000000UL)
#define OFFSET (0x50000000L)
#define FLAGS (MAP_SHARED)

int main(void)
{
char *addr;
int fd;
char s;
unsigned long i;

fd = open(FILE_NAME, O_CREAT | O_RDWR, 0755);
if (fd < 0) {
perror("Open failed");
exit(1);
}

addr = mmap(ADDR, LENGTH, PROTECTION, FLAGS, fd, OFFSET);
if (addr == MAP_FAILED) {
perror("mmap");
unlink(FILE_NAME);
exit(1);
}

for (i = 0; i < LENGTH; i+= HPAGE_SIZE)
addr[i] = 1;

ftruncate(fd, TRUNCATE);
close(fd);
unlink(FILE_NAME);

return s;
}