From: "Kirill A. Shutemov" <kirill@shutemov.name>
To: Michal Hocko <mhocko@kernel.org>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
Andrew Morton <akpm@linux-foundation.org>,
Hugh Dickins <hughd@google.com>,
Andrea Arcangeli <aarcange@redhat.com>,
Dave Hansen <dave.hansen@intel.com>,
Vlastimil Babka <vbabka@suse.cz>,
Johannes Weiner <hannes@cmpxchg.org>,
David Rientjes <rientjes@google.com>,
linux-kernel@vger.kernel.org, linux-mm@kvack.org
Subject: Re: [PATCHv2 4/4] mm: make compound_head() robust
Date: Tue, 18 Aug 2015 21:24:41 +0300 [thread overview]
Message-ID: <20150818182441.GC21383@node.dhcp.inet.fi> (raw)
In-Reply-To: <20150818164112.GN5033@dhcp22.suse.cz>
On Tue, Aug 18, 2015 at 06:41:13PM +0200, Michal Hocko wrote:
> On Tue 18-08-15 13:20:22, Michal Hocko wrote:
> > On Mon 17-08-15 18:09:05, Kirill A. Shutemov wrote:
> > > Hugh has pointed that compound_head() call can be unsafe in some
> > > context. There's one example:
> > >
> > > CPU0 CPU1
> > >
> > > isolate_migratepages_block()
> > > page_count()
> > > compound_head()
> > > !!PageTail() == true
> > > put_page()
> > > tail->first_page = NULL
> > > head = tail->first_page
> > > alloc_pages(__GFP_COMP)
> > > prep_compound_page()
> > > tail->first_page = head
> > > __SetPageTail(p);
> > > !!PageTail() == true
> > > <head == NULL dereferencing>
> > >
> > > The race is pure theoretical. I don't it's possible to trigger it in
> > > practice. But who knows.
> > >
> > > We can fix the race by changing how encode PageTail() and compound_head()
> > > within struct page to be able to update them in one shot.
> > >
> > > The patch introduces page->compound_head into third double word block in
> > > front of compound_dtor and compound_order. That means it shares storage
> > > space with:
> > >
> > > - page->lru.next;
> > > - page->next;
> > > - page->rcu_head.next;
> > > - page->pmd_huge_pte;
> > >
> > > That's too long list to be absolutely sure, but looks like nobody uses
> > > bit 0 of the word. It can be used to encode PageTail(). And if the bit
> > > set, rest of the word is pointer to head page.
> >
> > I didn't look too closely but the general idea makes sense to me and the
> > overal code simplification is sound. I will give it more detailed review
> > after I sort out other stuff.
>
> AFICS page::first_page wasn't used outside of compound page logic so you
> should remove it in this patch. The rest looks good to me.
I missed it by accident during rework for v2. Will fix.
> Acked-by: Michal Hocko <mhocko@suse.com>
Thanks!
--
Kirill A. Shutemov
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
prev parent reply other threads:[~2015-08-18 18:24 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-17 15:09 [PATCHv2 0/4] Fix compound_head() race Kirill A. Shutemov
2015-08-17 15:09 ` [PATCHv2 1/4] mm: drop page->slab_page Kirill A. Shutemov
2015-08-18 0:43 ` David Rientjes
2015-08-17 15:09 ` [PATCHv2 2/4] zsmalloc: use page->private instead of page->first_page Kirill A. Shutemov
2015-08-25 1:49 ` Sergey Senozhatsky
2015-08-25 2:17 ` Sergey Senozhatsky
2015-08-25 17:10 ` Kirill A. Shutemov
2015-08-17 15:09 ` [PATCHv2 3/4] mm: pack compound_dtor and compound_order into one word in struct page Kirill A. Shutemov
2015-08-17 22:59 ` Hugh Dickins
2015-08-18 15:43 ` Michal Hocko
2015-08-18 18:22 ` Kirill A. Shutemov
2015-08-18 16:05 ` Michal Hocko
2015-08-18 18:22 ` Kirill A. Shutemov
2015-08-17 15:09 ` [PATCHv2 4/4] mm: make compound_head() robust Kirill A. Shutemov
2015-08-18 11:20 ` Michal Hocko
2015-08-18 16:41 ` Michal Hocko
2015-08-18 18:24 ` Kirill A. Shutemov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150818182441.GC21383@node.dhcp.inet.fi \
--to=kirill@shutemov.name \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=dave.hansen@intel.com \
--cc=hannes@cmpxchg.org \
--cc=hughd@google.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@kernel.org \
--cc=rientjes@google.com \
--cc=vbabka@suse.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).