From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wi0-f172.google.com (mail-wi0-f172.google.com [209.85.212.172]) by kanga.kvack.org (Postfix) with ESMTP id DBA076B025B for ; Fri, 25 Sep 2015 15:33:09 -0400 (EDT) Received: by wicgb1 with SMTP id gb1so33739868wic.1 for ; Fri, 25 Sep 2015 12:33:09 -0700 (PDT) Received: from mail-wi0-f178.google.com (mail-wi0-f178.google.com. [209.85.212.178]) by mx.google.com with ESMTPS id k8si6315022wif.54.2015.09.25.12.33.08 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 25 Sep 2015 12:33:08 -0700 (PDT) Received: by wiclk2 with SMTP id lk2so32379978wic.1 for ; Fri, 25 Sep 2015 12:33:08 -0700 (PDT) Date: Fri, 25 Sep 2015 22:33:06 +0300 From: "Kirill A. Shutemov" Subject: Re: Multiple potential races on vma->vm_flags Message-ID: <20150925193306.GA2200@node.dhcp.inet.fi> References: <20150911103959.GA7976@node.dhcp.inet.fi> <55F8572D.8010409@oracle.com> <20150915190143.GA18670@node.dhcp.inet.fi> <560346F2.4050507@oracle.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <560346F2.4050507@oracle.com> Sender: owner-linux-mm@kvack.org List-ID: To: Sasha Levin Cc: Andrey Konovalov , Hugh Dickins , Davidlohr Bueso , Oleg Nesterov , Rik van Riel , Andrew Morton , Dmitry Vyukov , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Vlastimil Babka On Wed, Sep 23, 2015 at 08:42:26PM -0400, Sasha Levin wrote: > On 09/23/2015 09:08 AM, Andrey Konovalov wrote: > > On Wed, Sep 23, 2015 at 3:39 AM, Hugh Dickins wrote: > >> > This is totally untested, and one of you may quickly prove me wrong; > >> > but I went in to fix your "Bad page state (mlocked)" by holding pte > >> > lock across the down_read_trylock of mmap_sem in try_to_unmap_one(), > >> > then couldn't see why it would need mmap_sem at all, given how mlock > >> > and munlock first assert intention by setting or clearing VM_LOCKED > >> > in vm_flags, then work their way up the vma, taking pte locks. > >> > > >> > Calling mlock_vma_page() under pte lock may look suspicious > >> > at first: but what it does is similar to clear_page_mlock(), > >> > which we regularly call under pte lock from page_remove_rmap(). > >> > > >> > I'd rather wait to hear whether this appears to work in practice, > >> > and whether you agree that it should work in theory, before writing > >> > the proper description. I'd love to lose that down_read_trylock. > > No, unfortunately it doesn't work, I still see "Bad page state (mlocked)". > > > > It seems that your patch doesn't fix the race from the report below, since pte > > lock is not taken when 'vma->vm_flags &= ~VM_LOCKED;' (mlock.c:425) > > is being executed. (Line numbers are from kernel with your patch applied.) > > I've fired up my HZ_10000 patch, Can we make HZ_10000 thing into upstream? Under KERNEL_DEBUG, or something? > and this seems to be a real race that is > somewhat easy to reproduce under those conditions. > > Here's a fresh backtrace from my VMs: > > [1935109.882343] BUG: Bad page state in process trinity-subchil pfn:3ca200 > [1935109.884000] page:ffffea000f288000 count:0 mapcount:0 mapping: (null) index:0x1e00 compound_mapcount: 0 > [1935109.885772] flags: 0x22fffff80144008(uptodate|head|swapbacked|mlocked) > [1935109.887174] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set > [1935109.888197] bad because of flags: > [1935109.888759] flags: 0x100000(mlocked) > [1935109.889525] Modules linked in: > [1935109.890165] CPU: 8 PID: 2615 Comm: trinity-subchil Not tainted 4.3.0-rc2-next-20150923-sasha-00079-gec04207-dirty #2569 > [1935109.891876] 1ffffffff6445448 00000000e5dca494 ffff8803f7657708 ffffffffa70402da > [1935109.893504] ffffea000f288000 ffff8803f7657738 ffffffffa56e522b 022fffff80144008 > [1935109.894947] ffffea000f288020 ffffea000f288000 00000000ffffffff ffff8803f76577a8 > [1935109.896413] Call Trace: > [1935109.899102] [] dump_stack+0x4e/0x84 > [1935109.899821] [] bad_page+0x17b/0x210 > [1935109.900469] [] free_pages_prepare+0xb48/0x1110 > [1935109.902127] [] __free_pages_ok+0x21/0x260 > [1935109.904435] [] free_compound_page+0x63/0x80 > [1935109.905614] [] free_transhuge_page+0x6e/0x80 > [1935109.906752] [] __put_compound_page+0x76/0xa0 > [1935109.907884] [] release_pages+0x4d5/0x9f0 > [1935109.913027] [] tlb_flush_mmu_free+0x8a/0x120 > [1935109.913957] [] unmap_page_range+0xe73/0x1460 > [1935109.915737] [] unmap_single_vma+0x126/0x2f0 > [1935109.916646] [] unmap_vmas+0xdd/0x190 > [1935109.917454] [] exit_mmap+0x221/0x430 > [1935109.921176] [] mmput+0xb1/0x240 > [1935109.921919] [] do_exit+0x732/0x27c0 > [1935109.928561] [] do_group_exit+0xf9/0x300 > [1935109.929786] [] SyS_exit_group+0x1d/0x20 > [1935109.930617] [] entry_SYSCALL_64_fastpath+0x16/0x7a Would it make any difference if you'll add mmap_sem protection in exit_mmap? -- Kirill A. Shutemov -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org