From: Sasha Levin <sasha.levin@oracle.com>
To: Vlastimil Babka <vbabka@suse.cz>, Bob Liu <bob.liu@oracle.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org,
Mel Gorman <mgorman@suse.de>, Rik van Riel <riel@redhat.com>,
joern@logfs.org, Michel Lespinasse <walken@google.com>
Subject: Re: [PATCH 1/3] mm: munlock: fix a bug where THP tail page is encountered
Date: Fri, 14 Mar 2014 23:06:29 -0400 [thread overview]
Message-ID: <5323C3B5.4060602@oracle.com> (raw)
In-Reply-To: <532396E7.6000400@oracle.com>
On 03/14/2014 07:55 PM, Sasha Levin wrote:
> On 12/17/2013 08:00 AM, Vlastimil Babka wrote:
>> From: Vlastimil Babka<vbabka@suse.cz>
>> Date: Fri, 13 Dec 2013 14:25:21 +0100
>> Subject: [PATCH 1/3] mm: munlock: fix a bug where THP tail page is encountered
>>
>> Since commit ff6a6da60 ("mm: accelerate munlock() treatment of THP pages")
>> munlock skips tail pages of a munlocked THP page. However, when the head page
>> already has PageMlocked unset, it will not skip the tail pages.
>>
>> Commit 7225522bb ("mm: munlock: batch non-THP page isolation and
>> munlock+putback using pagevec") has added a PageTransHuge() check which
>> contains VM_BUG_ON(PageTail(page)). Sasha Levin found this triggered using
>> trinity, on the first tail page of a THP page without PageMlocked flag.
>>
>> This patch fixes the issue by skipping tail pages also in the case when
>> PageMlocked flag is unset. There is still a possibility of race with THP page
>> split between clearing PageMlocked and determining how many pages to skip.
>> The race might result in former tail pages not being skipped, which is however
>> no longer a bug, as during the skip the PageTail flags are cleared.
>>
>> However this race also affects correctness of NR_MLOCK accounting, which is to
>> be fixed in a separate patch.
>
> I've hit the same thing again, on the latest -next, this time with a different trace:
>
> [ 539.199120] page:ffffea0013249a80 count:0 mapcount:1 mapping: (null) index:0x0
> [ 539.200429] page flags: 0x12fffff80008000(tail)
> [ 539.201167] ------------[ cut here ]------------
> [ 539.201889] kernel BUG at include/linux/page-flags.h:415!
> [ 539.202859] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
> [ 539.204588] Dumping ftrace buffer:
> [ 539.206415] (ftrace buffer empty)
> [ 539.207022] Modules linked in:
> [ 539.207503] CPU: 3 PID: 18262 Comm: trinity-c228 Tainted: G W 3.14.0-rc6-next-20140313-sasha-00010-gb8c1db1-dirty #217
> [ 539.209012] task: ffff880627b10000 ti: ffff8805a44c2000 task.ti: ffff8805a44c2000
> [ 539.209989] RIP: munlock_vma_pages_range+0x93/0x1d0 (include/linux/page-flags.h:415 mm/mlock.c:494)
> [ 539.210263] RSP: 0000:ffff8805a44c3e08 EFLAGS: 00010246
> [ 539.210263] RAX: ffff88052ae126a0 RBX: 000000000006a000 RCX: 0000000000000099
> [ 539.210263] RDX: 0000000000000000 RSI: ffff880627b10cf0 RDI: 0000000004c926a0
> [ 539.210263] RBP: ffff8805a44c3ec8 R08: 0000000000000001 R09: 0000000000000001
> [ 539.210263] R10: 0000000000000001 R11: 0000000000000001 R12: ffffea0013249a80
> [ 539.210263] R13: ffff88039dc95a00 R14: 000000000006b000 R15: ffff8805a44c3e94
> [ 539.210263] FS: 00007fd6ce14a700(0000) GS:ffff88042b800000(0000) knlGS:0000000000000000
> [ 539.210263] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [ 539.210263] CR2: 00007fd6ce0ef6ac CR3: 00000006025cd000 CR4: 00000000000006a0
> [ 539.210263] DR0: 0000000000698000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 539.210263] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
> [ 539.210263] Stack:
> [ 539.210263] 0000000000000000 0000000000000000 00018805a44c3e38 0000000000000000
> [ 539.210263] 0000000000000000 ffff88039dc95a00 00000000a44c3e88 0000000000000000
> [ 539.210263] 00ff8805a44c3e58 ffff880528f0a0f0 ffff8805a44c3eb8 ffff88039dc95a00
> [ 539.210263] Call Trace:
> [ 539.210263] do_munmap+0x1d2/0x360 (mm/internal.h:168 mm/mmap.c:2547)
> [ 539.210263] ? down_write+0xa6/0xc0 (kernel/locking/rwsem.c:51)
> [ 539.210263] ? vm_munmap+0x46/0x80 (mm/mmap.c:2571)
> [ 539.210263] vm_munmap+0x54/0x80 (mm/mmap.c:2572)
> [ 539.210263] SyS_munmap+0x2c/0x40 (mm/mmap.c:2577)
> [ 539.210263] tracesys+0xdd/0xe2 (arch/x86/kernel/entry_64.S:749)
> [ 539.210263] Code: ff 49 89 c4 48 85 c0 0f 84 f3 00 00 00 48 3d 00 f0 ff ff 0f 87 e7 00 00 00 48 8b 00 66 85 c0 79 17 31 f6 4c 89 e7 e8 4d d2 fc ff <0f> 0b 0f 1f 00 eb fe 66 0f 1f 44 00 00 49 8b 04 24 f6 c4 40 74
> [ 539.210263] RIP munlock_vma_pages_range+0x93/0x1d0 (include/linux/page-flags.h:415 mm/mlock.c:494)
> [ 539.210263] RSP <ffff8805a44c3e08>
> [ 539.236666] ---[ end trace 4e90dc9141579181 ]---
>
>
> Thanks,
> Sasha
And another related trace:
[ 741.192502] kernel BUG at mm/mlock.c:528!
[ 741.193088] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 741.194177] Dumping ftrace buffer:
[ 741.194645] (ftrace buffer empty)
[ 741.195109] Modules linked in:
[ 741.195728] CPU: 23 PID: 19908 Comm: trinity-c264 Tainted: G W 3.14.0-rc6-next-20140314-sasha-00012-g5590866 #219
[ 741.197549] task: ffff88061fc2b000 ti: ffff8805decb8000 task.ti: ffff8805decb8000
[ 741.198548] RIP: munlock_vma_pages_range+0x176/0x1d0 (mm/mlock.c:528)
[ 741.199754] RSP: 0018:ffff8805decb9e08 EFLAGS: 00010206
[ 741.200085] RAX: 00000000000001ff RBX: 0000000000111000 RCX: 0000000000000000
[ 741.200085] RDX: 0000000000000111 RSI: ffffffff81295fdd RDI: ffffffff84490705
[ 741.200085] RBP: ffff8805decb9ec8 R08: 0000000000000000 R09: 0000000000000000
[ 741.200085] R10: 0000000000000001 R11: 0000000000000000 R12: fffffffffffffff2
[ 741.200085] R13: ffff880221044e00 R14: 0000000000112000 R15: ffff8805decb9e94
[ 741.200085] FS: 00007f4bec6bc700(0000) GS:ffff88082ba00000(0000) knlGS:0000000000000000
[ 741.200085] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 741.200085] CR2: 0000000003109a98 CR3: 00000005decaf000 CR4: 00000000000006a0
[ 741.200085] Stack:
[ 741.200085] 0000000000000000 0000000000000000 00018805decb9e38 0000000000000000
[ 741.200085] 0000000000000000 ffff880221044e00 00000000decb9e88 0000000000000000
[ 741.200085] 00ff8805decb9e58 ffff880ff376f450 ffff8805decb9eb8 ffff880221044e00
[ 741.200085] Call Trace:
[ 741.200085] do_munmap+0x1d2/0x360 (mm/internal.h:168 mm/mmap.c:2547)
[ 741.200085] ? down_write+0xa6/0xc0 (kernel/locking/rwsem.c:51)
[ 741.200085] ? vm_munmap+0x46/0x80 (mm/mmap.c:2571)
[ 741.200085] vm_munmap+0x54/0x80 (mm/mmap.c:2572)
[ 741.200085] SyS_munmap+0x2c/0x40 (mm/mmap.c:2577)
[ 741.200085] tracesys+0xdd/0xe2 (arch/x86/kernel/entry_64.S:749)
[ 741.200085] Code: fd ff ff 4c 89 e6 48 89 c3 48 8d bd 40 ff ff ff e8 80 fa ff ff eb 2f 66 0f 1f 44 00 00 8b 45 cc 48 89 da 48 c1 ea 0c 85 d0 74 12 <0f> 0b 0f 1f 84 00 00 00 00 00 eb fe 66 0f 1f 44 00 00 ff c0 48
[ 741.200085] RIP munlock_vma_pages_range+0x176/0x1d0 (mm/mlock.c:528)
[ 741.200085] RSP <ffff8805decb9e08>
Thanks,
Sasha
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2014-03-15 3:16 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-08 1:52 kernel BUG in munlock_vma_pages_range Sasha Levin
2013-12-09 9:34 ` Vlastimil Babka
2013-12-09 17:05 ` Sasha Levin
2013-12-09 17:12 ` Vlastimil Babka
2013-12-09 17:15 ` Sasha Levin
2013-12-09 20:26 ` Sasha Levin
2013-12-11 22:59 ` Vlastimil Babka
2013-12-12 3:16 ` Sasha Levin
2013-12-12 5:03 ` Bob Liu
2013-12-12 12:41 ` Vlastimil Babka
2013-12-12 21:05 ` Sasha Levin
2013-12-13 8:49 ` Bob Liu
2013-12-13 9:08 ` Vlastimil Babka
2013-12-15 19:49 ` Sasha Levin
2013-12-16 10:14 ` [PATCH 0/3] Fix bugs in munlock Vlastimil Babka
2013-12-16 10:14 ` [PATCH 1/3] mm: munlock: fix a bug where THP tail page is encountered Vlastimil Babka
2013-12-17 1:26 ` Bob Liu
2013-12-17 13:00 ` Vlastimil Babka
2013-12-18 0:48 ` Bob Liu
2014-03-14 23:55 ` Sasha Levin
2014-03-15 3:06 ` Sasha Levin [this message]
2014-03-17 12:38 ` Vlastimil Babka
2014-03-17 21:08 ` Sasha Levin
2014-03-17 22:20 ` Vlastimil Babka
2014-03-17 22:58 ` Sasha Levin
2014-03-17 23:30 ` Vlastimil Babka
2014-03-18 10:41 ` Vlastimil Babka
2013-12-16 10:14 ` [PATCH 2/3] mm: munlock: fix deadlock in __munlock_pagevec() Vlastimil Babka
2013-12-17 0:31 ` Andrew Morton
2013-12-17 13:08 ` Vlastimil Babka
2013-12-16 10:14 ` [RFC PATCH 3/3] mm: munlock: fix potential race with THP page split Vlastimil Babka
2014-03-21 1:53 ` kernel BUG in munlock_vma_pages_range Sasha Levin
2014-03-21 9:02 ` Vlastimil Babka
2013-12-09 21:16 ` Jiri Kosina
2013-12-11 15:55 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5323C3B5.4060602@oracle.com \
--to=sasha.levin@oracle.com \
--cc=akpm@linux-foundation.org \
--cc=bob.liu@oracle.com \
--cc=joern@logfs.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mgorman@suse.de \
--cc=riel@redhat.com \
--cc=vbabka@suse.cz \
--cc=walken@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).