From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1057EC47422 for ; Mon, 29 Jan 2024 12:45:41 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 8C8906B0082; Mon, 29 Jan 2024 07:45:40 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 8780A6B0089; Mon, 29 Jan 2024 07:45:40 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 740816B008A; Mon, 29 Jan 2024 07:45:40 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 614A06B0082 for ; Mon, 29 Jan 2024 07:45:40 -0500 (EST) Received: from smtpin17.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 1EABC140A15 for ; Mon, 29 Jan 2024 12:45:40 +0000 (UTC) X-FDA: 81732320040.17.F70A530 Received: from mail-ed1-f53.google.com (mail-ed1-f53.google.com [209.85.208.53]) by imf19.hostedemail.com (Postfix) with ESMTP id 48FDC1A0018 for ; Mon, 29 Jan 2024 12:45:38 +0000 (UTC) Authentication-Results: imf19.hostedemail.com; dkim=none; dmarc=none; spf=pass (imf19.hostedemail.com: domain of breno.debian@gmail.com designates 209.85.208.53 as permitted sender) smtp.mailfrom=breno.debian@gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1706532338; a=rsa-sha256; cv=none; b=k26ZnnK50rD34JjO2UUjRGDlHAX5bEobMF3e+J8mV4/00sUPtzECzxP00LaOllPgSSwJcH GrCu/S3tuptZcLWsAFws76XuaJVbNLhAZ7EtbrWpAx/4rGuOKtNaFofJNlb4Ajrh5nJOkP AOALdJp1qfygdfD5K7QQZdSOOaPzQ3w= ARC-Authentication-Results: i=1; imf19.hostedemail.com; dkim=none; dmarc=none; spf=pass (imf19.hostedemail.com: domain of breno.debian@gmail.com designates 209.85.208.53 as permitted sender) smtp.mailfrom=breno.debian@gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1706532338; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/XBG9kFEaRnAAH7vBNHAabPo0iBDwnoKijQp+k7kbBw=; b=jEdf8qnNbGm+chKuMsm040IUEBtMe9eOFCNRoWIYTa7NsAzV+HSBc6QEWOSKPzACIbrh1j /IfFUfWb3O9h28BiJqXZuVlqQOQ5Ojp6wELmBrhAd7qo333HYEFR4QM+9epBkhKMt2iKLh 3ewOB9MoRA+FHv1fSwMwSfkX6KUF8Iw= Received: by mail-ed1-f53.google.com with SMTP id 4fb4d7f45d1cf-55eedf5a284so1365972a12.1 for ; Mon, 29 Jan 2024 04:45:37 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706532337; x=1707137137; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=/XBG9kFEaRnAAH7vBNHAabPo0iBDwnoKijQp+k7kbBw=; b=WVWWTypcDxThOkZygZiIkYBR8n5kozKJY+cnzYtvBDGuQ70DyxjXzBSpaLIz5MAVzP XYJMn8GpoBt1GY6lY7zbzFvJfjJeG42yMXUxZhvGLDv333bNMyQGlh0Y7/CzofGjLrbI 6RrNS6sQHanVpAwTh0+aHLB+2xUOaOdWesuOvn/0wi1oroU8Mtt0bFldyGLB/zs0rlW2 xBDILprxXSXpPx1XVuIEwn5FyuAcXb+zUpecgipHFCMaLgs/hHYrGmOdaUIVl+iE6fhD kzFI8FpiIDhvJOcruJ/JA3nQSFbl26Gle2wFaydGeLJkQzY04oFmtSL+/4SuIeHZfhF5 1NGQ== X-Gm-Message-State: AOJu0YxWvcXbhs079yzvMUZycEY1m4i8yDwAiBNS4CHt+34RMK16qZiY o14Wnne1luCSLkUCdg7DI4XUReaw8LwOW9leHS5mqRDWyKj07e1P X-Google-Smtp-Source: AGHT+IFWCfE0GI5vHIVPrNSMYwLdUjsx2uLON4IZW8QzhSo44niCSgeugPXbLnsIcOeVK17JCtnuuA== X-Received: by 2002:aa7:d8d0:0:b0:55e:faef:b1fd with SMTP id k16-20020aa7d8d0000000b0055efaefb1fdmr1731568eds.2.1706532336550; Mon, 29 Jan 2024 04:45:36 -0800 (PST) Received: from gmail.com (fwdproxy-cln-011.fbsv.net. [2a03:2880:31ff:b::face:b00c]) by smtp.gmail.com with ESMTPSA id a20-20020aa7d754000000b0055efeee7722sm1005959eds.79.2024.01.29.04.45.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 29 Jan 2024 04:45:36 -0800 (PST) Date: Mon, 29 Jan 2024 04:45:34 -0800 From: Breno Leitao To: Ryan Roberts Cc: Muchun Song , Andrew Morton , lstoakes@gmail.com, willy@infradead.org, mike.kravetz@oracle.com, Rik van Riel , "open list:HUGETLB SUBSYSTEM" , open list Subject: Re: [PATCH 1/2] mm/hugetlb: Restore the reservation if needed Message-ID: References: <20240117171058.2192286-1-leitao@debian.org> <7a0d92a9-f28c-4f3c-b956-1157e614dcbe@arm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <7a0d92a9-f28c-4f3c-b956-1157e614dcbe@arm.com> X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: 48FDC1A0018 X-Stat-Signature: oj1t5x8px759g9hfjdetkhsodwsj1fwq X-Rspam-User: X-HE-Tag: 1706532338-250636 X-HE-Meta: U2FsdGVkX1+tJd+DcO1HyeCmjVflT+N0CrfblU7FUvnYAlPFwYpn1QtJ0s+0oufYQMBCa/N+3ZOnEBcrk0+o4pYvOTm2tvgpB0it9UZwwhOT1cltqnZ9QHAjWiosg4fKcA3nyKzM7CoGODe3rLBdru0Pa6SX3D/3zPuNaFtYJA77aOLvv4K0kl6T3K5r/mPeAimI/AkRhriP/KTrTCZ3ly83f3GwrZsanwuR8MUvWg4b4jiVF8f51+naWPTtHIWU5aA1wKKlpCfhV3JNolEuewuja+Pk1m6lKRyoz0sCF/KYQQQmBxfWK9+U6u7jcUi1wxMPkYMGaxT2Ap8DBN5wNWYQib/eZ/1FLO8wBs/rSrMgT1HNyrZqhvN4n2m/PfW1OeGPWl18hWKJwEqchchExGc4wAls2B4hr4jfp/lHxM2gi9MDfPdRGxNZElXiMkq86PqNyy3fIp6WR95gb6JxnUwWMKmSIAK4iOjewQGOTMxHdfSGZEEzg3hGsxk15T6KFM67vrFt2vfEtXhVT+SEB8XtgEHE7Kwlh1qKoqykklE1T9fEzaIn3pIRe3aiX1+U072EPXxsc+aQQ49xGCL8FQsiaRahosz/YCnpkrIsOIG8irEW/i6WpgOxLRkCDWwj1FiDLwfhThB9LIFfQ/DzOHTDX+FBpMbs3emd2AQT+RxyegKLnkiE1bFCZZU2ZIbcwsG2OmwNdeENWK7RId374Agi1tCgcUkeSpKxa6dNLdKyH0OBtKYnTxLq7Ov/d1fCOjxQ+sWFAZah6Kc/J4UZSkJh7U0AR40pW2poxl6Q6L+o5I42dRT9IczumijGLPtrYcp/2Oz0G8bLp6X5mOS29LERfzwkrobjA3InyxuNtZVY16kl4TCB+QlTcOrdO7Wiq/Kry3SeawFYtNprjL5LE7x8WrAMsYXOhcn1mJNsuoxYRSLmFiOazeZ8TYUUTgGxuTMjXemIvNoISTnWQ++ oREyHJ+/ E3PHvW4mNSkltlJ/TUnKhn9B5rYs9L7MJknk3rVLKgd32kSkOXE4dvK+xbd1XU2kj9o/p9m3ABQconCOegTXPP8kAsMx69uxmR9IAOuQGvxQ4YWHgI51Vu9U2T5GupyIjMt6rGR173epQ7cAKAFFs5ItvuyEMf8n33nUttTIXfQybpyGjYjYJKgPqWOb3y18N8BAzyuTkkARyMadutcYSTvp8dKQVfl44yKeAlyP1UsRKrGumJDRk+xZyLxV55b3gLMjlf71Z7xSVavh9AElU4KSxLAc5v6gaULALptSyjtwQo2AkGptRWWo1XCortSYK+a81UaSYySU++hC12cfY1jOEdVR22ZvTZgX8dpw/ckTOhNNbtJl/73M7UkNN+ArMiA5fEdFNvoaBhNXeszjVR4XbdjYQLIhx57jz4KjIaxurj7GsBIUBl2TU/uKlwcsmHnFmQuN0hW/dgaffzcwgRWKZiB9QggVsRVV/MTo/UiQlaLzdJwZXaeO5xyfzmoB3CkixjWjVsFMt/hSt/FU3i5IKzrDFxLp74M6Z X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Wed, Jan 24, 2024 at 09:22:03AM +0000, Ryan Roberts wrote: > On 17/01/2024 17:10, Breno Leitao wrote: > > Currently there is a bug that a huge page could be stolen, and when the > > original owner tries to fault in it, it causes a page fault. > > > > You can achieve that by: > > 1) Creating a single page > > echo 1 > /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages > > > > 2) mmap() the page above with MAP_HUGETLB into (void *ptr1). > > * This will mark the page as reserved > > 3) touch the page, which causes a page fault and allocates the page > > * This will move the page out of the free list. > > * It will also unreserved the page, since there is no more free > > page > > 4) madvise(MADV_DONTNEED) the page > > * This will free the page, but not mark it as reserved. > > 5) Allocate a secondary page with mmap(MAP_HUGETLB) into (void *ptr2). > > * it should fail, but, since there is no more available page. > > * But, since the page above is not reserved, this mmap() succeed. > > 6) Faulting at ptr1 will cause a SIGBUS > > * it will try to allocate a huge page, but there is none > > available > > > > A full reproducer is in selftest. See > > https://lore.kernel.org/all/20240105155419.1939484-1-leitao@debian.org/ > > > > Fix this by restoring the reserved page if necessary. If the page being > > unmapped has HPAGE_RESV_OWNER set, and needs a reservation, set the > > restore_reserve flag, which will move the page from free to reserved. > > > > Suggested-by: Rik van Riel > > Signed-off-by: Breno Leitao > > --- > > mm/hugetlb.c | 10 ++++++++++ > > 1 file changed, 10 insertions(+) > > > > diff --git a/mm/hugetlb.c b/mm/hugetlb.c > > index ed1581b670d4..fa2c17767e44 100644 > > --- a/mm/hugetlb.c > > +++ b/mm/hugetlb.c > > @@ -5677,6 +5677,16 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, > > hugetlb_count_sub(pages_per_huge_page(h), mm); > > hugetlb_remove_rmap(page_folio(page)); > > > > + if (is_vma_resv_set(vma, HPAGE_RESV_OWNER) && > > + vma_needs_reservation(h, vma, start)) { > > + /* > > + * Restore the reservation if needed, otherwise the > > + * backing page could be stolen by someone. > > + */ > > + folio_set_hugetlb_restore_reserve(page_folio(page)); > > + vma_add_reservation(h, vma, address); > > + } > > + > > spin_unlock(ptl); > > tlb_remove_page_size(tlb, page, huge_page_size(h)); > > /* > > Hi Breno, > > I'm seeing a kernel bug fire when running the "map_hugetlb" mm selftest against latest mm-unstable. Bisect tells me this patch is culprit. I'm running on arm64 with defconfig plus the following: Hello Ryan, Thanks for the heads-up. I was able to reproduce the problem, and I am working on a solution. Thanks,