From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758119AbcBXIjY (ORCPT ); Wed, 24 Feb 2016 03:39:24 -0500 Received: from e06smtp13.uk.ibm.com ([195.75.94.109]:60667 "EHLO e06smtp13.uk.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753666AbcBXIjW (ORCPT ); Wed, 24 Feb 2016 03:39:22 -0500 X-IBM-Helo: d06dlp02.portsmouth.uk.ibm.com X-IBM-MailFrom: schwidefsky@de.ibm.com X-IBM-RcptTo: linux-kernel@vger.kernel.org;linux-s390@vger.kernel.org Date: Wed, 24 Feb 2016 09:39:15 +0100 From: Martin Schwidefsky To: "Kirill A. Shutemov" Cc: Gerald Schaefer , Christian Borntraeger , "Kirill A. Shutemov" , linux-mm@kvack.org, linux-kernel@vger.kernel.org, "Aneesh Kumar K.V" , Andrew Morton , Linus Torvalds , Michael Ellerman , Benjamin Herrenschmidt , Paul Mackerras , linuxppc-dev@lists.ozlabs.org, Catalin Marinas , Will Deacon , linux-arm-kernel@lists.infradead.org, Heiko Carstens , linux-s390@vger.kernel.org, Sebastian Ott Subject: Re: [BUG] random kernel crashes after THP rework on s390 (maybe also on PowerPC and ARM) Message-ID: <20160224093915.6e163a33@mschwide> In-Reply-To: <20160223193345.GC21820@node.shutemov.name> References: <20160211192223.4b517057@thinkpad> <20160211190942.GA10244@node.shutemov.name> <20160211205702.24f0d17a@thinkpad> <20160212154116.GA15142@node.shutemov.name> <56BE00E7.1010303@de.ibm.com> <20160212181640.4eabb85f@thinkpad> <20160223103221.GA1418@node.shutemov.name> <20160223191907.25719a4d@thinkpad> <20160223193345.GC21820@node.shutemov.name> X-Mailer: Claws Mail 3.9.3 (GTK+ 2.24.23; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16022408-0013-0000-0000-000008BF429F Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 23 Feb 2016 22:33:45 +0300 "Kirill A. Shutemov" wrote: > On Tue, Feb 23, 2016 at 07:19:07PM +0100, Gerald Schaefer wrote: > > I'll check with Martin, maybe it is actually trivial, then we can > > do a quick test it to rule that one out. > > Oh. I found a bug in __split_huge_pmd_locked(). Although, not sure if it's > _the_ bug. > > pmdp_invalidate() is called for the wrong address :-/ > I guess that can be destructive on the architecture, right? > > Could you check this? > > diff --git a/mm/huge_memory.c b/mm/huge_memory.c > index 1c317b85ea7d..4246bc70e55a 100644 > --- a/mm/huge_memory.c > +++ b/mm/huge_memory.c > @@ -2865,7 +2865,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, > pgtable = pgtable_trans_huge_withdraw(mm, pmd); > pmd_populate(mm, &_pmd, pgtable); > > - for (i = 0; i < HPAGE_PMD_NR; i++, haddr += PAGE_SIZE) { > + for (i = 0; i < HPAGE_PMD_NR; i++) { > pte_t entry, *pte; > /* > * Note that NUMA hinting access restrictions are not > @@ -2886,9 +2886,9 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, > } > if (dirty) > SetPageDirty(page + i); > - pte = pte_offset_map(&_pmd, haddr); > + pte = pte_offset_map(&_pmd, haddr + i * PAGE_SIZE); > BUG_ON(!pte_none(*pte)); > - set_pte_at(mm, haddr, pte, entry); > + set_pte_at(mm, haddr + i * PAGE_SIZE, pte, entry); > atomic_inc(&page[i]._mapcount); > pte_unmap(pte); > } > @@ -2938,7 +2938,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, > pmd_populate(mm, pmd, pgtable); > > if (freeze) { > - for (i = 0; i < HPAGE_PMD_NR; i++, haddr += PAGE_SIZE) { > + for (i = 0; i < HPAGE_PMD_NR; i++) { > page_remove_rmap(page + i, false); > put_page(page + i); > } Test is running and it looks good so far. For the final assessment I defer to Gerald and Sebastian. -- blue skies, Martin. "Reality continues to ruin my life." - Calvin.