From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755603AbbBUEU4 (ORCPT ); Fri, 20 Feb 2015 23:20:56 -0500 Received: from mail-pd0-f181.google.com ([209.85.192.181]:34702 "EHLO mail-pd0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755010AbbBUEUy (ORCPT ); Fri, 20 Feb 2015 23:20:54 -0500 Date: Fri, 20 Feb 2015 20:20:47 -0800 (PST) From: Hugh Dickins X-X-Sender: hugh@eggly.anvils To: "Kirill A. Shutemov" cc: Andrea Arcangeli , Ning Qu , Andrew Morton , David Rientjes , linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 18/24] huge tmpfs: mmap_sem is unlocked when truncation splits huge pmd In-Reply-To: Message-ID: References: User-Agent: Alpine 2.11 (LSU 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org zap_pmd_range()'s CONFIG_DEBUG_VM !rwsem_is_locked(&mmap_sem) BUG() is invalid with huge tmpfs, where truncation of a hugely-mapped file to an unhugely-aligned size easily hits it. (Although anon THP could in principle apply khugepaged to private file mappings, which are not excluded by the MADV_HUGEPAGE restrictions, in practice there's a vm_ops check which excludes them, so it never hits this BUG() - there's no interface to "truncate" an anonymous mapping.) We could complicate the test, to check i_mmap_rwsem also when there's a vm_file; but I'm inclined to make zap_pmd_range() more readable by simply deleting this check. A search has shown no report of the issue in the 2.5 years since e0897d75f0b2 ("mm, thp: print useful information when mmap_sem is unlocked in zap_pmd_range") expanded it from VM_BUG_ON() - though I cannot point to what commit I would say then fixed the issue. Signed-off-by: Hugh Dickins --- mm/memory.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) --- thpfs.orig/mm/memory.c 2015-02-20 19:34:48.083909034 -0800 +++ thpfs/mm/memory.c 2015-02-20 19:34:53.467896724 -0800 @@ -1219,18 +1219,9 @@ static inline unsigned long zap_pmd_rang do { next = pmd_addr_end(addr, end); if (pmd_trans_huge(*pmd)) { - if (next - addr != HPAGE_PMD_SIZE) { -#ifdef CONFIG_DEBUG_VM - if (!rwsem_is_locked(&tlb->mm->mmap_sem)) { - pr_err("%s: mmap_sem is unlocked! addr=0x%lx end=0x%lx vma->vm_start=0x%lx vma->vm_end=0x%lx\n", - __func__, addr, end, - vma->vm_start, - vma->vm_end); - BUG(); - } -#endif + if (next - addr != HPAGE_PMD_SIZE) split_huge_page_pmd(vma, addr, pmd); - } else if (zap_huge_pmd(tlb, vma, pmd, addr)) + else if (zap_huge_pmd(tlb, vma, pmd, addr)) goto next; /* fall through */ }