From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Tue, 13 Oct 2015 18:10:53 +0900 From: Minchan Kim To: Vlastimil Babka Cc: Andrew Morton , "Kirill A. Shutemov" , Mel Gorman , Andrea Arcangeli , Hugh Dickins , Rik van Riel , linux-kernel@vger.kernel.org, linux-mm@kvack.org, Greg Kroah-Hartman , stable@vger.kernel.org, "Kirill A. Shutemov" Subject: Re: [PATCH v2] thp: use is_zero_pfn only after pte_present check Message-ID: <20151013091053.GA6630@bbox> References: <1444703918-16597-1-git-send-email-minchan@kernel.org> <561CB297.9080600@suse.cz> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <561CB297.9080600@suse.cz> Sender: owner-linux-mm@kvack.org List-ID: On Tue, Oct 13, 2015 at 09:28:23AM +0200, Vlastimil Babka wrote: > On 10/13/2015 04:38 AM, Minchan Kim wrote: > >Use is_zero_pfn on pteval only after pte_present check on pteval > >(It might be better idea to introduce is_zero_pte where checks > >pte_present first). Otherwise, it could work with swap or > >migration entry and if pte_pfn's result is equal to zero_pfn > >by chance, we lose user's data in __collapse_huge_page_copy. > >So if you're luck, the application is segfaulted and finally you > >could see below message when the application is exit. > > > >BUG: Bad rss-counter state mm:ffff88007f099300 idx:2 val:3 > > > >Cc: > > More specific: > Cc: # 4.1+ > Fixes: ca0984caa823 ("mm: incorporate zero pages into transparent > huge pages") > > >Acked-by: Kirill A. Shutemov > > Acked-by: Vlastimil Babka Thanks for the detail and review, Vlastimil. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Subject: Re: [PATCH v2] thp: use is_zero_pfn only after pte_present check To: Minchan Kim , Andrew Morton References: <1444703918-16597-1-git-send-email-minchan@kernel.org> Cc: "Kirill A. Shutemov" , Mel Gorman , Andrea Arcangeli , Hugh Dickins , Rik van Riel , linux-kernel@vger.kernel.org, linux-mm@kvack.org, Greg Kroah-Hartman , stable@vger.kernel.org, "Kirill A. Shutemov" From: Vlastimil Babka Message-ID: <561CB297.9080600@suse.cz> Date: Tue, 13 Oct 2015 09:28:23 +0200 MIME-Version: 1.0 In-Reply-To: <1444703918-16597-1-git-send-email-minchan@kernel.org> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-linux-mm@kvack.org List-ID: On 10/13/2015 04:38 AM, Minchan Kim wrote: > Use is_zero_pfn on pteval only after pte_present check on pteval > (It might be better idea to introduce is_zero_pte where checks > pte_present first). Otherwise, it could work with swap or > migration entry and if pte_pfn's result is equal to zero_pfn > by chance, we lose user's data in __collapse_huge_page_copy. > So if you're luck, the application is segfaulted and finally you > could see below message when the application is exit. > > BUG: Bad rss-counter state mm:ffff88007f099300 idx:2 val:3 > > Cc: More specific: Cc: # 4.1+ Fixes: ca0984caa823 ("mm: incorporate zero pages into transparent huge pages") > Acked-by: Kirill A. Shutemov Acked-by: Vlastimil Babka > Reviewed-by: Andrea Arcangeli > Signed-off-by: Minchan Kim > --- > Hello Greg, > > This patch should go to -stable but when you will apply it > after merging of linus tree, it will be surely conflicted due > to userfaultfd part. > > I want to know how to handle it. > > Thanks. > > mm/huge_memory.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/mm/huge_memory.c b/mm/huge_memory.c > index 4b06b8db9df2..bbac913f96bc 100644 > --- a/mm/huge_memory.c > +++ b/mm/huge_memory.c > @@ -2206,7 +2206,8 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma, > for (_pte = pte; _pte < pte+HPAGE_PMD_NR; > _pte++, address += PAGE_SIZE) { > pte_t pteval = *_pte; > - if (pte_none(pteval) || is_zero_pfn(pte_pfn(pteval))) { > + if (pte_none(pteval) || (pte_present(pteval) && > + is_zero_pfn(pte_pfn(pteval)))) { > if (!userfaultfd_armed(vma) && > ++none_or_zero <= khugepaged_max_ptes_none) > continue; > -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Tue, 13 Oct 2015 15:26:52 +0900 From: Minchan Kim To: Greg Kroah-Hartman Cc: Andrew Morton , "Kirill A. Shutemov" , Mel Gorman , Vlastimil Babka , Andrea Arcangeli , Hugh Dickins , Rik van Riel , linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, "Kirill A. Shutemov" Subject: Re: [PATCH v2] thp: use is_zero_pfn only after pte_present check Message-ID: <20151013062630.GA16146@bbox> References: <1444703918-16597-1-git-send-email-minchan@kernel.org> <20151013054124.GB20952@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20151013054124.GB20952@kroah.com> Sender: owner-linux-mm@kvack.org List-ID: On Mon, Oct 12, 2015 at 10:41:24PM -0700, Greg Kroah-Hartman wrote: > On Tue, Oct 13, 2015 at 11:38:38AM +0900, Minchan Kim wrote: > > Use is_zero_pfn on pteval only after pte_present check on pteval > > (It might be better idea to introduce is_zero_pte where checks > > pte_present first). Otherwise, it could work with swap or > > migration entry and if pte_pfn's result is equal to zero_pfn > > by chance, we lose user's data in __collapse_huge_page_copy. > > So if you're luck, the application is segfaulted and finally you > > could see below message when the application is exit. > > > > BUG: Bad rss-counter state mm:ffff88007f099300 idx:2 val:3 > > > > Cc: > > Acked-by: Kirill A. Shutemov > > Reviewed-by: Andrea Arcangeli > > Signed-off-by: Minchan Kim > > --- > > Hello Greg, > > > > This patch should go to -stable but when you will apply it > > after merging of linus tree, it will be surely conflicted due > > to userfaultfd part. > > > > I want to know how to handle it. > > You will get an automated email saying it didn't apply and then you > provide a backported version. Or you send a properly backported version > to stable@vger.kernel.org before then, with the git commit id of the > patch in Linus's tree. Okay, I will send a right version when I received automatd email. Thanks. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Mon, 12 Oct 2015 22:41:24 -0700 From: Greg Kroah-Hartman To: Minchan Kim Cc: Andrew Morton , "Kirill A. Shutemov" , Mel Gorman , Vlastimil Babka , Andrea Arcangeli , Hugh Dickins , Rik van Riel , linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, "Kirill A. Shutemov" Subject: Re: [PATCH v2] thp: use is_zero_pfn only after pte_present check Message-ID: <20151013054124.GB20952@kroah.com> References: <1444703918-16597-1-git-send-email-minchan@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1444703918-16597-1-git-send-email-minchan@kernel.org> Sender: owner-linux-mm@kvack.org List-ID: On Tue, Oct 13, 2015 at 11:38:38AM +0900, Minchan Kim wrote: > Use is_zero_pfn on pteval only after pte_present check on pteval > (It might be better idea to introduce is_zero_pte where checks > pte_present first). Otherwise, it could work with swap or > migration entry and if pte_pfn's result is equal to zero_pfn > by chance, we lose user's data in __collapse_huge_page_copy. > So if you're luck, the application is segfaulted and finally you > could see below message when the application is exit. > > BUG: Bad rss-counter state mm:ffff88007f099300 idx:2 val:3 > > Cc: > Acked-by: Kirill A. Shutemov > Reviewed-by: Andrea Arcangeli > Signed-off-by: Minchan Kim > --- > Hello Greg, > > This patch should go to -stable but when you will apply it > after merging of linus tree, it will be surely conflicted due > to userfaultfd part. > > I want to know how to handle it. You will get an automated email saying it didn't apply and then you provide a backported version. Or you send a properly backported version to stable@vger.kernel.org before then, with the git commit id of the patch in Linus's tree. thanks, greg k-h -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Minchan Kim To: Andrew Morton Cc: "Kirill A. Shutemov" , Mel Gorman , Vlastimil Babka , Andrea Arcangeli , Hugh Dickins , Rik van Riel , linux-kernel@vger.kernel.org, linux-mm@kvack.org, Greg Kroah-Hartman , Minchan Kim , , "Kirill A. Shutemov" Subject: [PATCH v2] thp: use is_zero_pfn only after pte_present check Date: Tue, 13 Oct 2015 11:38:38 +0900 Message-Id: <1444703918-16597-1-git-send-email-minchan@kernel.org> Sender: owner-linux-mm@kvack.org List-ID: Use is_zero_pfn on pteval only after pte_present check on pteval (It might be better idea to introduce is_zero_pte where checks pte_present first). Otherwise, it could work with swap or migration entry and if pte_pfn's result is equal to zero_pfn by chance, we lose user's data in __collapse_huge_page_copy. So if you're luck, the application is segfaulted and finally you could see below message when the application is exit. BUG: Bad rss-counter state mm:ffff88007f099300 idx:2 val:3 Cc: Acked-by: Kirill A. Shutemov Reviewed-by: Andrea Arcangeli Signed-off-by: Minchan Kim --- Hello Greg, This patch should go to -stable but when you will apply it after merging of linus tree, it will be surely conflicted due to userfaultfd part. I want to know how to handle it. Thanks. mm/huge_memory.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 4b06b8db9df2..bbac913f96bc 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -2206,7 +2206,8 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma, for (_pte = pte; _pte < pte+HPAGE_PMD_NR; _pte++, address += PAGE_SIZE) { pte_t pteval = *_pte; - if (pte_none(pteval) || is_zero_pfn(pte_pfn(pteval))) { + if (pte_none(pteval) || (pte_present(pteval) && + is_zero_pfn(pte_pfn(pteval)))) { if (!userfaultfd_armed(vma) && ++none_or_zero <= khugepaged_max_ptes_none) continue; -- 1.9.1 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org