From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 27560EB64D9 for ; Fri, 30 Jun 2023 02:14:21 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 928CE8D0002; Thu, 29 Jun 2023 22:14:20 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 8AF068D0001; Thu, 29 Jun 2023 22:14:20 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 728678D0002; Thu, 29 Jun 2023 22:14:20 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 5D4648D0001 for ; Thu, 29 Jun 2023 22:14:20 -0400 (EDT) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 158C51C8E6B for ; Fri, 30 Jun 2023 02:14:20 +0000 (UTC) X-FDA: 80957794680.06.7AA20D0 Received: from out-52.mta0.migadu.com (out-52.mta0.migadu.com [91.218.175.52]) by imf17.hostedemail.com (Postfix) with ESMTP id 0E6D640003 for ; Fri, 30 Jun 2023 02:14:17 +0000 (UTC) Authentication-Results: imf17.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=nBw5cd0U; spf=pass (imf17.hostedemail.com: domain of muchun.song@linux.dev designates 91.218.175.52 as permitted sender) smtp.mailfrom=muchun.song@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1688091258; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=c+Q6kGCsNOKoZaGl4/+CoNXY45hAC8Rmehd0ODubecA=; b=JClfmSB5YC+7jrwVzL11RPfo7fYaNeJKbkMH7bi7Jhmb2unkgv6CceYSh1khR4CajO99J3 mlGSvZfC+3bL7BN9pAgsTY7CKy+2XqfPBuFAKiOe82AVPQpb/YuU+vgcXnOmetfsWFSgsB Bxe1oYBIslKQwpj13sehlJg34PZ+9uI= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1688091258; a=rsa-sha256; cv=none; b=QmJg6+CP1MVlu9RjWBUrjN5C8aypuxwz7XLW/Iv+eaJTgq1UEy5GJIW6/tZUqfvKqenZd2 WAsLGUKnGpOHHpcUFMClfVhgogirz9HdfS+LZ2mufjNnEUhADAA8dkaLFuWdJbH4v2zQK9 QJmMIwE5VYrHwqPqKPNB5ia+EHIwMO0= ARC-Authentication-Results: i=1; imf17.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=nBw5cd0U; spf=pass (imf17.hostedemail.com: domain of muchun.song@linux.dev designates 91.218.175.52 as permitted sender) smtp.mailfrom=muchun.song@linux.dev; dmarc=pass (policy=none) header.from=linux.dev Content-Type: text/plain; charset=us-ascii DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1688091255; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=c+Q6kGCsNOKoZaGl4/+CoNXY45hAC8Rmehd0ODubecA=; b=nBw5cd0UmlLTPBcRMaXJgc7YE0SMPKtdhLmuO73l3i6lmYUhxiOT/De7PvW9OIa2qAxDHg mA10/Pb7AmwhwRqeiQSmdiToCh59DsruaJ1F+7UnJqGswYO1K5cH8Ibxcf06gt+QMAuVpo iVNAWO95ztLaVLBd0bSJGpTZzQGqt8M= MIME-Version: 1.0 Subject: Re: [PATCH] mm/hugetlb.c: fix a bug within a BUG(): inconsistent pte comparison X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Muchun Song In-Reply-To: <20230630013203.1955064-1-jhubbard@nvidia.com> Date: Fri, 30 Jun 2023 10:13:31 +0800 Cc: Andrew Morton , LKML , Linux Memory Management List , Adrian Hunter , Al Viro , Alex Williamson , Alexander Potapenko , Alexander Shishkin , Andrey Konovalov , Andrey Ryabinin , Christian Brauner , Christoph Hellwig , Daniel Vetter , Dave Airlie , Dimitri Sivanich , Dmitry Vyukov , Ian Rogers , Jason Gunthorpe , Jiri Olsa , Johannes Weiner , "Kirill A . Shutemov" , Lorenzo Stoakes , Mark Rutland , Matthew Wilcox , Miaohe Lin , Michal Hocko , Mike Kravetz , Mike Rapoport , Namhyung Kim , Naoya Horiguchi , Oleksandr Tyshchenko , Pavel Tatashin , Roman Gushchin , Ryan Roberts , SeongJae Park , Shakeel Butt , Uladzislau Rezki , Vincenzo Frascino , Yu Zhao Content-Transfer-Encoding: 7bit Message-Id: <070B191B-1D20-4E19-A9AB-961852FEC333@linux.dev> References: <20230630013203.1955064-1-jhubbard@nvidia.com> To: John Hubbard X-Migadu-Flow: FLOW_OUT X-Stat-Signature: tkb63jfq6kud3rzq9nbebkaw9cgt417g X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 0E6D640003 X-Rspam-User: X-HE-Tag: 1688091257-485346 X-HE-Meta: U2FsdGVkX1+qpHkkPkd6ZW12yqoB9Xf3TN9sVqH3fDpExRq/6MC7DPx5WnsnFojrrgYHKTdcfgeBfk/cqpz03PD14oV7HR/mhzxSObuCz5n4LCCtciZEA9Btl7FKToFYtK8+E/2jKIZ98fJPkW2uhTP0OasyTZkFla8/7Gh00IBaaoQDzFqGjC5pKOF8TLQCFWBZutgtwlBXsBqxbGtqpVV+Z8VmIrsioErITeZ4i1vory6r03uYpcqrM6DRtwOS1frAXEBWl2lN1qYuhzhirZ4gzieeGrYdhmGxMP0E82McgS8WtBIXHu8qezcIXDfVYE1GyEevq22CFD3/jrtuwWfHKNOyHrytbk09TSH6x6hy5y39XTUvFx2b4zf4exkCC+PL7Oi441RN+P6OAWm90fYZD7tVYCi1ATjXHvrQ0IB4WRuHfEB1fGEQnnwaGcXBqHcSpGq62qasAt8zZZmzqCaTSGzEsJ5uk5sts/P5Rqgeo37IpCgDHmn7Tfss0bDqdcie183RdOPFlCGK3z6X+fmf+9yGMUhdVWgiLFB/EypQsquQ+C7WlYbeu6aXE4Xzj7wmI/eUYKzI0mNASrXgxzaTrpngvVvdg5uUg9sRsKdSG+YUe/w8z7YJKV/9hpIxRHqXee3AXN9xmu+gAZpvVc1cWbp06cM7Z3efAZyT2zNmur0E2TkNAuZkwFKv01M1qf5CVHw27kfarZhJuCd547eq3b+FJMDbFzqvEcc/azL84e6CCOhgalE4brOA0pj38glnFlrVtv0As8si4bIJfEdkj4TVrP6guTgSZZHbna2CcxUlmylhoHso9YmDweDPcDlHrXA4beOUV61FlJSHbMGUzkreK52mQ2rxOS796sM0rs8HtFZJKmHpkytUx8D+GaKh5AZWUb/0ajhLHPVQ08cXdFM5B5Ev/0rKef06XxN/xyc701GaNkHqabwAdiJW9D1McRG27gHIf318S/R w4Q9Q+rE annntUhWUsLPYtsxF2Wr4TUKmgPZJ727RhA5JTh0c7+dsB+JC+ydiTXxKbCa8lAiTicFxMBeGhd1YMMKkOAWtELx711T9VaIRNeJf/IELvzPS3fAVC/KRQm6a+fT9soR3GUQo0rD71yrO3Xrljb/SCw1tFvQNXicHovAcSV3RCZUvO52nWDDydgHaz3KunsHFixYpP7jHy44ELJWoS3WTtoOagmqtdxz8V/r12JgKRRi/0kwoP6ALDe7dYKRKaCxE+Om2Plswlk5O5HO0R+eaVsXlYMnDXVzluHPj5XGL7aVVWWN4UxhyzXj4La9lRJCYGf7/Duox3rOJfcOGSpG3XFEgxJf+obRO3vfB2aHTmtLlrymNqkCIZ37xhxkHSfG31qI/w+asyKUSiochzQymH2KGd1+TDLo5/OrdW4CKMFTyyvQmq/mxHAZ05JC9l3KzDlfEH5BfHt8BIMrKBhuGCydNAVkTiVpTlNDpOY1PwIsR4sYeS7xkhua35nHhLxBV1/73zS0OEydXSYfl1dgJnAfXeRPlVwNzQa2pcKEuBF6eOTihFHaipI90FLw8o3kSHRu5UPDupmK6oGkRzYqI6yofJUlUGd5b67maln63Kt8pXTSZkyF4++iFmQ5qpC5uVJclnzYaPAFx6kZFI4+MoKXZfHPp8OKBozx3luRfa4gCg+eMsn3K/gM5n/+W5tHL3DuVXaTLOCRzxxxldGketIRhcaw4qvznO5uJh4dkOeW9lkxPjqxF++ELarrPXa2ZY9jFgjKQzDyd9xE6Jw0tB+iNy6sd+3vnuNa6nOO8mk/xwt3dSszj57AaqY/3EaF1TRSHsc+3J8VAXeCu0FbWUfCSKJhJqbGSAc67oWT0Vczn8FlD7v0ZemDhxV6EI8Z4SAmlzxNxImcMZMeH45PcWXQeYOfuo4OSFD79wzU33XOizCC27sqxJQaU/n3005F1m7sg/rzSMz5hDmc= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: > On Jun 30, 2023, at 09:32, John Hubbard wrote: > > The following crash happens for me when running the -mm selftests > (below). Specifically, it happens while running the uffd-stress > subtests: > > kernel BUG at mm/hugetlb.c:7249! > invalid opcode: 0000 [#1] PREEMPT SMP NOPTI > CPU: 0 PID: 3238 Comm: uffd-stress Not tainted 6.4.0-hubbard-github+ #109 > Hardware name: ASUS X299-A/PRIME X299-A, BIOS 1503 08/03/2018 > RIP: 0010:huge_pte_alloc+0x12c/0x1a0 > ... > Call Trace: > > ? __die_body+0x63/0xb0 > ? die+0x9f/0xc0 > ? do_trap+0xab/0x180 > ? huge_pte_alloc+0x12c/0x1a0 > ? do_error_trap+0xc6/0x110 > ? huge_pte_alloc+0x12c/0x1a0 > ? handle_invalid_op+0x2c/0x40 > ? huge_pte_alloc+0x12c/0x1a0 > ? exc_invalid_op+0x33/0x50 > ? asm_exc_invalid_op+0x16/0x20 > ? __pfx_put_prev_task_idle+0x10/0x10 > ? huge_pte_alloc+0x12c/0x1a0 > hugetlb_fault+0x1a3/0x1120 > ? finish_task_switch+0xb3/0x2a0 > ? lock_is_held_type+0xdb/0x150 > handle_mm_fault+0xb8a/0xd40 > ? find_vma+0x5d/0xa0 > do_user_addr_fault+0x257/0x5d0 > exc_page_fault+0x7b/0x1f0 > asm_exc_page_fault+0x22/0x30 > > That happens because a BUG() statement in huge_pte_alloc() attempts to > check that a pte, if present, is a hugetlb pte, but it does so in a > non-lockless-safe manner that leads to a false BUG() report. > > We got here due to a couple of bugs, each of which by itself was not > quite enough to cause a problem: > > First of all, before commit c33c794828f2("mm: ptep_get() conversion"), > the BUG() statement in huge_pte_alloc() was itself fragile: it relied > upon compiler behavior to only read the pte once, despite using it twice > in the same conditional. > > Next, commit c33c794828f2 ("mm: ptep_get() conversion") broke that > delicate situation, by causing all direct pte reads to be done via > READ_ONCE(). And so READ_ONCE() got called twice within the same BUG() > conditional, leading to comparing (potentially, occasionally) different > versions of the pte, and thus to false BUG() reports. > > Fix this by taking a single snapshot of the pte before using it in the > BUG conditional. > > Now, that commit is only partially to blame here but, people doing > bisections will invariably land there, so this will help them find a fix > for a real crash. And also, the previous behavior was unlikely to ever > expose this bug--it was fragile, yet not actually broken. > > So that's why I chose this commit for the Fixes tag, rather than the > commit that created the original BUG() statement. > > Fixes: c33c794828f2 ("mm: ptep_get() conversion") > Cc: Adrian Hunter > Cc: Al Viro > Cc: Alex Williamson > Cc: Alexander Potapenko > Cc: Alexander Shishkin > Cc: Andrew Morton > Cc: Andrey Konovalov > Cc: Andrey Ryabinin > Cc: Christian Brauner > Cc: Christoph Hellwig > Cc: Daniel Vetter > Cc: Dave Airlie > Cc: Dimitri Sivanich > Cc: Dmitry Vyukov > Cc: Ian Rogers > Cc: Jason Gunthorpe > Cc: Jiri Olsa > Cc: Johannes Weiner > Cc: Kirill A. Shutemov > Cc: Lorenzo Stoakes > Cc: Mark Rutland > Cc: Matthew Wilcox > Cc: Miaohe Lin > Cc: Michal Hocko > Cc: Mike Kravetz > Cc: Mike Rapoport (IBM) > Cc: Muchun Song > Cc: Namhyung Kim > Cc: Naoya Horiguchi > Cc: Oleksandr Tyshchenko > Cc: Pavel Tatashin > Cc: Roman Gushchin > Cc: Ryan Roberts > Cc: SeongJae Park > Cc: Shakeel Butt > Cc: Uladzislau Rezki (Sony) > Cc: Vincenzo Frascino > Cc: Yu Zhao > Signed-off-by: John Hubbard Acked-by: Muchun Song Thanks.