[PATCH] HWPOSION, hugetlb: lock_page/unlock_page does not match for handling a free hugepage

[PATCH] HWPOSION, hugetlb: lock_page/unlock_page does not match for handling a free hugepage

[Chen Yucong]

For handling a free hugepage in memory failure, the race will happen if
another thread hwpoisoned this hugepage concurrently. So we need to
check PageHWPoison instead of !PageHWPoison.

If hwpoison_filter(p) returns true or a race happens, then we need to
unlock_page(hpage).

Signed-off-by: Chen Yucong <slaoub@gmail.com>
Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
---
mm/memory-failure.c |   15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 35ef28a..dbf8922 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1081,15 +1081,16 @@ int memory_failure(unsigned long pfn, int
trapno, int flags)
 			return 0;
 		} else if (PageHuge(hpage)) {
 			/*
-			 * Check "just unpoisoned", "filter hit", and
-			 * "race with other subpage."
+			 * Check "filter hit" and "race with other subpage."
 			 */
 			lock_page(hpage);
-			if (!PageHWPoison(hpage)
-			    || (hwpoison_filter(p) && TestClearPageHWPoison(p))
-			    || (p != hpage && TestSetPageHWPoison(hpage))) {
-				atomic_long_sub(nr_pages, &num_poisoned_pages);
-				return 0;
+			if (PageHWPoison(hpage)) {
+				if ((hwpoison_filter(p) && TestClearPageHWPoison(p))
+				    || (p != hpage && TestSetPageHWPoison(hpage))) {
+					atomic_long_sub(nr_pages, &num_poisoned_pages);
+					unlock_page(hpage);
+					return 0;
+				}
 			}
 			set_page_hwpoison_huge_page(hpage);
 			res = dequeue_hwpoisoned_huge_page(hpage);
-- 
1.7.10.4






--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [PATCH] HWPOSION, hugetlb: lock_page/unlock_page does not match for handling a free hugepage

[Naoya Horiguchi]

(Cced: Andrew)

On Sat, May 10, 2014 at 11:14:34AM +0800, Chen Yucong wrote:
> For handling a free hugepage in memory failure, the race will happen if
> another thread hwpoisoned this hugepage concurrently. So we need to
> check PageHWPoison instead of !PageHWPoison.
> 
> If hwpoison_filter(p) returns true or a race happens, then we need to
> unlock_page(hpage).
> 
> Signed-off-by: Chen Yucong <slaoub@gmail.com>
> Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>

I tested this patch on latest linux-next, and confirmed that memory error
on a tail page of a free hugepage is properly handled.

Tested-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>

And I think this patch should go into all recent stable trees, since this
bug exists since 2.6.36 (because of my patch, sorry.)

> ---
> mm/memory-failure.c |   15 ++++++++-------
> 1 file changed, 8 insertions(+), 7 deletions(-)
> 
> diff --git a/mm/memory-failure.c b/mm/memory-failure.c
> index 35ef28a..dbf8922 100644
> --- a/mm/memory-failure.c
> +++ b/mm/memory-failure.c
> @@ -1081,15 +1081,16 @@ int memory_failure(unsigned long pfn, int
> trapno, int flags)

This linebreak breaks patch format. I guess it's done by your email
client or copy and paste. If it's true, git-send-email might be helpful
to avoid such errors.

Thanks,
Naoya


>  			return 0;
>  		} else if (PageHuge(hpage)) {
>  			/*
> -			 * Check "just unpoisoned", "filter hit", and
> -			 * "race with other subpage."
> +			 * Check "filter hit" and "race with other subpage."
>  			 */
>  			lock_page(hpage);
> -			if (!PageHWPoison(hpage)
> -			    || (hwpoison_filter(p) && TestClearPageHWPoison(p))
> -			    || (p != hpage && TestSetPageHWPoison(hpage))) {
> -				atomic_long_sub(nr_pages, &num_poisoned_pages);
> -				return 0;
> +			if (PageHWPoison(hpage)) {
> +				if ((hwpoison_filter(p) && TestClearPageHWPoison(p))
> +				    || (p != hpage && TestSetPageHWPoison(hpage))) {
> +					atomic_long_sub(nr_pages, &num_poisoned_pages);
> +					unlock_page(hpage);
> +					return 0;
> +				}
>  			}
>  			set_page_hwpoison_huge_page(hpage);
>  			res = dequeue_hwpoisoned_huge_page(hpage);
> -- 
> 1.7.10.4
> 
> 
> 
> 
> 
> 
> --
> To unsubscribe, send a message with 'unsubscribe linux-mm' in
> the body to majordomo@kvack.org.  For more info on Linux MM,
> see: http://www.linux-mm.org/ .
> Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
> 

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [PATCH] HWPOSION, hugetlb: lock_page/unlock_page does not match for handling a free hugepage

[Andi Kleen]

On Mon, May 12, 2014 at 04:24:07PM -0400, Naoya Horiguchi wrote:
> (Cced: Andrew)
> 
> On Sat, May 10, 2014 at 11:14:34AM +0800, Chen Yucong wrote:
> > For handling a free hugepage in memory failure, the race will happen if
> > another thread hwpoisoned this hugepage concurrently. So we need to
> > check PageHWPoison instead of !PageHWPoison.
> > 
> > If hwpoison_filter(p) returns true or a race happens, then we need to
> > unlock_page(hpage).
> > 
> > Signed-off-by: Chen Yucong <slaoub@gmail.com>
> > Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
> 
> I tested this patch on latest linux-next, and confirmed that memory error
> on a tail page of a free hugepage is properly handled.

Patch looks good to me too.

Reviewed-by: Andi Kleen <ak@linux.intel.com> 

-Andi
> 
> Tested-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
> 
> And I think this patch should go into all recent stable trees, since this
> bug exists since 2.6.36 (because of my patch, sorry.)
> 
> > ---
> > mm/memory-failure.c |   15 ++++++++-------
> > 1 file changed, 8 insertions(+), 7 deletions(-)
> > 
> > diff --git a/mm/memory-failure.c b/mm/memory-failure.c
> > index 35ef28a..dbf8922 100644
> > --- a/mm/memory-failure.c
> > +++ b/mm/memory-failure.c
> > @@ -1081,15 +1081,16 @@ int memory_failure(unsigned long pfn, int
> > trapno, int flags)
> 
> This linebreak breaks patch format. I guess it's done by your email
> client or copy and paste. If it's true, git-send-email might be helpful
> to avoid such errors.
> 
> Thanks,
> Naoya
> 
> 
> >  			return 0;
> >  		} else if (PageHuge(hpage)) {
> >  			/*
> > -			 * Check "just unpoisoned", "filter hit", and
> > -			 * "race with other subpage."
> > +			 * Check "filter hit" and "race with other subpage."
> >  			 */
> >  			lock_page(hpage);
> > -			if (!PageHWPoison(hpage)
> > -			    || (hwpoison_filter(p) && TestClearPageHWPoison(p))
> > -			    || (p != hpage && TestSetPageHWPoison(hpage))) {
> > -				atomic_long_sub(nr_pages, &num_poisoned_pages);
> > -				return 0;
> > +			if (PageHWPoison(hpage)) {
> > +				if ((hwpoison_filter(p) && TestClearPageHWPoison(p))
> > +				    || (p != hpage && TestSetPageHWPoison(hpage))) {
> > +					atomic_long_sub(nr_pages, &num_poisoned_pages);
> > +					unlock_page(hpage);
> > +					return 0;
> > +				}
> >  			}
> >  			set_page_hwpoison_huge_page(hpage);
> >  			res = dequeue_hwpoisoned_huge_page(hpage);
> > -- 
> > 1.7.10.4
> > 
> > 
> > 
> > 
> > 
> > 
> > --
> > To unsubscribe, send a message with 'unsubscribe linux-mm' in
> > the body to majordomo@kvack.org.  For more info on Linux MM,
> > see: http://www.linux-mm.org/ .
> > Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
> > 

-- 
ak@linux.intel.com -- Speaking for myself only

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>