[PATCH] mm: hugetlb: fix copy_hugetlb_page_range() (Re: [BUG] new copy_hugetlb_page_range() causing crashes)

[PATCH] mm: hugetlb: fix copy_hugetlb_page_range() (Re: [BUG] new copy_hugetlb_page_range() causing crashes)

[Naoya Horiguchi]

# CCed Andrew, and linux-mm 

On Thu, Jul 17, 2014 at 11:59:36PM +0200, Guillaume Morin wrote:
> On 17 Jul 17:33, Naoya Horiguchi wrote:
...
> > And it seems that this also happens on v3.16-rc5.
> > So it might be an upstream bug, not a stable-specific matter.
> 
> That's my understanding as well. I just reported it for 3.4 and 3.14
> since these were the kernels I could easily try my original test with.

OK. I've checked the fix you suggested below on mainline, and
it passed our test program.

> > It looks strange to me that the problem is gone by removing the commit
> > 4a705fef98 (although I confirmed it is,) because the kernel's behavior
> > shouldn't change unless (is_hugetlb_entry_migration(entry) ||
> > is_hugetlb_entry_hwpoisoned(entry)) is true. And I checked with systemtap
> > that both these check returned false in the above test program.
> > So I'm wondering why the commit makes difference for this test program.
> 
> I don't know why I am just thinking about that now.  Isn't this the fact
> that your patch moved the huge_ptep_get() before
> huge_ptep_set_wrprotect() in the pte_present() cow case?

Ah, right. I was really blind :(

> 
> Actually, I've just tried to re-add the huge_ptep_get call for that
> case and it's fixing the problem for me...
> 
> Hmm, want a patch?

Thanks, but it's just a oneliner, so I wrote the one.

Naoya Horiguchi
---
From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Date: Thu, 17 Jul 2014 18:11:22 -0400
Subject: [PATCH] mm: hugetlb: fix copy_hugetlb_page_range()

commit 4a705fef98 ("hugetlb: fix copy_hugetlb_page_range() to handle
migration/hwpoisoned entry") changed the order of huge_ptep_set_wrprotect()
and huge_ptep_get(), which leads to break some workload like hugepage-backed
heap allocation via libhugetlbfs. This patch fixes it.

The test program for the problem is shown below:

  $ cat heap.c
  #include <unistd.h>
  #include <stdlib.h>
  #include <string.h>

  #define HPS 0x200000

  int main() {
  	int i;
  	char *p = malloc(HPS);
  	memset(p, '1', HPS);
  	for (i = 0; i < 5; i++) {
  		if (!fork()) {
  			memset(p, '2', HPS);
  			p = malloc(HPS);
  			memset(p, '3', HPS);
  			free(p);
  			return 0;
  		}
  	}
  	sleep(1);
  	free(p);
  	return 0;
  }

  $ export HUGETLB_MORECORE=yes ; export HUGETLB_NO_PREFAULT= ; hugectl --heap ./heap

Reported-by: Guillaume Morin <guillaume@morinfr.org>
Suggested-by: Guillaume Morin <guillaume@morinfr.org>
Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: stable@vger.kernel.org
---
 mm/hugetlb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index a8d4155eb019..7263c770e9b3 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2597,6 +2597,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
 		} else {
 			if (cow)
 				huge_ptep_set_wrprotect(src, addr, src_pte);
+			entry = huge_ptep_get(src_pte);
 			ptepage = pte_page(entry);
 			get_page(ptepage);
 			page_dup_rmap(ptepage);
-- 
1.9.3

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [PATCH] mm: hugetlb: fix copy_hugetlb_page_range() (Re: [BUG] new copy_hugetlb_page_range() causing crashes)

[Hugh Dickins]

On Thu, 17 Jul 2014, Naoya Horiguchi wrote:

> # CCed Andrew, and linux-mm 
> 
> On Thu, Jul 17, 2014 at 11:59:36PM +0200, Guillaume Morin wrote:
> > On 17 Jul 17:33, Naoya Horiguchi wrote:
> ...
> > > And it seems that this also happens on v3.16-rc5.
> > > So it might be an upstream bug, not a stable-specific matter.
> > 
> > That's my understanding as well. I just reported it for 3.4 and 3.14
> > since these were the kernels I could easily try my original test with.
> 
> OK. I've checked the fix you suggested below on mainline, and
> it passed our test program.
> 
> > > It looks strange to me that the problem is gone by removing the commit
> > > 4a705fef98 (although I confirmed it is,) because the kernel's behavior
> > > shouldn't change unless (is_hugetlb_entry_migration(entry) ||
> > > is_hugetlb_entry_hwpoisoned(entry)) is true. And I checked with systemtap
> > > that both these check returned false in the above test program.
> > > So I'm wondering why the commit makes difference for this test program.
> > 
> > I don't know why I am just thinking about that now.  Isn't this the fact
> > that your patch moved the huge_ptep_get() before
> > huge_ptep_set_wrprotect() in the pte_present() cow case?
> 
> Ah, right. I was really blind :(
> 
> > 
> > Actually, I've just tried to re-add the huge_ptep_get call for that
> > case and it's fixing the problem for me...
> > 
> > Hmm, want a patch?
> 
> Thanks, but it's just a oneliner, so I wrote the one.
> 
> Naoya Horiguchi
> ---
> From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
> Date: Thu, 17 Jul 2014 18:11:22 -0400
> Subject: [PATCH] mm: hugetlb: fix copy_hugetlb_page_range()
> 
> commit 4a705fef98 ("hugetlb: fix copy_hugetlb_page_range() to handle
> migration/hwpoisoned entry") changed the order of huge_ptep_set_wrprotect()
> and huge_ptep_get(), which leads to break some workload like hugepage-backed
> heap allocation via libhugetlbfs. This patch fixes it.
> 
> The test program for the problem is shown below:
> 
>   $ cat heap.c
>   #include <unistd.h>
>   #include <stdlib.h>
>   #include <string.h>
> 
>   #define HPS 0x200000
> 
>   int main() {
>   	int i;
>   	char *p = malloc(HPS);
>   	memset(p, '1', HPS);
>   	for (i = 0; i < 5; i++) {
>   		if (!fork()) {
>   			memset(p, '2', HPS);
>   			p = malloc(HPS);
>   			memset(p, '3', HPS);
>   			free(p);
>   			return 0;
>   		}
>   	}
>   	sleep(1);
>   	free(p);
>   	return 0;
>   }
> 
>   $ export HUGETLB_MORECORE=yes ; export HUGETLB_NO_PREFAULT= ; hugectl --heap ./heap
> 
> Reported-by: Guillaume Morin <guillaume@morinfr.org>
> Suggested-by: Guillaume Morin <guillaume@morinfr.org>
> Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>

Acked-by: Hugh Dickins <hughd@google.com>

Yes, indeed: I'm ashamed not to have noticed that - sorry.

> Cc: stable@vger.kernel.org
> ---
>  mm/hugetlb.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index a8d4155eb019..7263c770e9b3 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -2597,6 +2597,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
>  		} else {
>  			if (cow)
>  				huge_ptep_set_wrprotect(src, addr, src_pte);
> +			entry = huge_ptep_get(src_pte);
>  			ptepage = pte_page(entry);
>  			get_page(ptepage);
>  			page_dup_rmap(ptepage);
> -- 
> 1.9.3

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>