From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f72.google.com (mail-wm0-f72.google.com [74.125.82.72]) by kanga.kvack.org (Postfix) with ESMTP id 48E6882963 for ; Thu, 21 Jul 2016 08:30:05 -0400 (EDT) Received: by mail-wm0-f72.google.com with SMTP id x83so12095004wma.2 for ; Thu, 21 Jul 2016 05:30:05 -0700 (PDT) Received: from mail-wm0-f66.google.com (mail-wm0-f66.google.com. [74.125.82.66]) by mx.google.com with ESMTPS id q197si3180753wmb.145.2016.07.21.05.30.04 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 21 Jul 2016 05:30:04 -0700 (PDT) Received: by mail-wm0-f66.google.com with SMTP id x83so2319604wma.3 for ; Thu, 21 Jul 2016 05:30:04 -0700 (PDT) Date: Thu, 21 Jul 2016 14:30:01 +0200 From: Michal Hocko Subject: Re: + mm-hugetlb-fix-race-when-migrate-pages.patch added to -mm tree Message-ID: <20160721123001.GI26379@dhcp22.suse.cz> References: <578eb28b.YbRUDGz5RloTVlrE%akpm@linux-foundation.org> <20160721074340.GA26398@dhcp22.suse.cz> <5790A9D1.6060304@huawei.com> <20160721112754.GH26379@dhcp22.suse.cz> <5790BCB1.4020800@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5790BCB1.4020800@huawei.com> Sender: owner-linux-mm@kvack.org List-ID: To: zhong jiang Cc: akpm@linux-foundation.org, qiuxishi@huawei.com, vbabka@suse.cz, mm-commits@vger.kernel.org, Mike Kravetz , Naoya Horiguchi , Mel Gorman , linux-mm@kvack.org On Thu 21-07-16 20:14:41, zhong jiang wrote: > On 2016/7/21 19:27, Michal Hocko wrote: > > On Thu 21-07-16 18:54:09, zhong jiang wrote: > >> On 2016/7/21 15:43, Michal Hocko wrote: > >>> We have further discussed the patch and I believe it is not correct. See [1]. > >>> I am proposing the following alternative. > >>> > >>> [1] http://lkml.kernel.org/r/20160720132431.GM11249@dhcp22.suse.cz > >>> --- > >>> >From b1e9b3214f1859fdf7d134cdcb56f5871933539c Mon Sep 17 00:00:00 2001 > >>> From: Michal Hocko > >>> Date: Thu, 21 Jul 2016 09:28:13 +0200 > >>> Subject: [PATCH] mm, hugetlb: fix huge_pte_alloc BUG_ON > >>> > >>> Zhong Jiang has reported a BUG_ON from huge_pte_alloc hitting when he > >>> runs his database load with memory online and offline running in > >>> parallel. The reason is that huge_pmd_share might detect a shared pmd > >>> which is currently migrated and so it has migration pte which is > >>> !pte_huge. > >>> > >>> There doesn't seem to be any easy way to prevent from the race and in > >>> fact seeing the migration swap entry is not harmful. Both callers of > >>> huge_pte_alloc are prepared to handle them. copy_hugetlb_page_range > >>> will copy the swap entry and make it COW if needed. hugetlb_fault will > >>> back off and so the page fault is retries if the page is still under > >>> migration and waits for its completion in hugetlb_fault. > >>> > >>> That means that the BUG_ON is wrong and we should update it. Let's > >>> simply check that all present ptes are pte_huge instead. > >>> > >>> Reported-by: zhongjiang > >>> Signed-off-by: Michal Hocko > >>> --- > >>> mm/hugetlb.c | 2 +- > >>> 1 file changed, 1 insertion(+), 1 deletion(-) > >>> > >>> diff --git a/mm/hugetlb.c b/mm/hugetlb.c > >>> index 34379d653aa3..31dd2b8b86b3 100644 > >>> --- a/mm/hugetlb.c > >>> +++ b/mm/hugetlb.c > >>> @@ -4303,7 +4303,7 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, > >>> pte = (pte_t *)pmd_alloc(mm, pud, addr); > >>> } > >>> } > >>> - BUG_ON(pte && !pte_none(*pte) && !pte_huge(*pte)); > >>> + BUG_ON(pte && pte_present(*pte) && !pte_huge(*pte)); > >>> > >>> return pte; > >>> } > >> I don't think that the patch can fix the question. The explain is as follow. > >> > >> cpu0 cpu1 > >> copy_hugetlb_page_range try_to_unmap_one > >> huge_pte_alloc #pmd may be shared > >> lock dst_pte #dst_pte may be migrate > >> lock src_pte #src_pte may be normal pt1 > >> set_huge_pte_at #dst_pte points to normal > >> spin_unlock (src_pt1) > >> lock src_pte > >> spin_unlock(dst_pt1) set src_pte migrate entry > >> spin_unlock(src_pte) > >> * dst_pte is a normal pte, but corresponding to the > >> pfn is under migrate. it is dangerous. > >> > >> The race may occur. is right ? if the scenario exist. we should think about more. > > Can this happen at all? copy_hugetlb_page_range does the following to > > rule out shared page table entries. At least that is my understanding of > > c5c99429fa57 ("fix hugepages leak due to pagetable page sharing") > > > > /* If the pagetables are shared don't copy or take references */ > > if (dst_pte == src_pte) > > continue; > > vm_file points to mapping should be shared, I am not sure, if it is > so, the possibility is exist. of course, src_pte is the same as the > dst_pte. I am not sure I understand. This is a fork path where the ptes are copied over from the parent to the child. So how would vm_file differ? -- Michal Hocko SUSE Labs -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org