From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id E1943C6FD1F for ; Tue, 2 Apr 2024 11:24:09 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 4ED726B009A; Tue, 2 Apr 2024 07:24:09 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 44F176B009B; Tue, 2 Apr 2024 07:24:09 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2A0CC6B009C; Tue, 2 Apr 2024 07:24:09 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 089486B009A for ; Tue, 2 Apr 2024 07:24:09 -0400 (EDT) Received: from smtpin14.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id B5945140A97 for ; Tue, 2 Apr 2024 11:24:08 +0000 (UTC) X-FDA: 81964357776.14.9CBC728 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by imf19.hostedemail.com (Postfix) with ESMTP id 39D881A0004 for ; Tue, 2 Apr 2024 11:24:04 +0000 (UTC) Authentication-Results: imf19.hostedemail.com; dkim=none; spf=pass (imf19.hostedemail.com: domain of linmiaohe@huawei.com designates 45.249.212.188 as permitted sender) smtp.mailfrom=linmiaohe@huawei.com; dmarc=pass (policy=quarantine) header.from=huawei.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1712057046; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=rXTeZKn24UUjSjiTn3aI0Iws5EpdoeCFYrzomYs6P4s=; b=wKCZq+UmZ+bJHN25sJ2eKANycYhhT8IPR632qmJmtY+oCa1EF2QEbVgXppgeNVfUqBxQ57 INqssoRlJ5iI7a9q9PB0BetlL+vM/20/ZhcFNWtX2KUtE4/4W/I72cdm4r9oWxYXmPOBcj +AHP/1/b4GEJWgjXgf6LeTKktJL5uCc= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1712057046; a=rsa-sha256; cv=none; b=wHLeKd61nAHyQve+03dVK9wsAJCEaWQUzkO9JORqE/M5+AmcEGP3+Lmzj3ydsMK1mWjuYJ 9rdC+uSCZwrA/F48U3808FHyYS0UYxsfDmSMLsqltK+WrhzNZy7K+ia00E4o+w/jZ5wHnn arni3rWdPdmMxRmx/TJxqeVMiU8RI3c= ARC-Authentication-Results: i=1; imf19.hostedemail.com; dkim=none; spf=pass (imf19.hostedemail.com: domain of linmiaohe@huawei.com designates 45.249.212.188 as permitted sender) smtp.mailfrom=linmiaohe@huawei.com; dmarc=pass (policy=quarantine) header.from=huawei.com Received: from mail.maildlp.com (unknown [172.19.163.174]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4V856S6nVlzXk1c; Tue, 2 Apr 2024 19:21:04 +0800 (CST) Received: from canpemm500002.china.huawei.com (unknown [7.192.104.244]) by mail.maildlp.com (Postfix) with ESMTPS id 2A3F21400FD; Tue, 2 Apr 2024 19:24:01 +0800 (CST) Received: from [10.173.135.154] (10.173.135.154) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.35; Tue, 2 Apr 2024 19:24:00 +0800 Subject: Re: hugetlbfs: WARNING: bad unlock balance detected during MADV_REMOVE To: Thorvald Natvig CC: Jane Chu , "Liam R. Howlett" , Muchun Song , Linux-MM References: <42788ABD-99AE-4AEF-B543-C0FABAFA0464@linux.dev> <4780b0e3-42e1-9099-d010-5a1793b6cbd3@huawei.com> <531195fb-b642-2bc1-3a07-4944ee5d8664@huawei.com> <20240129161735.6gmjsswx62o4pbja@revolver> <76f33f3b-f61f-efe7-f63f-1b2e0efaf71d@huawei.com> <20240130040814.hd3edkda5rbsxru7@revolver> <70f13c9f-4364-4154-9b5c-69d6c5e9d65a@oracle.com> <188533a8-e742-65ac-bf24-0560e63e3730@huawei.com> From: Miaohe Lin Message-ID: <33f14813-a523-8996-03b4-af9c2264058a@huawei.com> Date: Tue, 2 Apr 2024 19:24:00 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="utf-8" Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [10.173.135.154] X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To canpemm500002.china.huawei.com (7.192.104.244) X-Stat-Signature: rcw6jn37gy9x8td6bhgqte361h3isd6r X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 39D881A0004 X-Rspam-User: X-HE-Tag: 1712057044-558116 X-HE-Meta: U2FsdGVkX1+82iXtkyeD8C9gagLYOunum0AY0v3aaRe6cnEySOsyeA0/IscOc1vT28fhi/lPxIizqaFikJwBcc7rkWeMfr2Wr7hEnLJF4JJav9G6hrNCQvxAH7fd5mrwyJte+fJOr1tgkdFRVIJL+K7DCbl3jmLragBavrNkoljUXoN9XC/FfdgN2MVFlORzQh/6JVLO7XXNyxV8Y2AW91gphFCSVb17kPujGOCyHaGnP+j4BUdAeN9BJVU89Dj1c1LThGlrxmD2j4UNk6AdK/+lxc7HSJf8IG0mU2aG5aW8UlStms2cHD5bV3d0MPVJQbPl+/vZ8u4uo8HqjLhuoz74MxJHR1OevxSkGHCSVFwPurJ5YYjNsJhFwJCzlmYO9LfFDDIRSkDV/LEFabOCjP07cmRDhvOK78wzMnr1DJYgpI+0uKM6bEm2mqOqP2xDJh3d8T/y0Ccb1qsjCvmgVv8pBLJ+UXa2FwU46CxhCrK02GkNcCYIZcwP4wUI5oEU0yIYdf1oBF2uZh9YfhdHrrqa234uvn47b8dJMUwVGRBZbfatCW0juramvW3uFmsfeFeBJcgAU+rcNpzsBzl9CGWI/920Py5nKT9gFdgZAW4anNTGp6adMSdaMryeSf+iwvUYYfDBKZASUIjHATPaIerSDFCV1Fbj2WELPzQWEL/6/tYM4+7CPVm3HrqN9zqO2bk5ujaTR5i9Tv5NJlT3FSM0KNvmd32/5KhgmMJ/JztjtHqteJ3z4Y1p+nv9IzTMPCyw2HGmMhg0hU+Lu0B103/legqLcGvQy0E76Os9oN/cZekVUbeKT/UzFsl/4mJPhp/6ovREN12COE83ssOt9ZX++jH3l4yEBtJtWduwzZw/I4PcgFcgk6Sc+JNBo+KBkhU78BH+c5FgNgmT1Whn3e5yX3U4h2q9aySvNfR+cugg9JhZNCst5rsfxjAi6TkNwcadQk7d4gwxnmGiSUF g+tiVkbX 2MKsoUdbN1rYbo3RFW8nJC5/UtNeZdfpZxlv+aqNroN6K6GzQv6/oaevOvEYNQA1v1FgJXSbu2DjCDDKfXUETxTTGez+p1NTdDD/W2wMhOxxE8FA+4Z96y9nQyIxYfPXcxIGVP/XiCZM+08jehNeVy8+MpXBrgwkPLeVlUy3p5hF8JA2rM4XNHbkZyw6eQbH6riYjDilUpWorGPNp7sWXRqyxa4qHgyRU+GNII6mAfzjhKpjm5+d/HvDgDTacAbtvPJtnWiWaPN8jDpSsf5jKF6JHPG9hX/c3ef3sya2LAAafaBC35W1pBRT0BZtIkR4vLSjMw3PcVob3/lE= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 2024/3/29 23:54, Thorvald Natvig wrote: > Did this patch (or another fix for the same problem) make it through? I'm sorry but I didn't have enough time to figure out a complete solution and this stuff got lost in my mind... > If not, is there anything we can do to help? I would try to send a formal patch as soon as possible. A full test and review would be really helpful. Thanks. > > - Thorvald > > > On Sat, Feb 3, 2024 at 5:54 PM Miaohe Lin wrote: >> >> On 2024/2/3 5:02, Jane Chu wrote: >>> On 1/30/2024 10:51 PM, Miaohe Lin wrote: >>> >>>> On 2024/1/30 12:08, Liam R. Howlett wrote: >>>>> * Miaohe Lin [240129 21:14]: >>>>>> On 2024/1/30 0:17, Liam R. Howlett wrote: >>>>>>> * Miaohe Lin [240129 07:56]: >>>>>>>> On 2024/1/27 18:13, Miaohe Lin wrote: >>>>>>>>> On 2024/1/26 15:50, Muchun Song wrote: >>>>>>>>>>> On Jan 26, 2024, at 04:28, Thorvald Natvig wrote: >>>>>>>>>>> >>>>>>>>>>> We've found what appears to be a lock issue that results in a blocked >>>>>>>>>>> process somewhere in hugetlbfs for shared maps; seemingly from an >>>>>>>>>>> interaction between hugetlb_vm_op_open and hugetlb_vmdelete_list. >>>>>>>>>>> >>>>>>>>>>> Based on some added pr_warn, we believe the following is happening: >>>>>>>>>>> When hugetlb_vmdelete_list is entered from the child process, >>>>>>>>>>> vma->vm_private_data is NULL, and hence hugetlb_vma_trylock_write does >>>>>>>>>>> not lock, since neither __vma_shareable_lock nor __vma_private_lock >>>>>>>>>>> are true. >>>>>>>>>>> >>>>>>>>>>> While hugetlb_vmdelete_list is executing, the parent process does >>>>>>>>>>> fork(), which ends up in hugetlb_vm_op_open, which in turn allocates a >>>>>>>>>>> lock for the same vma. >>>>>>>>>>> >>>>>>>>>>> Thus, when the hugetlb_vmdelete_list in the child reaches the end of >>>>>>>>>>> the function, vma->vm_private_data is now populated, and hence >>>>>>>>>>> hugetlb_vma_unlock_write tries to unlock the vma_lock, which it does >>>>>>>>>>> not hold. >>>>>>>>>> Thanks for your report. ->vm_private_data was introduced since the >>>>>>>>>> series [1]. So I suspect it was caused by this. But I haven't reviewed >>>>>>>>>> that at that time (actually, it is a little complex in pmd sharing >>>>>>>>>> case). I saw Miaohe had reviewed many of those. >>>>>>>>>> >>>>>>>>>> CC Miaohe, maybe he has some ideas on this. >>>>>>>>>> >>>>>>>>>> [1] https://lore.kernel.org/all/20220914221810.95771-7-mike.kravetz@oracle.com/T/#m2141e4bc30401a8ce490b1965b9bad74e7f791ff >>>>>>>>>> >>>>>>>>>> Thanks. >>>>>>>>>> >>>>>>>>>>> dmesg: >>>>>>>>>>> WARNING: bad unlock balance detected! >>>>>>>>>>> 6.8.0-rc1+ #24 Not tainted >>>>>>>>>>> ------------------------------------- >>>>>>>>>>> lock/2613 is trying to release lock (&vma_lock->rw_sema) at: >>>>>>>>>>> [] hugetlb_vma_unlock_write+0x48/0x60 >>>>>>>>>>> but there are no more locks to release! >>>>>>>>> Thanks for your report. It seems there's a race: >>>>>>>>> >>>>>>>>> CPU 1 CPU 2 >>>>>>>>> fork hugetlbfs_fallocate >>>>>>>>> dup_mmap hugetlbfs_punch_hole >>>>>>>>> i_mmap_lock_write(mapping); >>>>>>>>> vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree. >>>>>>>>> i_mmap_unlock_write(mapping); >>>>>>>>> hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem! i_mmap_lock_write(mapping); >>>>>>>>> hugetlb_vmdelete_list >>>>>>>>> vma_interval_tree_foreach >>>>>>>>> hugetlb_vma_trylock_write -- Vma_lock is cleared. >>>>>>>>> tmp->vm_ops->open -- Alloc new vma_lock outside i_mmap_rwsem! >>>>>>>>> hugetlb_vma_unlock_write -- Vma_lock is assigned!!! >>>>>>>>> i_mmap_unlock_write(mapping); >>>>>>>>> >>>>>>>>> hugetlb_dup_vma_private and hugetlb_vm_op_open are called outside i_mmap_rwsem lock. So there will be another bugs behind it. >>>>>>>>> But I'm not really sure. I will take a more closed look at next week. >>>>>>>> This can be fixed by deferring vma_interval_tree_insert_after() until vma is fully initialized. >>>>>>>> But I'm not sure whether there're side effects with this patch. >>>>>>>> >>>>>>>> linux-UJMmTI:/home/linmiaohe/mm # git diff >>>>>>>> diff --git a/kernel/fork.c b/kernel/fork.c >>>>>>>> index 47ff3b35352e..2ef2711452e0 100644 >>>>>>>> --- a/kernel/fork.c >>>>>>>> +++ b/kernel/fork.c >>>>>>>> @@ -712,21 +712,6 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, >>>>>>>> } else if (anon_vma_fork(tmp, mpnt)) >>>>>>>> goto fail_nomem_anon_vma_fork; >>>>>>>> vm_flags_clear(tmp, VM_LOCKED_MASK); >>>>>>>> - file = tmp->vm_file; >>>>>>>> - if (file) { >>>>>>>> - struct address_space *mapping = file->f_mapping; >>>>>>>> - >>>>>>>> - get_file(file); >>>>>>>> - i_mmap_lock_write(mapping); >>>>>>>> - if (vma_is_shared_maywrite(tmp)) >>>>>>>> - mapping_allow_writable(mapping); >>>>>>>> - flush_dcache_mmap_lock(mapping); >>>>>>>> - /* insert tmp into the share list, just after mpnt */ >>>>>>>> - vma_interval_tree_insert_after(tmp, mpnt, >>>>>>>> - &mapping->i_mmap); >>>>>>>> - flush_dcache_mmap_unlock(mapping); >>>>>>>> - i_mmap_unlock_write(mapping); >>>>>>>> - } >>>>>>>> >>>>>>>> /* >>>>>>>> * Copy/update hugetlb private vma information. >>>>>>>> @@ -747,6 +732,22 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, >>>>>>>> if (tmp->vm_ops && tmp->vm_ops->open) >>>>>>>> tmp->vm_ops->open(tmp); >>>>>>>> >>>>>>>> + file = tmp->vm_file; >>>>>>>> + if (file) { >>>>>>>> + struct address_space *mapping = file->f_mapping; >>>>>>>> + >>>>>>>> + get_file(file); >>>>>>>> + i_mmap_lock_write(mapping); >>>>>>>> + if (vma_is_shared_maywrite(tmp)) >>>>>>>> + mapping_allow_writable(mapping); >>>>>>>> + flush_dcache_mmap_lock(mapping); >>>>>>>> + /* insert tmp into the share list, just after mpnt. */ >>>>>>>> + vma_interval_tree_insert_after(tmp, mpnt, >>>>>>>> + &mapping->i_mmap); >>>>>>>> + flush_dcache_mmap_unlock(mapping); >>>>>>>> + i_mmap_unlock_write(mapping); >>>>>>>> + } >>>>>>>> + >>>>>>>> if (retval) { >>>>>>>> mpnt = vma_next(&vmi); >>>>>>>> goto loop_out; >>>>>>>> >>>>>>>> >>>>>>> How is this possible? I thought, as specified in mm/rmap.c, that the >>>>>>> hugetlbfs path would be holding the mmap lock (which is also held in the >>>>>>> fork path)? >>>>>> The fork path holds the mmap lock from parent A and other childs(except first child B) while hugetlbfs path >>>>>> holds the mmap lock from first child B. So the mmap lock won't help here because it comes from different mm. >>>>>> Or am I miss something? >>>>> You are correct. It is also in mm/rmap.c: >>>>> * hugetlbfs PageHuge() take locks in this order: >>>>> * hugetlb_fault_mutex (hugetlbfs specific page fault mutex) >>>>> * vma_lock (hugetlb specific lock for pmd_sharing) >>>>> * mapping->i_mmap_rwsem (also used for hugetlb pmd sharing) >>>>> * page->flags PG_locked (lock_page) >>>>> >>>>> Does it make sense for hugetlb_dup_vma_private() to assert >>>>> mapping->i_mmap_rwsem is locked? When is that necessary? >>>> I'm afraid not. AFAICS, vma_lock(vma->vm_private_data) is only modified at the time of >>>> vma creating or destroy. Vma_lock is not supposed to be used at that time. >>>> >>>>> I also think it might be safer to move the hugetlb_dup_vma_private() >>>>> call up instead of the insert into the interval tree down? >>>>> See the following comment from mmap.c: >>>>> >>>>> /* >>>>> * Put into interval tree now, so instantiated pages >>>>> * are visible to arm/parisc __flush_dcache_page >>>>> * throughout; but we cannot insert into address >>>>> * space until vma start or end is updated. >>>>> */ >>>>> >>>>> So there may be arch dependent reasons for this order. >>>> Yes, it should be safer to move hugetlb_dup_vma_private() call up. But we also need to move tmp->vm_ops->open(tmp) call up. >>>> Or the race still exists: >>>> >>>> CPU 1 CPU 2 >>>> fork hugetlbfs_fallocate >>>> dup_mmap hugetlbfs_punch_hole >>>> hugetlb_dup_vma_private -- Clear vma_lock. <-- it is moved up. >>>> i_mmap_lock_write(mapping); >>>> vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree. >>>> i_mmap_unlock_write(mapping); >>>> i_mmap_lock_write(mapping); >>>> hugetlb_vmdelete_list >>>> vma_interval_tree_foreach >>>> hugetlb_vma_trylock_write -- Vma_lock is already cleared. >>>> tmp->vm_ops->open -- Alloc new vma_lock outside i_mmap_rwsem! >>>> hugetlb_vma_unlock_write -- Vma_lock is assigned!!! >>>> i_mmap_unlock_write(mapping); >>>> >>>> >>>> My patch should not be a complete solution. It's used to prove and fix the race quickly. It's very great if you or >>>> someone else can provide a better and safer solution. >>> >>> But, your patch has already moved the vma_interval_tree_insert_after() block after the >>> >>> tmp->vm_ops->open(tmp) call, right? Hence, there should be no more race with truncation? >> >> Sure. There won't be more race if tmp->vm_ops->open(tmp) call is *also* moved above vma_interval_tree_insert_after() block. >> But I'm not sure it's safe to do so. There might be some obscure assumptions about the time to call vma_interval_tree_insert_after(). >> >> Thanks. >> >>> >>> thanks, >>> -jane >>> >>>> Thanks. >>>> >>>>> Thanks, >>>>> Liam >>>>> >>>>> . >>>>> >> > . >