From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA8DBCD11DD for ; Fri, 29 Mar 2024 15:54:57 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 052A56B007B; Fri, 29 Mar 2024 11:54:57 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 002566B0082; Fri, 29 Mar 2024 11:54:56 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E0C986B0085; Fri, 29 Mar 2024 11:54:56 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id C2A7E6B007B for ; Fri, 29 Mar 2024 11:54:56 -0400 (EDT) Received: from smtpin03.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 54B7D8023D for ; Fri, 29 Mar 2024 15:54:56 +0000 (UTC) X-FDA: 81950524992.03.427B853 Received: from mail-ua1-f44.google.com (mail-ua1-f44.google.com [209.85.222.44]) by imf11.hostedemail.com (Postfix) with ESMTP id 8FF6A4000C for ; Fri, 29 Mar 2024 15:54:54 +0000 (UTC) Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=x7hKfC1M; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf11.hostedemail.com: domain of thorvald@google.com designates 209.85.222.44 as permitted sender) smtp.mailfrom=thorvald@google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1711727694; a=rsa-sha256; cv=none; b=7V+T2quT4d1NfPK78i6wtEDur/qvgwlqb0gnqUDywb/jkgthv3sMLGdtRKFjR0iVQ4bI0d Tx+RWjq9IxumqXZ4F5V3p8cUbGH3XPQXpWpwqkwOV3YaEnVhprSiZgJyjSPhK/ljHCpPyz S7aFTKr/fgwRYmTxGS9l9j6PEAvQoTs= ARC-Authentication-Results: i=1; imf11.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=x7hKfC1M; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf11.hostedemail.com: domain of thorvald@google.com designates 209.85.222.44 as permitted sender) smtp.mailfrom=thorvald@google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1711727694; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=WrXH6GutdrfCclYWr871MecxszpRHey+2Yl4QE5xHBg=; b=4k1UNc6AgUhgGAkZ8vyZmd0ZFjyPUK75ERVJj73eGcm92gUzDZIza3yYKoiYbtKBafmZZW HcJF8bAXQrVwfASDzBF8EPSqmDDRWDJiIZ8BB1wK9vnkN1qQDFerh/q6f8dOUnyFZ6+wXD gqdLpfaUqT8/KggGEsB3NGugZoZM7U8= Received: by mail-ua1-f44.google.com with SMTP id a1e0cc1a2514c-7e05b1ef7caso806887241.2 for ; Fri, 29 Mar 2024 08:54:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1711727693; x=1712332493; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=WrXH6GutdrfCclYWr871MecxszpRHey+2Yl4QE5xHBg=; b=x7hKfC1M1UGMfnsRm/p3SVBpVGPfCNUsUGYPgN6n9YXxYrxWSPXdYK7g4PS27pXQFw FDEEfjKeH5HMhHvV21spkiooB3ZfoqPszFNWLM/K4W8CCXmiJ8D4CUdSdPMoKwAa4R8W MGyayA4DDVe0gvdrbKSXGXUDjuWpIFipHUO/WxqsD++RQ7OBIg4KyZdBlmkAnEWZT1mg 1kIO5RkcyVZvq5tiBoxP61kuvx0n0+QviTP6nDQMpjXXEkRhij8AFsQO54gG6UkA/W3x wWMOVwUluhcJwknVPrxi2s0daVTkXCRdVkU8+M3mE4wJj6ZSWGiQWNLnk7PP/KeWpAUF FZYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1711727693; x=1712332493; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=WrXH6GutdrfCclYWr871MecxszpRHey+2Yl4QE5xHBg=; b=LX0q878GHZ0B65aMbJSvQp2/XB656AXHrtR6CBqcGGl+NiAmKeNehp4MNIE5r0OnPc ayFNIjGseo6tTTgrRpvuWWFp7V7SmAB7iS5DzQ+eGbavdkmUub3WfQzAKr6ZfcYPlr59 PN17Dk9UH2mzvBFNSVNil89G+dG3EUEmt1pBTeq9zzq3aGV2W60Cnb1s6ACUW8A07EsJ GOZemyeFuXmMQbr9Z/qYvW5od9L73m6WAXuFs9Vy0hvE3V/wgANu95sqXPsV0SSMbX+B m2BLWWu4K1QaGdk8VYK4jnMqhs/tJdWPW34gfj9snPhRQkezHMHjLteChPlsm0fOfEOz ybFQ== X-Forwarded-Encrypted: i=1; AJvYcCVBTt/vGs1/RzWMDRzxk414zVyHdAJHgNRb4UjAAcXJCswnXDIsjyDSWM0hJXf+9rZKzbsiGSNjGOFyFYwSuqJWwL4= X-Gm-Message-State: AOJu0YxQd4rrjjaf41RioeOysPrztZ4N8AjCcoIg6vAp08C3oaEHXIK8 3KIJXUB2MQeL/DWuSCvd7uZu199AEFWazBqYXK5tSNn4RQTKzvHh8XnaIPCs8Nvqm/8HKg32I7s wU9K+IdfMW1mL4xvpr+Z/3PnsSrEjuSycd1Ll X-Google-Smtp-Source: AGHT+IFxJJZUO9+IseJvT0lWb5jz7dgP03Yk2hNWQNPZoRT8/ZFlSmaZCLjyaIEqRB5BS859XS2UISR6XnaUita9Qsk= X-Received: by 2002:a05:6122:1799:b0:4ca:4a07:9006 with SMTP id o25-20020a056122179900b004ca4a079006mr3070404vkf.0.1711727693473; Fri, 29 Mar 2024 08:54:53 -0700 (PDT) MIME-Version: 1.0 References: <42788ABD-99AE-4AEF-B543-C0FABAFA0464@linux.dev> <4780b0e3-42e1-9099-d010-5a1793b6cbd3@huawei.com> <531195fb-b642-2bc1-3a07-4944ee5d8664@huawei.com> <20240129161735.6gmjsswx62o4pbja@revolver> <76f33f3b-f61f-efe7-f63f-1b2e0efaf71d@huawei.com> <20240130040814.hd3edkda5rbsxru7@revolver> <70f13c9f-4364-4154-9b5c-69d6c5e9d65a@oracle.com> <188533a8-e742-65ac-bf24-0560e63e3730@huawei.com> In-Reply-To: <188533a8-e742-65ac-bf24-0560e63e3730@huawei.com> From: Thorvald Natvig Date: Fri, 29 Mar 2024 08:54:36 -0700 Message-ID: Subject: Re: hugetlbfs: WARNING: bad unlock balance detected during MADV_REMOVE To: Miaohe Lin Cc: Jane Chu , "Liam R. Howlett" , Muchun Song , Linux-MM Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspam-User: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: 8FF6A4000C X-Stat-Signature: tw36g45kf6jfup1cxon9jy6f76amt4b9 X-HE-Tag: 1711727694-766527 X-HE-Meta: U2FsdGVkX1+vzlOTOt/R9jxvo1enXRvRcIO5I6orztFf3dp2x14F7V7CK+YIp3R79OdF75Vev53aYYOfZK+oJel2z1aOqoj64dmnJt7VpNM/iEt+RKfTs0L3hNXvVV2OgQhbdnrmFvsaarbE463PPnIjdptrjx1W0vCBUwLDxZc52IbvZmOcC3nraJWc6W5WcbyaeVYBaA2Uc8klVAdIb7cWW48PE9WSLsoZugFjffzSVpO93xtpkvI21bckmQDau6DIvOe+GtXQox6QXKYcC9m98jf8cM8XfflsXCUnbjs3yfTDtim93zaMakpsGSIPVZoR7vB+nl/wt6dmE3vLBELUBzI/HHLkKC36BOVVqezZ8DOCMHPcexGf9Q82UJlhJ0Alj6/Vkegm7mgBkiABjSuy+sfOf76l9T/NWdb8AzGhon/m80hy4XeDeLWPSpSfVyQ5XyB++PqFNnzd1Oo/OLIolUIpEq3fnungLdUj9gRhuUoYVfXX5VNHD2JQ9h3zX+VDes5X4XMAZhyEmsWiypIq8FLYScNKQWC/1gi/nGX4rLAXNNVyBNl5d7MHfM7jirMfFroCEeDmAkXkGdQsIbX95xIML87gAPG+dmwJOpsoTE0zndHwGFg9D4/KZMOv+4kLXbApr7O8QPbZhUChTNZMsv42lZqDWJ5pQYpU5X7jsZNNo+iFQwGl5aHDMkiLsRk0yZeES5nc+y8b1EODVCG0yV/Zspx3NHGDFJrk8k9geZJfugKF+A3WzpdxuAJ9n2ofj7cqYWZ4iikyLx/U95FaHpDsz54VkHwHTTaoeXU4kgmQISdtPwe2vyDyLdFBx+nfgRavFxvtdx3x9Pk/0vCgJiKUJR1h4b7Y2FSQE3sPLQlyyn8Q+IhwqwwbV6W0PMbYjSfsrhHynFfZKlGU5bH7UCiWRHYobM8GLhH7n14nkuVIoOGqCT73jBPy1/cSfB182Pm9xsPuPLm6An/ YFyA9vw1 c7D66Kl8ESO1qcYBwcD2PnPyFx+jGAJ0MFEHQgahzjCFbw4ar7ZBCzpSgmqXYcTch30Sej+3kXYhcC/w0PFPbLMaEn/fr+w1ySVuGkW584GIlK256nI1kryoJqxAAZyZdazZhse1hUzylccJa629qWhtqysNHS6hbiZ2AeeOZTCEg77+j8dQQPRd1ZewkUYRFj0acxiM/zQT7yPSepyLELAVH1sOiXh8WnUFcl2zilX/XMBSdUuBc3GGOf5UfaGgwcN+kE+K+XodJG/nriukr/koWlOqfyY4UnpHi9T/5WGbUJema8ULW8+E8MaU5Lc3Z6lvTxOcsGY0jYsdqd8EDKC60Ln1K01Ra+8EjDIrs+TvUPRtgcnQdL+iFfRWA/p4yuycvVhhiAuI5Qyc= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Did this patch (or another fix for the same problem) make it through? If not, is there anything we can do to help? - Thorvald On Sat, Feb 3, 2024 at 5:54=E2=80=AFPM Miaohe Lin wr= ote: > > On 2024/2/3 5:02, Jane Chu wrote: > > On 1/30/2024 10:51 PM, Miaohe Lin wrote: > > > >> On 2024/1/30 12:08, Liam R. Howlett wrote: > >>> * Miaohe Lin [240129 21:14]: > >>>> On 2024/1/30 0:17, Liam R. Howlett wrote: > >>>>> * Miaohe Lin [240129 07:56]: > >>>>>> On 2024/1/27 18:13, Miaohe Lin wrote: > >>>>>>> On 2024/1/26 15:50, Muchun Song wrote: > >>>>>>>>> On Jan 26, 2024, at 04:28, Thorvald Natvig wrote: > >>>>>>>>> > >>>>>>>>> We've found what appears to be a lock issue that results in a b= locked > >>>>>>>>> process somewhere in hugetlbfs for shared maps; seemingly from = an > >>>>>>>>> interaction between hugetlb_vm_op_open and hugetlb_vmdelete_lis= t. > >>>>>>>>> > >>>>>>>>> Based on some added pr_warn, we believe the following is happen= ing: > >>>>>>>>> When hugetlb_vmdelete_list is entered from the child process, > >>>>>>>>> vma->vm_private_data is NULL, and hence hugetlb_vma_trylock_wri= te does > >>>>>>>>> not lock, since neither __vma_shareable_lock nor __vma_private_= lock > >>>>>>>>> are true. > >>>>>>>>> > >>>>>>>>> While hugetlb_vmdelete_list is executing, the parent process do= es > >>>>>>>>> fork(), which ends up in hugetlb_vm_op_open, which in turn allo= cates a > >>>>>>>>> lock for the same vma. > >>>>>>>>> > >>>>>>>>> Thus, when the hugetlb_vmdelete_list in the child reaches the e= nd of > >>>>>>>>> the function, vma->vm_private_data is now populated, and hence > >>>>>>>>> hugetlb_vma_unlock_write tries to unlock the vma_lock, which it= does > >>>>>>>>> not hold. > >>>>>>>> Thanks for your report. ->vm_private_data was introduced since t= he > >>>>>>>> series [1]. So I suspect it was caused by this. But I haven't re= viewed > >>>>>>>> that at that time (actually, it is a little complex in pmd shari= ng > >>>>>>>> case). I saw Miaohe had reviewed many of those. > >>>>>>>> > >>>>>>>> CC Miaohe, maybe he has some ideas on this. > >>>>>>>> > >>>>>>>> [1] https://lore.kernel.org/all/20220914221810.95771-7-mike.krav= etz@oracle.com/T/#m2141e4bc30401a8ce490b1965b9bad74e7f791ff > >>>>>>>> > >>>>>>>> Thanks. > >>>>>>>> > >>>>>>>>> dmesg: > >>>>>>>>> WARNING: bad unlock balance detected! > >>>>>>>>> 6.8.0-rc1+ #24 Not tainted > >>>>>>>>> ------------------------------------- > >>>>>>>>> lock/2613 is trying to release lock (&vma_lock->rw_sema) at: > >>>>>>>>> [] hugetlb_vma_unlock_write+0x48/0x60 > >>>>>>>>> but there are no more locks to release! > >>>>>>> Thanks for your report. It seems there's a race: > >>>>>>> > >>>>>>> CPU 1 = CPU 2 > >>>>>>> fork = hugetlbfs_fallocate > >>>>>>> dup_mmap = hugetlbfs_punch_hole > >>>>>>> i_mmap_lock_write(mapping); > >>>>>>> vma_interval_tree_insert_after -- Child vma is visible through= i_mmap tree. > >>>>>>> i_mmap_unlock_write(mapping); > >>>>>>> hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem= ! i_mmap_lock_write(mapping); > >>>>>>> = hugetlb_vmdelete_list > >>>>>>> = vma_interval_tree_foreach > >>>>>>> = hugetlb_vma_trylock_write -- Vma_lock is cleared. > >>>>>>> tmp->vm_ops->open -- Alloc new vma_lock outside i_mmap_rwsem! > >>>>>>> = hugetlb_vma_unlock_write -- Vma_lock is assigned!= !! > >>>>>>> = i_mmap_unlock_write(mapping); > >>>>>>> > >>>>>>> hugetlb_dup_vma_private and hugetlb_vm_op_open are called outside= i_mmap_rwsem lock. So there will be another bugs behind it. > >>>>>>> But I'm not really sure. I will take a more closed look at next w= eek. > >>>>>> This can be fixed by deferring vma_interval_tree_insert_after() un= til vma is fully initialized. > >>>>>> But I'm not sure whether there're side effects with this patch. > >>>>>> > >>>>>> linux-UJMmTI:/home/linmiaohe/mm # git diff > >>>>>> diff --git a/kernel/fork.c b/kernel/fork.c > >>>>>> index 47ff3b35352e..2ef2711452e0 100644 > >>>>>> --- a/kernel/fork.c > >>>>>> +++ b/kernel/fork.c > >>>>>> @@ -712,21 +712,6 @@ static __latent_entropy int dup_mmap(struct m= m_struct *mm, > >>>>>> } else if (anon_vma_fork(tmp, mpnt)) > >>>>>> goto fail_nomem_anon_vma_fork; > >>>>>> vm_flags_clear(tmp, VM_LOCKED_MASK); > >>>>>> - file =3D tmp->vm_file; > >>>>>> - if (file) { > >>>>>> - struct address_space *mapping =3D file->f_= mapping; > >>>>>> - > >>>>>> - get_file(file); > >>>>>> - i_mmap_lock_write(mapping); > >>>>>> - if (vma_is_shared_maywrite(tmp)) > >>>>>> - mapping_allow_writable(mapping); > >>>>>> - flush_dcache_mmap_lock(mapping); > >>>>>> - /* insert tmp into the share list, just af= ter mpnt */ > >>>>>> - vma_interval_tree_insert_after(tmp, mpnt, > >>>>>> - &mapping->i_mmap); > >>>>>> - flush_dcache_mmap_unlock(mapping); > >>>>>> - i_mmap_unlock_write(mapping); > >>>>>> - } > >>>>>> > >>>>>> /* > >>>>>> * Copy/update hugetlb private vma information. > >>>>>> @@ -747,6 +732,22 @@ static __latent_entropy int dup_mmap(struct m= m_struct *mm, > >>>>>> if (tmp->vm_ops && tmp->vm_ops->open) > >>>>>> tmp->vm_ops->open(tmp); > >>>>>> > >>>>>> + file =3D tmp->vm_file; > >>>>>> + if (file) { > >>>>>> + struct address_space *mapping =3D file->f_= mapping; > >>>>>> + > >>>>>> + get_file(file); > >>>>>> + i_mmap_lock_write(mapping); > >>>>>> + if (vma_is_shared_maywrite(tmp)) > >>>>>> + mapping_allow_writable(mapping); > >>>>>> + flush_dcache_mmap_lock(mapping); > >>>>>> + /* insert tmp into the share list, just af= ter mpnt. */ > >>>>>> + vma_interval_tree_insert_after(tmp, mpnt, > >>>>>> + &mapping->i_mmap); > >>>>>> + flush_dcache_mmap_unlock(mapping); > >>>>>> + i_mmap_unlock_write(mapping); > >>>>>> + } > >>>>>> + > >>>>>> if (retval) { > >>>>>> mpnt =3D vma_next(&vmi); > >>>>>> goto loop_out; > >>>>>> > >>>>>> > >>>>> How is this possible? I thought, as specified in mm/rmap.c, that t= he > >>>>> hugetlbfs path would be holding the mmap lock (which is also held i= n the > >>>>> fork path)? > >>>> The fork path holds the mmap lock from parent A and other childs(exc= ept first child B) while hugetlbfs path > >>>> holds the mmap lock from first child B. So the mmap lock won't help = here because it comes from different mm. > >>>> Or am I miss something? > >>> You are correct. It is also in mm/rmap.c: > >>> * hugetlbfs PageHuge() take locks in this order: > >>> * hugetlb_fault_mutex (hugetlbfs specific page fault mutex) > >>> * vma_lock (hugetlb specific lock for pmd_sharing) > >>> * mapping->i_mmap_rwsem (also used for hugetlb pmd sharing) > >>> * page->flags PG_locked (lock_page) > >>> > >>> Does it make sense for hugetlb_dup_vma_private() to assert > >>> mapping->i_mmap_rwsem is locked? When is that necessary? > >> I'm afraid not. AFAICS, vma_lock(vma->vm_private_data) is only modifie= d at the time of > >> vma creating or destroy. Vma_lock is not supposed to be used at that t= ime. > >> > >>> I also think it might be safer to move the hugetlb_dup_vma_private() > >>> call up instead of the insert into the interval tree down? > >>> See the following comment from mmap.c: > >>> > >>> /* > >>> * Put into interval tree now, so instantiate= d pages > >>> * are visible to arm/parisc __flush_dcache_p= age > >>> * throughout; but we cannot insert into addr= ess > >>> * space until vma start or end is updated. > >>> */ > >>> > >>> So there may be arch dependent reasons for this order. > >> Yes, it should be safer to move hugetlb_dup_vma_private() call up. But= we also need to move tmp->vm_ops->open(tmp) call up. > >> Or the race still exists: > >> > >> CPU 1 = CPU 2 > >> fork = hugetlbfs_fallocate > >> dup_mmap = hugetlbfs_punch_hole > >> hugetlb_dup_vma_private -- Clear vma_lock. <-- it is moved u= p. > >> i_mmap_lock_write(mapping); > >> vma_interval_tree_insert_after -- Child vma is visible through i_mm= ap tree. > >> i_mmap_unlock_write(mapping); > >> = i_mmap_lock_write(mapping); > >> = hugetlb_vmdelete_list > >> = vma_interval_tree_foreach > >> = hugetlb_vma_trylock_write -- Vma_lock is already cleared. > >> tmp->vm_ops->open -- Alloc new vma_lock outside i_mmap_rwsem! > >> = hugetlb_vma_unlock_write -- Vma_lock is assigned!!! > >> = i_mmap_unlock_write(mapping); > >> > >> > >> My patch should not be a complete solution. It's used to prove and fix= the race quickly. It's very great if you or > >> someone else can provide a better and safer solution. > > > > But, your patch has already moved the vma_interval_tree_insert_after(= ) block after the > > > > tmp->vm_ops->open(tmp) call, right? Hence, there should be no more rac= e with truncation? > > Sure. There won't be more race if tmp->vm_ops->open(tmp) call is *also* m= oved above vma_interval_tree_insert_after() block. > But I'm not sure it's safe to do so. There might be some obscure assumpti= ons about the time to call vma_interval_tree_insert_after(). > > Thanks. > > > > > thanks, > > -jane > > > >> Thanks. > >> > >>> Thanks, > >>> Liam > >>> > >>> . > >>> >