From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_RED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 91FCFC48BCD for ; Wed, 9 Jun 2021 16:54:01 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 22C66613C0 for ; Wed, 9 Jun 2021 16:54:01 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 22C66613C0 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 96C026B0036; Wed, 9 Jun 2021 12:54:00 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 91C046B006C; Wed, 9 Jun 2021 12:54:00 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 7BCF36B0070; Wed, 9 Jun 2021 12:54:00 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0063.hostedemail.com [216.40.44.63]) by kanga.kvack.org (Postfix) with ESMTP id 4C3B46B0036 for ; Wed, 9 Jun 2021 12:54:00 -0400 (EDT) Received: from smtpin37.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id D00309421 for ; Wed, 9 Jun 2021 16:53:59 +0000 (UTC) X-FDA: 78234782598.37.501131A Received: from mail-ej1-f42.google.com (mail-ej1-f42.google.com [209.85.218.42]) by imf13.hostedemail.com (Postfix) with ESMTP id 93244E00026E for ; Wed, 9 Jun 2021 16:53:55 +0000 (UTC) Received: by mail-ej1-f42.google.com with SMTP id g20so39503229ejt.0 for ; Wed, 09 Jun 2021 09:53:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=CjuPCxkHMajDm0LJZ6HojP9067gxaOE35kQ09vyuTbY=; b=fsZc6cAAlB0htjqxdXE0wo5PNRQysfgWur6+bR1Zo6eVJrQNOtXwHgNg791zHZexAT ylFxAKIlMjIKiqqfcAN8r11+yZ1HlVaMOyIyFrjXC6wAD5L2rmPmS/NuQZKP2Lj1ug1z 3MDWYvTABFF2uy2lhTgAYXCQkK7lBdK7zsHdkMN9i2lwd69QKUFYAS3F1n+MnJTWpWVH Db/EbKaa6BxRRF87mMa9XCRZGVCIfYNn6Dj6bnCxmXCxGRF7LRF3TgxTwEAMtSR5P+gm gA6YcLiwHJ7USXf8qYwYm735BOV7s/f0kA2ehkABwbq0ymzEYl1+IM2/YVOncfWyuFfZ adhA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=CjuPCxkHMajDm0LJZ6HojP9067gxaOE35kQ09vyuTbY=; b=OhSWzvx5zXTtonIXbwNPvXczzKiJk0Nm3py2CocQdI7AwcvobKOm+YDUhoDUCCFqfA sKfkivxEACefdtMvHsgSbKH8rV9bTZLj6sESjTm3xFyfTNFdamSUUuEHyn9glJIF18+n xPwsL674U9E9tTxMdAbjiknJo46gcuW08EyyvDDSX4aWC2e3m+JAPht9hsjfvmVhMAEv 3w/Xz6cgfaVyKE5PI8SxLA3HMBxk4jLqY5eP5sS5oouI+TgxuL4mAjFWnIPBFDbOPxw/ zcMGeDM7L41BRIweYgvF0gwyPoNGa3Qncah7O65W8CKDVBO6vC3oP28tqmbpvS/AQWwj +5cQ== X-Gm-Message-State: AOAM5317Vzt/wJX2IxpibOpUM8f08hg4ZsTNxBY6Flm9VbLLYJT6SKpN jftUS2X0+Z6syWQ9OML2npqSB7IhaI05ivNmLuU= X-Google-Smtp-Source: ABdhPJyxNnJY1mRKbOQyd8Piy7wEoYiZWAgvyt3+9ySh0YfpyREn2j0vfzXc12Y6SXpgpcQ7xRjRhax25zHTWa1V36E= X-Received: by 2002:a17:906:488a:: with SMTP id v10mr755069ejq.383.1623257638180; Wed, 09 Jun 2021 09:53:58 -0700 (PDT) MIME-Version: 1.0 References: <59d94b4-c0dd-310-894-be99416f3c92@google.com> In-Reply-To: <59d94b4-c0dd-310-894-be99416f3c92@google.com> From: Yang Shi Date: Wed, 9 Jun 2021 09:53:46 -0700 Message-ID: Subject: Re: [PATCH v2 01/10] mm/thp: fix __split_huge_pmd_locked() on shmem migration entry (fwd) To: Hugh Dickins Cc: Linux MM , Linux Kernel Mailing List Content-Type: text/plain; charset="UTF-8" Authentication-Results: imf13.hostedemail.com; dkim=pass header.d=gmail.com header.s=20161025 header.b=fsZc6cAA; spf=pass (imf13.hostedemail.com: domain of shy828301@gmail.com designates 209.85.218.42 as permitted sender) smtp.mailfrom=shy828301@gmail.com; dmarc=pass (policy=none) header.from=gmail.com X-Stat-Signature: w334yta17qu9aj4chbbxju9qtx3nfp14 X-Rspamd-Queue-Id: 93244E00026E X-Rspamd-Server: rspam06 X-HE-Tag: 1623257635-650089 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Jun 8, 2021 at 9:05 PM Hugh Dickins wrote: > > > > ---------- Forwarded message ---------- > Date: Tue, 8 Jun 2021 21:00:12 -0700 (PDT) > From: Hugh Dickins > To: Andrew Morton > Cc: Hugh Dickins , > Kirill A. Shutemov , > Yang Shi , Wang Yugui , > Matthew Wilcox , > Naoya Horiguchi , > Alistair Popple , Ralph Campbell , > Zi Yan , Miaohe Lin , > Minchan Kim , Jue Wang , > Peter Xu , Jan Kara , > Shakeel Butt , Oscar Salvador > Subject: [PATCH v2 01/10] mm/thp: fix __split_huge_pmd_locked() on shmem > migration entry > > Stressing huge tmpfs page migration racing hole punch often crashed on the > VM_BUG_ON(!pmd_present) in pmdp_huge_clear_flush(), with DEBUG_VM=y kernel; > or shortly afterwards, on a bad dereference in __split_huge_pmd_locked() > when DEBUG_VM=n. They forgot to allow for pmd migration entries in the > non-anonymous case. > > Full disclosure: those particular experiments were on a kernel with more > relaxed mmap_lock and i_mmap_rwsem locking, and were not repeated on the > vanilla kernel: it is conceivable that stricter locking happens to avoid > those cases, or makes them less likely; but __split_huge_pmd_locked() > already allowed for pmd migration entries when handling anonymous THPs, > so this commit brings the shmem and file THP handling into line. > > And while there: use old_pmd rather than _pmd, as in the following blocks; > and make it clearer to the eye that the !vma_is_anonymous() block is > self-contained, making an early return after accounting for unmapping. > > Fixes: e71769ae5260 ("mm: enable thp migration for shmem thp") > Signed-off-by: Hugh Dickins > Cc: Reviewed-by: Yang Shi > --- > v2: omit is_huge_zero_pmd() mods (done differently in next), per Kirill > > mm/huge_memory.c | 27 ++++++++++++++++++--------- > mm/pgtable-generic.c | 5 ++--- > 2 files changed, 20 insertions(+), 12 deletions(-) > > diff --git a/mm/huge_memory.c b/mm/huge_memory.c > index 63ed6b25deaa..42cfefc6e66e 100644 > --- a/mm/huge_memory.c > +++ b/mm/huge_memory.c > @@ -2044,7 +2044,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, > count_vm_event(THP_SPLIT_PMD); > > if (!vma_is_anonymous(vma)) { > - _pmd = pmdp_huge_clear_flush_notify(vma, haddr, pmd); > + old_pmd = pmdp_huge_clear_flush_notify(vma, haddr, pmd); > /* > * We are going to unmap this huge page. So > * just go ahead and zap it > @@ -2053,16 +2053,25 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, > zap_deposited_table(mm, pmd); > if (vma_is_special_huge(vma)) > return; > - page = pmd_page(_pmd); > - if (!PageDirty(page) && pmd_dirty(_pmd)) > - set_page_dirty(page); > - if (!PageReferenced(page) && pmd_young(_pmd)) > - SetPageReferenced(page); > - page_remove_rmap(page, true); > - put_page(page); > + if (unlikely(is_pmd_migration_entry(old_pmd))) { > + swp_entry_t entry; > + > + entry = pmd_to_swp_entry(old_pmd); > + page = migration_entry_to_page(entry); > + } else { > + page = pmd_page(old_pmd); > + if (!PageDirty(page) && pmd_dirty(old_pmd)) > + set_page_dirty(page); > + if (!PageReferenced(page) && pmd_young(old_pmd)) > + SetPageReferenced(page); > + page_remove_rmap(page, true); > + put_page(page); > + } > add_mm_counter(mm, mm_counter_file(page), -HPAGE_PMD_NR); > return; > - } else if (pmd_trans_huge(*pmd) && is_huge_zero_pmd(*pmd)) { > + } > + > + if (pmd_trans_huge(*pmd) && is_huge_zero_pmd(*pmd)) { > /* > * FIXME: Do we want to invalidate secondary mmu by calling > * mmu_notifier_invalidate_range() see comments below inside > diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c > index c2210e1cdb51..4e640baf9794 100644 > --- a/mm/pgtable-generic.c > +++ b/mm/pgtable-generic.c > @@ -135,9 +135,8 @@ pmd_t pmdp_huge_clear_flush(struct vm_area_struct *vma, unsigned long address, > { > pmd_t pmd; > VM_BUG_ON(address & ~HPAGE_PMD_MASK); > - VM_BUG_ON(!pmd_present(*pmdp)); > - /* Below assumes pmd_present() is true */ > - VM_BUG_ON(!pmd_trans_huge(*pmdp) && !pmd_devmap(*pmdp)); > + VM_BUG_ON(pmd_present(*pmdp) && !pmd_trans_huge(*pmdp) && > + !pmd_devmap(*pmdp)); > pmd = pmdp_huge_get_and_clear(vma->vm_mm, address, pmdp); > flush_pmd_tlb_range(vma, address, address + HPAGE_PMD_SIZE); > return pmd; > -- > 2.26.2 > >