From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F8EAC678D5 for ; Sat, 4 Mar 2023 23:26:08 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 931106B0072; Sat, 4 Mar 2023 18:26:07 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 8BA616B0073; Sat, 4 Mar 2023 18:26:07 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 75A846B0074; Sat, 4 Mar 2023 18:26:07 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 60AD56B0072 for ; Sat, 4 Mar 2023 18:26:07 -0500 (EST) Received: from smtpin24.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 3990E1203C6 for ; Sat, 4 Mar 2023 23:26:07 +0000 (UTC) X-FDA: 80532801174.24.1A1633D Received: from mail-yb1-f170.google.com (mail-yb1-f170.google.com [209.85.219.170]) by imf08.hostedemail.com (Postfix) with ESMTP id 7902616001A for ; Sat, 4 Mar 2023 23:26:05 +0000 (UTC) Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=j5pUyWqI; spf=pass (imf08.hostedemail.com: domain of surenb@google.com designates 209.85.219.170 as permitted sender) smtp.mailfrom=surenb@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1677972365; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=RyFHuSabdXskT7o5KuCkB0maeQkY66+o/DnfFkdhBiE=; b=x/HKQd4g+efCMccmZFSgaEKCv7qPIiqfSp2FfB5jIKDZH1i+QI5eFUDfIIoHyP9+aQJuND af3oq3gfaQSG5PGcRpcbipF8jtmFV/dMKh/SH1gf4YY6ZfT5IJAGmTALT27GOJhlxoD1N4 NPV+svBpZxopnEjDLdsTBsw6UiaaAo4= ARC-Authentication-Results: i=1; imf08.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=j5pUyWqI; spf=pass (imf08.hostedemail.com: domain of surenb@google.com designates 209.85.219.170 as permitted sender) smtp.mailfrom=surenb@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1677972365; a=rsa-sha256; cv=none; b=yWZtbbnLODTY/xz0aVH3mNOUtIc4qUkXCKtEB7VgNqNLGs3o74A+Qqqhj66B9zTjAPSmWn 4MRVJgFVi5hjcM2jUysaB30sAdlp8M/wGmWs/GgQoBe6mYgYleEuKWFc9ruF8yf8DtuGBR w2BSej4TSKrtn8HKmNiezINkJCyJjXE= Received: by mail-yb1-f170.google.com with SMTP id n18so4991977ybm.10 for ; Sat, 04 Mar 2023 15:26:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; t=1677972364; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=RyFHuSabdXskT7o5KuCkB0maeQkY66+o/DnfFkdhBiE=; b=j5pUyWqIM4qqaXra/q1gm5l+Rrxt3/gxNNbU9bD+iCQfnOBIx1N/hO/J2Owi6e+Cmi ES+7FedXhyFT92k4iOMFTIoAChF6c+cfjEYNN81MN4eFGbTrXPFKezTpupvJrmObaxto msh7zvGEhiokA6mCHqfriXB9wTWrEd2aG4m/L1Gidhr8kk+gR/lq5L1aR87Gb7EcDPdp UUQaH5oALkzqX2vRtsj+/vjs2q1vdiX5MZeUjMYy+dqytpGC3ySDJM/iC/Yd/KvT0xLr lR6CBPvCrAC+XJtY5HqIH7YOb4y5GRjo0He6b8cXC+0XgEku69nOGRuym7vvp9OkGhXl ecJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1677972364; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=RyFHuSabdXskT7o5KuCkB0maeQkY66+o/DnfFkdhBiE=; b=Jn6ktqeEUcsKIoSttOi4UZOZGk9ZvkFKcZP5FS7JufIvxW+AMg6exg66G5YZnXF/9c tf7J3xYB/Gn0LQmU10OMuwK6CSGirMS+esCRPSTFxkOGZKuvMAKKIsh5nTSP3J7DVkkK batHU0gIKb2bMrTxRnajEL6RWF7o0PV2LY1+c5ljI3tWW1gHhOM+XQr7FlBisSFnMLES LYGQoAcw8s20qf99qRePXR2LfZLESjBd1cWbGS6y4KutorgAbSuCauRwNOqfvoTS6zrI K2j5KeoBbosQULD7Y5cdQaRTSqDte7iahNJuaeS63ml+j5sq5iDNtvmsCSFjZVpsumLr 6vlA== X-Gm-Message-State: AO0yUKUWW1/cWjHd9c9HtkHpM9PzGhhhf3XDHtGPM6z46cm2243VzQcJ SKthgiWErJ9ArMoMw/k+pHjgpu9t/+geiEoeeuIrEQ== X-Google-Smtp-Source: AK7set9MGrcd7OX+jyQL3bPRFDTlcTb8iKtIwFr+cEznVewr5XHLHgIlkxlPYX6Wv26mEDxLxmTUjyIJ2/sYuwcoIW0= X-Received: by 2002:a05:6902:524:b0:ab8:1ed9:cfc5 with SMTP id y4-20020a056902052400b00ab81ed9cfc5mr3668856ybs.6.1677972364336; Sat, 04 Mar 2023 15:26:04 -0800 (PST) MIME-Version: 1.0 References: <20230303213250.3555716-1-surenb@google.com> In-Reply-To: <20230303213250.3555716-1-surenb@google.com> From: Suren Baghdasaryan Date: Sat, 4 Mar 2023 15:25:53 -0800 Message-ID: Subject: Re: [PATCH 1/1] mm/khugepaged: fix vm_lock/i_mmap_rwsem inversion in retract_page_tables To: akpm@linux-foundation.org Cc: michel@lespinasse.org, jglisse@google.com, mhocko@suse.com, vbabka@suse.cz, hannes@cmpxchg.org, mgorman@techsingularity.net, dave@stgolabs.net, willy@infradead.org, liam.howlett@oracle.com, songliubraving@fb.com, peterx@redhat.com, david@redhat.com, dhowells@redhat.com, hughd@google.com, bigeasy@linutronix.de, punit.agrawal@bytedance.com, lstoakes@gmail.com, rppt@kernel.org, jannh@google.com, shakeelb@google.com, gthelen@google.com, gurua@google.com, arjunroy@google.com, posk@google.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-team@android.com, syzbot+8955a9646d1a48b8be92@syzkaller.appspotmail.com Content-Type: text/plain; charset="UTF-8" X-Rspam-User: X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 7902616001A X-Stat-Signature: u5rwrhgna8tz45hj1nbdrnoba6xet146 X-HE-Tag: 1677972365-350077 X-HE-Meta: U2FsdGVkX19xHYTemoPL+BZ289IeL3N/OZNutaeyNQ37Ze1uNlB/wzBMfXo3W4Dc9fKNBRB27WIOqbQ95A6uN5O1nATiU4UTnMvhG+KizkC+2V17zF56kYLUjCKzKDxyNsyqj1SwOxJQ1EwA2wxzWzQvgBTVT+B+AB1A/ltA3QrUA0aLg3sRAbepInpNi1QkaCv7tJyVyLi7Fk7GDjU8AJKJcimFMHejVaP6rN+OZeXU0BsQxK7OZD9O+ZNjqd0r4m3DeCfraK3q9/DreD3PjjGAZVZsebR3ajl2ggAXnZYOXkVfPhhj46qTzu3BYbllhc9Fz6WLFr+fM43vkvNGNNETm3axo99/G1702K+pG/+CZbp2FVG2jUaU/QwJzXeTkaZX9bTkPRXMukClowiR093ROB5fTlkrFqIaZl+EfCO1E18AUFW5Ld7tO8vPCCU4N7nrjgGAssaF+7nuzxM0Bo2V0BsSfo4sOHNDzpGEOx1uvcvICr4CqCJ11yG6W/AzzRXZXb3kDxX9I6hs5LmjKC+foPuJYvxKzUyaGNPpr6fbn6iiDJ0f+sEKcJxxxhMtg0s+9JN+LKuNBwIqIVDpsugvSwMf0f4a+yZ+vCil0V3Z8sKNWgeuMvRrYlqdV4hglm/OwgJIqoCJu9fdvluWYPvIug44j+ycCvjZTESxon033uxVa/sxl/0mrCqgt3CqdRpYVVqW5z+NZnpGsHf3FD3w02A0lZqwI+sS0JM4HUxuBL678hjHxuzvBguwrC85JsWxYqWKanJTNVD2Vqx2k+LsBepuA8MEq0045FG/9e9byufVY466GMUSF3f2rG76Nvsiu2QLX8vuk3ZQpl2sGCEh+veLaBnmOYXdcpTK6guAiOtjNBaI69BR/hTE96Z1UXqmRjaSs80ygbFwyDeEg/M2dxv8J4PC0X3LBVgz6jE2ShX0GNcaI0RAv8lPD2E3Ba61S4znsFbrnIDTwyY Tantb5e6 UrCkANHimQR5NTmZlC8XrHDTW7EmYkRkHvowwLgq6kpJr2tK/jT8VxHPOdxYAEApqEC+I7cnji1WSMI041P+mbB4gYjNmf8DxwR6OSEV62n4HBwW/5E+IW4Bp8B7Kk9TdI4zXPtMBylmOXxKVOIMs22eXqKJ6Hg5TFJ8DidjI3ZkB6TbY4CtBNw+RkZ/0K6lvtUi5VdgdNpdel2j4E5wxiqgWbLam0Cjthrv2xqq4s+OQTD6h+PXv87COoRfqPfSeU268xj+F2nQ+ZfHCglpA9whUoodrqtj4tFWdWKsSOYv5qPaK7u4c8NbM6OeecwgDhZl2MPdVYm3IWq2hoTQFNCf8isyPHyh1SiaVN27NBRvWm/qlXJcw8GFgKt+pu3SuqVzCgLmAY5Wdey8FPB2ISyvjlj3kfZ89zi7S2gDAQWucAf/6e/oxxbkaqRoeqvbqB64Pnvll8G4ib1sggl1FegcSJ+Ul2CnkOlax X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, Mar 3, 2023 at 1:32 PM Suren Baghdasaryan wrote: > > Internal syscaller on linux-next reported a lock inversion cause by > vm_lock being taken after i_mmap_rwsem: > > ====================================================== > WARNING: possible circular locking dependency detected > 6.2.0-next-20230301-syzkaller #0 Not tainted > ------------------------------------------------------ > syz-executor115/5084 is trying to acquire lock: > ffff888078307a90 (&vma->vm_lock->lock){++++}-{3:3}, at: vma_start_write include/linux/mm.h:678 [inline] > ffff888078307a90 (&vma->vm_lock->lock){++++}-{3:3}, at: retract_page_tables mm/khugepaged.c:1826 [inline] > ffff888078307a90 (&vma->vm_lock->lock){++++}-{3:3}, at: collapse_file+0x4fa5/0x5980 mm/khugepaged.c:2204 > > but task is already holding lock: > ffff88801f93efa8 (&mapping->i_mmap_rwsem){++++}-{3:3}, at: i_mmap_lock_write include/linux/fs.h:468 [inline] > ffff88801f93efa8 (&mapping->i_mmap_rwsem){++++}-{3:3}, at: retract_page_tables mm/khugepaged.c:1745 [inline] > ffff88801f93efa8 (&mapping->i_mmap_rwsem){++++}-{3:3}, at: collapse_file+0x3da6/0x5980 mm/khugepaged.c:2204 > > retract_page_tables takes i_mmap_rwsem before exclusive mmap_lock, which > is inverse to normal order. Deadlock is avoided by try-locking mmap_lock > and skipping on failure to obtain it. Locking the VMA should use the same > locking pattern to avoid this lock inversion. > > Fixes: 44a83f2083bd ("mm/khugepaged: write-lock VMA while collapsing a huge page") > Reported-by: syzbot+8955a9646d1a48b8be92@syzkaller.appspotmail.com > Signed-off-by: Suren Baghdasaryan > --- > include/linux/mm.h | 39 ++++++++++++++++++++++++++++----------- > mm/khugepaged.c | 5 ++++- > 2 files changed, 32 insertions(+), 12 deletions(-) > > diff --git a/include/linux/mm.h b/include/linux/mm.h > index 1b9be34a24fb..5f16263d176d 100644 > --- a/include/linux/mm.h > +++ b/include/linux/mm.h > @@ -676,18 +676,23 @@ static inline void vma_end_read(struct vm_area_struct *vma) > rcu_read_unlock(); > } > > -static inline void vma_start_write(struct vm_area_struct *vma) > +static bool __is_vma_write_locked(struct vm_area_struct *vma, int *mm_lock_seq) > { > - int mm_lock_seq; > - > mmap_assert_write_locked(vma->vm_mm); > > /* > * current task is holding mmap_write_lock, both vma->vm_lock_seq and > * mm->mm_lock_seq can't be concurrently modified. > */ > - mm_lock_seq = READ_ONCE(vma->vm_mm->mm_lock_seq); > - if (vma->vm_lock_seq == mm_lock_seq) > + *mm_lock_seq = READ_ONCE(vma->vm_mm->mm_lock_seq); > + return (vma->vm_lock_seq == *mm_lock_seq); > +} > + > +static inline void vma_start_write(struct vm_area_struct *vma) > +{ > + int mm_lock_seq; > + > + if (__is_vma_write_locked(vma, &mm_lock_seq)) > return; > > down_write(&vma->vm_lock->lock); > @@ -695,14 +700,26 @@ static inline void vma_start_write(struct vm_area_struct *vma) > up_write(&vma->vm_lock->lock); > } > > +static inline bool vma_try_start_write(struct vm_area_struct *vma) > +{ > + int mm_lock_seq; > + > + if (__is_vma_write_locked(vma, &mm_lock_seq)) > + return true; > + > + if (!down_write_trylock(&vma->vm_lock->lock)) > + return false; > + > + vma->vm_lock_seq = mm_lock_seq; > + up_write(&vma->vm_lock->lock); > + return true; > +} > + > static inline void vma_assert_write_locked(struct vm_area_struct *vma) > { > - mmap_assert_write_locked(vma->vm_mm); > - /* > - * current task is holding mmap_write_lock, both vma->vm_lock_seq and > - * mm->mm_lock_seq can't be concurrently modified. > - */ > - VM_BUG_ON_VMA(vma->vm_lock_seq != READ_ONCE(vma->vm_mm->mm_lock_seq), vma); > + int mm_lock_seq; > + > + VM_BUG_ON_VMA(!__is_vma_write_locked(vma, &mm_lock_seq), vma); > } Hi Andrew, I missed vma_try_start_write() definition for CONFIG_PER_VMA_LOCK=n configuration. Could you please patch this with the following?: --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -740,6 +740,8 @@ static inline bool vma_start_read(struct vm_area_struct *vma) { return false; } static inline void vma_end_read(struct vm_area_struct *vma) {} static inline void vma_start_write(struct vm_area_struct *vma) {} +static inline bool vma_try_start_write(struct vm_area_struct *vma) { return true; } static inline void vma_assert_write_locked(struct vm_area_struct *vma) {} or should I send a separate patch? Thanks, Suren. > > static inline void vma_mark_detached(struct vm_area_struct *vma, bool detached) > diff --git a/mm/khugepaged.c b/mm/khugepaged.c > index c64e01f03f27..408fed42c9f5 100644 > --- a/mm/khugepaged.c > +++ b/mm/khugepaged.c > @@ -1795,6 +1795,10 @@ static int retract_page_tables(struct address_space *mapping, pgoff_t pgoff, > result = SCAN_PTE_MAPPED_HUGEPAGE; > if ((cc->is_khugepaged || is_target) && > mmap_write_trylock(mm)) { > + /* trylock for the same lock inversion as above */ > + if (!vma_try_start_write(vma)) > + goto unlock_next; > + > /* > * Re-check whether we have an ->anon_vma, because > * collapse_and_free_pmd() requires that either no > @@ -1823,7 +1827,6 @@ static int retract_page_tables(struct address_space *mapping, pgoff_t pgoff, > result = SCAN_PTE_UFFD_WP; > goto unlock_next; > } > - vma_start_write(vma); > collapse_and_free_pmd(mm, vma, addr, pmd); > if (!cc->is_khugepaged && is_target) > result = set_huge_pmd(vma, addr, pmd, hpage); > -- > 2.40.0.rc0.216.gc4246ad0f0-goog >