From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C3557C433DB for ; Tue, 5 Jan 2021 06:12:58 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id E332822838 for ; Tue, 5 Jan 2021 06:12:57 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E332822838 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=bytedance.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 014C08D0055; Tue, 5 Jan 2021 01:12:57 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id EDFFF8D0036; Tue, 5 Jan 2021 01:12:56 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id DA76D8D0055; Tue, 5 Jan 2021 01:12:56 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0200.hostedemail.com [216.40.44.200]) by kanga.kvack.org (Postfix) with ESMTP id BF9E08D0036 for ; Tue, 5 Jan 2021 01:12:56 -0500 (EST) Received: from smtpin06.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 8532D3623 for ; Tue, 5 Jan 2021 06:12:56 +0000 (UTC) X-FDA: 77670703152.06.alarm67_3d1093f274d6 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin06.hostedemail.com (Postfix) with ESMTP id 6867110047DF8 for ; Tue, 5 Jan 2021 06:12:56 +0000 (UTC) X-HE-Tag: alarm67_3d1093f274d6 X-Filterd-Recvd-Size: 8966 Received: from mail-pg1-f181.google.com (mail-pg1-f181.google.com [209.85.215.181]) by imf27.hostedemail.com (Postfix) with ESMTP for ; Tue, 5 Jan 2021 06:12:55 +0000 (UTC) Received: by mail-pg1-f181.google.com with SMTP id i5so20642271pgo.1 for ; Mon, 04 Jan 2021 22:12:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jWi8cw1qWlIxjtO30blJ1+kqTM+zKLfOAXDrjiZ/2r4=; b=MJYCp2RWqiVgRL/UD9z2PVZZQMcTly8hOW3cgohu42eT1wvF6x5ZHLX9HaUmGelPWy 5RtiI5TMc5s4M49wj6e7ysioZLRV6ARTHYtJlI6vTWIhNixxvUpQNYMcR6Pm1JwC63wg 4Vzp6r2f/yhmcpXUf8hvhWhCqEwXd4FLOezTYwJtK0RESMbQ5Ho+yFTcgFPTPCMIBjOM Un6VoH1DRgJjJ2CzGoFLQAGzpLrdRg1EI6uVsfOwvxFN1fwF9+wzC5fU4lDtVL41f4OQ CDKKnaAnZtEG0wL+J1jJeW3GX49XIb+CYA8DtqaJsn3ObSPrswQ4seF91v5YToqixcpW 8X5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jWi8cw1qWlIxjtO30blJ1+kqTM+zKLfOAXDrjiZ/2r4=; b=cBo5n82xdU1++QqwkL5hGu21JmhXrNj0BSMa1/QGl26gREVMfLYXsXkCGp8KoMb068 8Ph5MRvoWB6YCzI06zcE5eOmzZnf3Ppld0K1BfvECCb7OywBon2lDpi96Kx1VWB7JKp/ IuRXOYDcfRHS8UWth9jDTD7OWxtlh1ab7LVNosckmLJdUbQiB39zC28GJx8ucBu/toN7 asnMZq4kGV5WEUPsrDOJJ9KmLBQV3pRRWpVH61JTXST/H+La3oxFoDJ5ovHtlSDgWuRP FwB8boi59yba1i4QRKnPZnWNGUckHCrJB68T68OtGz20FW2CsX78KjeYPQdKiPwhFb6q G2Tg== X-Gm-Message-State: AOAM530LHyUrmjZAl1ENZckm5lNlSlHguGpwpu943Xs9RmjxQvg5vuk+ TDJDYMtpfk5f1Y2K/ObWao0JSi0HZGeXUoI2ZpYlzg== X-Google-Smtp-Source: ABdhPJzjWz4zKDMMh3np/qltfI8R8yx7wZLmQRDuZmltkV8Dzo4n5qhCZDiVfY7gjCgR6U1iPU9yD7SPf2q+dysi8B8= X-Received: by 2002:a63:480f:: with SMTP id v15mr60806345pga.341.1609827174665; Mon, 04 Jan 2021 22:12:54 -0800 (PST) MIME-Version: 1.0 References: <20210104065843.5658-1-songmuchun@bytedance.com> <20210104065843.5658-3-songmuchun@bytedance.com> In-Reply-To: From: Muchun Song Date: Tue, 5 Jan 2021 14:12:16 +0800 Message-ID: Subject: Re: [External] Re: [PATCH 3/6] mm: hugetlb: fix a race between freeing and dissolving the page To: Mike Kravetz Cc: Andrew Morton , Naoya Horiguchi , Andi Kleen , mhocko@suse.cz, Linux Memory Management List , LKML Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Jan 5, 2021 at 8:02 AM Mike Kravetz wrote: > > On 1/3/21 10:58 PM, Muchun Song wrote: > > There is a race condition between __free_huge_page() > > and dissolve_free_huge_page(). > > > > CPU0: CPU1: > > > > // page_count(page) == 1 > > put_page(page) > > __free_huge_page(page) > > dissolve_free_huge_page(page) > > spin_lock(&hugetlb_lock) > > // PageHuge(page) && !page_count(page) > > update_and_free_page(page) > > // page is freed to the buddy > > spin_unlock(&hugetlb_lock) > > spin_lock(&hugetlb_lock) > > clear_page_huge_active(page) > > enqueue_huge_page(page) > > // It is wrong, the page is already freed > > spin_unlock(&hugetlb_lock) > > > > The race windows is between put_page() and spin_lock() which > > is in the __free_huge_page(). > > > > We should make sure that the page is already on the free list > > when it is dissolved. > > > > Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage") > > Signed-off-by: Muchun Song > > --- > > mm/hugetlb.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ > > 1 file changed, 48 insertions(+) > > > > diff --git a/mm/hugetlb.c b/mm/hugetlb.c > > index 1f3bf1710b66..72608008f8b4 100644 > > --- a/mm/hugetlb.c > > +++ b/mm/hugetlb.c > > @@ -79,6 +79,21 @@ DEFINE_SPINLOCK(hugetlb_lock); > > static int num_fault_mutexes; > > struct mutex *hugetlb_fault_mutex_table ____cacheline_aligned_in_smp; > > > > +static inline bool PageHugeFreed(struct page *head) > > +{ > > + return page_private(head) == -1UL; > > return page_private(head + 4) == -1UL; Very thanks. It's my mistake when rebasing. Will update in the next version. > > > +} > > + > > +static inline void SetPageHugeFreed(struct page *head) > > +{ > > + set_page_private(head + 4, -1UL); > > +} > > + > > +static inline void ClearPageHugeFreed(struct page *head) > > +{ > > + set_page_private(head + 4, 0); > > +} > > It is unfortunate that we can not use some existing value like > page_huge_active() to determine if dissolve_free_huge_page() should > proceed with freeing the page to buddy. If the existing check, > > if (!page_count(page)) { > > was changed to > > if (!page_count(page) && !page_huge_active(page)) { > > the race window would be shrunk. However, the most straight forward > way to fully close the window is with the approach taken here. > > > + > > /* Forward declaration */ > > static int hugetlb_acct_memory(struct hstate *h, long delta); > > > > @@ -1028,6 +1043,7 @@ static void enqueue_huge_page(struct hstate *h, struct page *page) > > list_move(&page->lru, &h->hugepage_freelists[nid]); > > h->free_huge_pages++; > > h->free_huge_pages_node[nid]++; > > + SetPageHugeFreed(page); > > } > > > > static struct page *dequeue_huge_page_node_exact(struct hstate *h, int nid) > > @@ -1044,6 +1060,7 @@ static struct page *dequeue_huge_page_node_exact(struct hstate *h, int nid) > > > > list_move(&page->lru, &h->hugepage_activelist); > > set_page_refcounted(page); > > + ClearPageHugeFreed(page); > > h->free_huge_pages--; > > h->free_huge_pages_node[nid]--; > > return page; > > @@ -1504,6 +1521,7 @@ static void prep_new_huge_page(struct hstate *h, struct page *page, int nid) > > spin_lock(&hugetlb_lock); > > h->nr_huge_pages++; > > h->nr_huge_pages_node[nid]++; > > + ClearPageHugeFreed(page); > > spin_unlock(&hugetlb_lock); > > } > > > > @@ -1770,6 +1788,36 @@ int dissolve_free_huge_page(struct page *page) > > int nid = page_to_nid(head); > > if (h->free_huge_pages - h->resv_huge_pages == 0) > > goto out; > > + > > + /* > > + * There is a race condition between __free_huge_page() > > + * and dissolve_free_huge_page(). > > + * > > + * CPU0: CPU1: > > + * > > + * // page_count(page) == 1 > > + * put_page(page) > > + * __free_huge_page(page) > > + * dissolve_free_huge_page(page) > > + * spin_lock(&hugetlb_lock) > > + * // PageHuge(page) && !page_count(page) > > + * update_and_free_page(page) > > + * // page is freed to the buddy > > + * spin_unlock(&hugetlb_lock) > > + * spin_lock(&hugetlb_lock) > > + * enqueue_huge_page(page) > > + * // It is wrong, the page is already freed > > + * spin_unlock(&hugetlb_lock) > > + * > > + * The race window is between put_page() and spin_lock() which > > + * is in the __free_huge_page(). > > IMO, the description of the race condition in the commit message is > sufficient. It does not need to be here in the code. The below comment > should be sufficient. > > -- > Mike Kravetz > > > + * > > + * We should make sure that the page is already on the free list > > + * when it is dissolved. > > + */ > > + if (unlikely(!PageHugeFreed(head))) > > + goto out; > > + > > /* > > * Move PageHWPoison flag from head page to the raw error page, > > * which makes any subpages rather than the error page reusable. > >