From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97FDBC433E0 for ; Tue, 5 Jan 2021 02:56:30 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 090D322583 for ; Tue, 5 Jan 2021 02:56:29 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 090D322583 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=bytedance.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 484C08D004D; Mon, 4 Jan 2021 21:56:29 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 434318D0036; Mon, 4 Jan 2021 21:56:29 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 322F48D004D; Mon, 4 Jan 2021 21:56:29 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0069.hostedemail.com [216.40.44.69]) by kanga.kvack.org (Postfix) with ESMTP id 186A18D0036 for ; Mon, 4 Jan 2021 21:56:29 -0500 (EST) Received: from smtpin08.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id C21621EE6 for ; Tue, 5 Jan 2021 02:56:28 +0000 (UTC) X-FDA: 77670208056.08.force88_430f786274d5 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin08.hostedemail.com (Postfix) with ESMTP id A58DC1819E76C for ; Tue, 5 Jan 2021 02:56:28 +0000 (UTC) X-HE-Tag: force88_430f786274d5 X-Filterd-Recvd-Size: 9264 Received: from mail-pf1-f178.google.com (mail-pf1-f178.google.com [209.85.210.178]) by imf50.hostedemail.com (Postfix) with ESMTP for ; Tue, 5 Jan 2021 02:56:28 +0000 (UTC) Received: by mail-pf1-f178.google.com with SMTP id t8so17563031pfg.8 for ; Mon, 04 Jan 2021 18:56:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9AEybwBm69eftg0EYajj+axAG59q1uYEjCyvlHbtWBw=; b=baZfvCvW6DzeGHxZGTYllRm8nfGKjooORbGZN724+erCePBgDl7vsa5pzxKVrK+1sB DyMvSAEwybBGKLXSbkI/yXvagvGrTcGw8fWqTToS6k/wYKVn8Bd01W6bvNp3P5/t/pXz AKfCHLFIxemOoD44gRQqFtjjk3Fa7av6/FWhoPxJ4xHGCk8AAUj9kOsRuJm8fN3JPU2j 4+n2KfMARA42l/AWgsvPl0DLIRAggS0822E2cge/wbTKDstgTDN7IuI6NtLQvETQJndG CIyDO7l/D4E1h7k8MNz6G8xQeYJB0Y1MRx1cIhl1kY0MT3ZSBcAJ6vU3DxD+64qvVW0G DFKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9AEybwBm69eftg0EYajj+axAG59q1uYEjCyvlHbtWBw=; b=HHJsGs7qbONMDqA+3bGepSAh2Pk6ug0bcdUpnbH5zndXIb2Vxg09trn+T97V7T6VGQ c9UBUEd8nxmfqg3mWLj6YRF6to9UGI2uw724m9pxk06GZ9jSHMguBj92a3/FFkTyEmYH BntFexdnLkXmci12i7j1mz1/FwLnnpHAoXX3hMAbO2yzIC+W7shyN9bcIrtxdDTCe6du zeaXG/3ovlhOg7PmM89RzWaBAOViblBp/ohh4WTzAy2MJxGVHFQzxj0gjf1LHrVWq6KR 2O3EYD11PG6UtH2gzRkONar+sXnLpMKtx9jMKOMfhaIkZPN8bGIPO3+0sx6PlOeYCitP PEfw== X-Gm-Message-State: AOAM530kk5yIV7A1FCuGf7tzD93FrwWLB6LVnvX3PFzuqOdlRh+xDRt4 TOjB5sSnU8Y5h/UchAmxF0xsy6l3p5m4wtpoYZyxyQ== X-Google-Smtp-Source: ABdhPJzFTZnYS94A5UDGnJH/0pYS5Hcr6/QtFKZ95F64YOBsw0Cl7plmMSeUZuONXS0nKjy/Oex7rIy6aKjdll/Gxk0= X-Received: by 2002:aa7:979d:0:b029:1a4:3b76:a559 with SMTP id o29-20020aa7979d0000b02901a43b76a559mr67796241pfp.49.1609815385446; Mon, 04 Jan 2021 18:56:25 -0800 (PST) MIME-Version: 1.0 References: <20210104065843.5658-1-songmuchun@bytedance.com> <20210104065843.5658-3-songmuchun@bytedance.com> In-Reply-To: From: Muchun Song Date: Tue, 5 Jan 2021 10:55:46 +0800 Message-ID: Subject: Re: [External] Re: [PATCH 3/6] mm: hugetlb: fix a race between freeing and dissolving the page To: Mike Kravetz Cc: Andrew Morton , Naoya Horiguchi , Andi Kleen , mhocko@suse.cz, Linux Memory Management List , LKML Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Jan 5, 2021 at 8:02 AM Mike Kravetz wrote: > > On 1/3/21 10:58 PM, Muchun Song wrote: > > There is a race condition between __free_huge_page() > > and dissolve_free_huge_page(). > > > > CPU0: CPU1: > > > > // page_count(page) == 1 > > put_page(page) > > __free_huge_page(page) > > dissolve_free_huge_page(page) > > spin_lock(&hugetlb_lock) > > // PageHuge(page) && !page_count(page) > > update_and_free_page(page) > > // page is freed to the buddy > > spin_unlock(&hugetlb_lock) > > spin_lock(&hugetlb_lock) > > clear_page_huge_active(page) > > enqueue_huge_page(page) > > // It is wrong, the page is already freed > > spin_unlock(&hugetlb_lock) > > > > The race windows is between put_page() and spin_lock() which > > is in the __free_huge_page(). > > > > We should make sure that the page is already on the free list > > when it is dissolved. > > > > Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage") > > Signed-off-by: Muchun Song > > --- > > mm/hugetlb.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ > > 1 file changed, 48 insertions(+) > > > > diff --git a/mm/hugetlb.c b/mm/hugetlb.c > > index 1f3bf1710b66..72608008f8b4 100644 > > --- a/mm/hugetlb.c > > +++ b/mm/hugetlb.c > > @@ -79,6 +79,21 @@ DEFINE_SPINLOCK(hugetlb_lock); > > static int num_fault_mutexes; > > struct mutex *hugetlb_fault_mutex_table ____cacheline_aligned_in_smp; > > > > +static inline bool PageHugeFreed(struct page *head) > > +{ > > + return page_private(head) == -1UL; > > return page_private(head + 4) == -1UL; > > > +} > > + > > +static inline void SetPageHugeFreed(struct page *head) > > +{ > > + set_page_private(head + 4, -1UL); > > +} > > + > > +static inline void ClearPageHugeFreed(struct page *head) > > +{ > > + set_page_private(head + 4, 0); > > +} > > It is unfortunate that we can not use some existing value like > page_huge_active() to determine if dissolve_free_huge_page() should > proceed with freeing the page to buddy. If the existing check, > > if (!page_count(page)) { > > was changed to > > if (!page_count(page) && !page_huge_active(page)) { > > the race window would be shrunk. However, the most straight forward > way to fully close the window is with the approach taken here. I also thought about this fix. But this is not enough. Because we just call put_page to free the HugeTLB page without setting activeness in some place (e.g. error handling routines). If we use page_huge_active, we should set activeness before put_page. But we cannot guarantee this. Thanks. > > > + > > /* Forward declaration */ > > static int hugetlb_acct_memory(struct hstate *h, long delta); > > > > @@ -1028,6 +1043,7 @@ static void enqueue_huge_page(struct hstate *h, struct page *page) > > list_move(&page->lru, &h->hugepage_freelists[nid]); > > h->free_huge_pages++; > > h->free_huge_pages_node[nid]++; > > + SetPageHugeFreed(page); > > } > > > > static struct page *dequeue_huge_page_node_exact(struct hstate *h, int nid) > > @@ -1044,6 +1060,7 @@ static struct page *dequeue_huge_page_node_exact(struct hstate *h, int nid) > > > > list_move(&page->lru, &h->hugepage_activelist); > > set_page_refcounted(page); > > + ClearPageHugeFreed(page); > > h->free_huge_pages--; > > h->free_huge_pages_node[nid]--; > > return page; > > @@ -1504,6 +1521,7 @@ static void prep_new_huge_page(struct hstate *h, struct page *page, int nid) > > spin_lock(&hugetlb_lock); > > h->nr_huge_pages++; > > h->nr_huge_pages_node[nid]++; > > + ClearPageHugeFreed(page); > > spin_unlock(&hugetlb_lock); > > } > > > > @@ -1770,6 +1788,36 @@ int dissolve_free_huge_page(struct page *page) > > int nid = page_to_nid(head); > > if (h->free_huge_pages - h->resv_huge_pages == 0) > > goto out; > > + > > + /* > > + * There is a race condition between __free_huge_page() > > + * and dissolve_free_huge_page(). > > + * > > + * CPU0: CPU1: > > + * > > + * // page_count(page) == 1 > > + * put_page(page) > > + * __free_huge_page(page) > > + * dissolve_free_huge_page(page) > > + * spin_lock(&hugetlb_lock) > > + * // PageHuge(page) && !page_count(page) > > + * update_and_free_page(page) > > + * // page is freed to the buddy > > + * spin_unlock(&hugetlb_lock) > > + * spin_lock(&hugetlb_lock) > > + * enqueue_huge_page(page) > > + * // It is wrong, the page is already freed > > + * spin_unlock(&hugetlb_lock) > > + * > > + * The race window is between put_page() and spin_lock() which > > + * is in the __free_huge_page(). > > IMO, the description of the race condition in the commit message is > sufficient. It does not need to be here in the code. The below comment > should be sufficient. Thanks. Will do. > > -- > Mike Kravetz > > > + * > > + * We should make sure that the page is already on the free list > > + * when it is dissolved. > > + */ > > + if (unlikely(!PageHugeFreed(head))) > > + goto out; > > + > > /* > > * Move PageHWPoison flag from head page to the raw error page, > > * which makes any subpages rather than the error page reusable. > >