From: Muchun Song <songmuchun@bytedance.com>
To: yanghui <yanghui.def@bytedance.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
Linux Memory Management List <linux-mm@kvack.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: Re: [RESEND PATCH v3] mm/mempolicy: fix a race between offset_il_node and mpol_rebind_task
Date: Mon, 6 Sep 2021 11:53:27 +0800 [thread overview]
Message-ID: <CAMZfGtVE2eAMwWLzwSEp6g7hOReu++hCa00OuaPur-24UQHrhA@mail.gmail.com> (raw)
In-Reply-To: <20210906034658.48721-1-yanghui.def@bytedance.com>
On Mon, Sep 6, 2021 at 11:47 AM yanghui <yanghui.def@bytedance.com> wrote:
>
> Servers happened below panic:
> Kernel version:5.4.56
> BUG: unable to handle page fault for address: 0000000000002c48
> RIP: 0010:__next_zones_zonelist+0x1d/0x40
> [264003.977696] RAX: 0000000000002c40 RBX: 0000000000100dca RCX: 0000000000000014
> [264003.977872] Call Trace:
> [264003.977888] __alloc_pages_nodemask+0x277/0x310
> [264003.977908] alloc_page_interleave+0x13/0x70
> [264003.977926] handle_mm_fault+0xf99/0x1390
> [264003.977951] __do_page_fault+0x288/0x500
> [264003.977979] ? schedule+0x39/0xa0
> [264003.977994] do_page_fault+0x30/0x110
> [264003.978010] page_fault+0x3e/0x50
>
> The reason of panic is that MAX_NUMNODES is passd in the third parameter
> in function __alloc_pages_nodemask(preferred_nid). So if to access
> zonelist->zoneref->zone_idx in __next_zones_zonelist the panic will happen.
>
> In offset_il_node(), first_node() return nid from pol->v.nodes, after
> this other threads may changed pol->v.nodes before next_node().
> This race condition will let next_node return MAX_NUMNODES.So put
> pol->nodes in a local variable.
>
> The race condition is between offset_il_node and cpuset_change_task_nodemask:
> CPU0: CPU1:
> alloc_pages_vma()
> interleave_nid(pol,)
> offset_il_node(pol,)
> first_node(pol->v.nodes) cpuset_change_task_nodemask
> //nodes==0xc mpol_rebind_task
> mpol_rebind_policy
> mpol_rebind_nodemask(pol,nodes)
> //nodes==0x3
> next_node(nid, pol->v.nodes)//return MAX_NUMNODES
>
> Signed-off-by: yanghui <yanghui.def@bytedance.com>
LGTM.
Reviewed-by: Muchun Song <songmuchun@bytedance.com>
prev parent reply other threads:[~2021-09-06 3:54 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-06 3:46 yanghui
2021-09-06 3:53 ` Muchun Song [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAMZfGtVE2eAMwWLzwSEp6g7hOReu++hCa00OuaPur-24UQHrhA@mail.gmail.com \
--to=songmuchun@bytedance.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=yanghui.def@bytedance.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox