From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 537F3C433DB for ; Thu, 7 Jan 2021 05:40:24 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id B0BA822E03 for ; Thu, 7 Jan 2021 05:40:23 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B0BA822E03 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=bytedance.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id B1B808D0124; Thu, 7 Jan 2021 00:40:22 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id ACC538D011F; Thu, 7 Jan 2021 00:40:22 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9BAA58D0124; Thu, 7 Jan 2021 00:40:22 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 837598D011F for ; Thu, 7 Jan 2021 00:40:22 -0500 (EST) Received: from smtpin21.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 3DCC23644 for ; Thu, 7 Jan 2021 05:40:22 +0000 (UTC) X-FDA: 77677878684.21.plant05_2012331274e7 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin21.hostedemail.com (Postfix) with ESMTP id 14DF8180442C0 for ; Thu, 7 Jan 2021 05:40:22 +0000 (UTC) X-HE-Tag: plant05_2012331274e7 X-Filterd-Recvd-Size: 9240 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) by imf34.hostedemail.com (Postfix) with ESMTP for ; Thu, 7 Jan 2021 05:40:21 +0000 (UTC) Received: by mail-pj1-f47.google.com with SMTP id m5so3063899pjv.5 for ; Wed, 06 Jan 2021 21:40:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=1jnCkm1owhte9y8px2sov/viXOh3cLFDZwAq5Gr8Nwg=; b=p+7kg5ziqAvL8WUTcXPi5/ASddQWqKnDpDRlZp9bTaYRoBPArjxki+Wfn/KwE5GfGh 99Sr8KC9yQJp2wozkI8jSA4Kdi2IgDQCfG3vrhrtxYbcC8A9ZINziXP27Da+fE9JHL2p qKKQoFQqX8ymMWf3HJVm4GqIIh3jBXZCuVl80oMDRC9xT5fu1d3XhgCm+k+Ho9aFNVUg 4V2Z5tHvB7GkwqGNkx9NsU3+hjE/A7NXuHR0NORJgCNyZCrplBw6L7WGNssvrH81BKkt yO1xdETUGIxAh8DKcGdKadT8wrzkVLPW8W/0oOTehcA5QjLTVMEX3KRlfZzA9TiFlnt8 93MA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=1jnCkm1owhte9y8px2sov/viXOh3cLFDZwAq5Gr8Nwg=; b=TOtgqHiJBUXR1EDdokUz7TpphnuRlikdTa38JbPM6vloMdmrT79MsDnOmzRA/r8v65 JYxcjV6cn1IwJxzWeJkiSprOphf7IIaxTLxCQ2gUzzr3kmfj8/pugPgTTahNWzjKqqHA UIsWnSLLxONnsTbmNrx+xBEPo0PytQTpwL0tKKwR8u949frFX7hYKBbK6RO+unV3/duF v1XQnHelGy/8WgqG07v4t235kPWO9/ch+Qm69ow0BJsP+rVnDzjr7gBwUKwsK8JCnXgj G34zk4tfkhU3IQKqca9Y6Wp5I4EdMkqPxNpI+zxARa3rDyZV5AJbP5kx0gvYjYNbYgdn dxIQ== X-Gm-Message-State: AOAM530J0tinRalmKcuC74dtFiaSdF8a5N5cKScxhf3ZEaFO86968clZ n4sWgc0O8e4t5cGNOuIYJ4aX0+S25i8DVBlJykr57Q== X-Google-Smtp-Source: ABdhPJxXzC0R4XPggBOlhY6T2zzIZ1lXQ6+U0TVonqjomDw0Cdx1gWk0kdF4Ni6T3EL8CEacGeb6utMsERIpYlJ2s6U= X-Received: by 2002:a17:90a:ba88:: with SMTP id t8mr7637885pjr.229.1609998018749; Wed, 06 Jan 2021 21:40:18 -0800 (PST) MIME-Version: 1.0 References: <20210106084739.63318-1-songmuchun@bytedance.com> <20210106084739.63318-4-songmuchun@bytedance.com> <20210106165632.GT13207@dhcp22.suse.cz> In-Reply-To: <20210106165632.GT13207@dhcp22.suse.cz> From: Muchun Song Date: Thu, 7 Jan 2021 13:39:38 +0800 Message-ID: Subject: Re: [External] Re: [PATCH v2 3/6] mm: hugetlb: fix a race between freeing and dissolving the page To: Michal Hocko Cc: Mike Kravetz , Andrew Morton , Naoya Horiguchi , Andi Kleen , Linux Memory Management List , LKML Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Jan 7, 2021 at 12:56 AM Michal Hocko wrote: > > On Wed 06-01-21 16:47:36, Muchun Song wrote: > > There is a race condition between __free_huge_page() > > and dissolve_free_huge_page(). > > > > CPU0: CPU1: > > > > // page_count(page) == 1 > > put_page(page) > > __free_huge_page(page) > > dissolve_free_huge_page(page) > > spin_lock(&hugetlb_lock) > > // PageHuge(page) && !page_count(page) > > update_and_free_page(page) > > // page is freed to the buddy > > spin_unlock(&hugetlb_lock) > > spin_lock(&hugetlb_lock) > > clear_page_huge_active(page) > > enqueue_huge_page(page) > > // It is wrong, the page is already freed > > spin_unlock(&hugetlb_lock) > > > > The race windows is between put_page() and spin_lock() which > > is in the __free_huge_page(). > > The race window reall is between put_page and dissolve_free_huge_page. > And the result is that the put_page path would clobber an unrelated page > (either free or already reused page) which is quite serious. > Fortunatelly pages are dissolved very rarely. I believe that user would > require to be privileged to hit this by intention. > > > We should make sure that the page is already on the free list > > when it is dissolved. > > Another option would be to check for PageHuge in __free_huge_page. Have > you considered that rather than add yet another state? The scope of the > spinlock would have to be extended. If that sounds more tricky then can > we check the page->lru in the dissolve path? If the page is still > PageHuge and reference count 0 then there shouldn't be many options > where it can be queued, right? Did you mean that we iterate over the free list to check whether the page is on the free list? If so, I do not think it is a good solution than introducing another state. Because if there are a lot of pages on the free list, it may take some time to do it with holding hugetlb_lock. Right? Actually, we have some tail page structs to store the state. At least it's not in short supply right now. Thanks. > > > Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage") > > Signed-off-by: Muchun Song > > --- > > mm/hugetlb.c | 38 ++++++++++++++++++++++++++++++++++++++ > > 1 file changed, 38 insertions(+) > > > > diff --git a/mm/hugetlb.c b/mm/hugetlb.c > > index 4741d60f8955..8ff138c17129 100644 > > --- a/mm/hugetlb.c > > +++ b/mm/hugetlb.c > > @@ -79,6 +79,21 @@ DEFINE_SPINLOCK(hugetlb_lock); > > static int num_fault_mutexes; > > struct mutex *hugetlb_fault_mutex_table ____cacheline_aligned_in_smp; > > > > +static inline bool PageHugeFreed(struct page *head) > > +{ > > + return (unsigned long)head[3].mapping == -1U; > > +} > > + > > +static inline void SetPageHugeFreed(struct page *head) > > +{ > > + head[3].mapping = (void *)-1U; > > +} > > + > > +static inline void ClearPageHugeFreed(struct page *head) > > +{ > > + head[3].mapping = NULL; > > +} > > + > > /* Forward declaration */ > > static int hugetlb_acct_memory(struct hstate *h, long delta); > > > > @@ -1028,6 +1043,7 @@ static void enqueue_huge_page(struct hstate *h, struct page *page) > > list_move(&page->lru, &h->hugepage_freelists[nid]); > > h->free_huge_pages++; > > h->free_huge_pages_node[nid]++; > > + SetPageHugeFreed(page); > > } > > > > static struct page *dequeue_huge_page_node_exact(struct hstate *h, int nid) > > @@ -1044,6 +1060,7 @@ static struct page *dequeue_huge_page_node_exact(struct hstate *h, int nid) > > > > list_move(&page->lru, &h->hugepage_activelist); > > set_page_refcounted(page); > > + ClearPageHugeFreed(page); > > h->free_huge_pages--; > > h->free_huge_pages_node[nid]--; > > return page; > > @@ -1291,6 +1308,17 @@ static inline void destroy_compound_gigantic_page(struct page *page, > > unsigned int order) { } > > #endif > > > > +/* > > + * Because we reuse the mapping field of some tail page structs, we should > > + * reset those mapping to initial value before @head is freed to the buddy > > + * allocator. The invalid value will be checked in the free_tail_pages_check(). > > + */ > > +static inline void reset_tail_page_mapping(struct hstate *h, struct page *head) > > +{ > > + if (!hstate_is_gigantic(h)) > > + head[3].mapping = TAIL_MAPPING; > > +} > > + > > static void update_and_free_page(struct hstate *h, struct page *page) > > { > > int i; > > @@ -1298,6 +1326,7 @@ static void update_and_free_page(struct hstate *h, struct page *page) > > if (hstate_is_gigantic(h) && !gigantic_page_runtime_supported()) > > return; > > > > + reset_tail_page_mapping(h, page); > > h->nr_huge_pages--; > > h->nr_huge_pages_node[page_to_nid(page)]--; > > for (i = 0; i < pages_per_huge_page(h); i++) { > > @@ -1504,6 +1533,7 @@ static void prep_new_huge_page(struct hstate *h, struct page *page, int nid) > > spin_lock(&hugetlb_lock); > > h->nr_huge_pages++; > > h->nr_huge_pages_node[nid]++; > > + ClearPageHugeFreed(page); > > spin_unlock(&hugetlb_lock); > > } > > > > @@ -1770,6 +1800,14 @@ int dissolve_free_huge_page(struct page *page) > > int nid = page_to_nid(head); > > if (h->free_huge_pages - h->resv_huge_pages == 0) > > goto out; > > + > > + /* > > + * We should make sure that the page is already on the free list > > + * when it is dissolved. > > + */ > > + if (unlikely(!PageHugeFreed(head))) > > + goto out; > > + > > /* > > * Move PageHWPoison flag from head page to the raw error page, > > * which makes any subpages rather than the error page reusable. > > -- > > 2.11.0 > > -- > Michal Hocko > SUSE Labs