From: Max Filippov <jcmvbkbc@gmail.com>
To: LKML <linux-kernel@vger.kernel.org>,
"linux-mm@kvack.org" <linux-mm@kvack.org>,
Christoph Lameter <cl@linux-foundation.org>,
Pekka Enberg <penberg@kernel.org>, Matt Mackall <mpm@selenic.com>
Subject: CONFIG_SLUB/USE_SPLIT_PTLOCKS compatibility
Date: Mon, 14 Oct 2013 01:12:47 +0400 [thread overview]
Message-ID: <CAMo8BfKqWPbDCMwCoH6BO6uXyYwr0Z1=AaMJDRLQt66FLb7LAg@mail.gmail.com> (raw)
Hello,
I'm reliably getting kernel crash on xtensa when CONFIG_SLUB
is selected and USE_SPLIT_PTLOCKS appears to be true (SMP=y,
NR_CPUS=4, DEBUG_SPINLOCK=n, DEBUG_LOCK_ALLOC=n).
This happens because spinlock_t ptl and struct page *first_page overlap
in the struct page. The following call chain makes allocation of order
3 and initializes first_page pointer in its 7 tail pages:
do_page_fault
handle_mm_fault
__pte_alloc
kmem_cache_alloc
__slab_alloc
new_slab
__alloc_pages_nodemask
get_page_from_freelist
prep_compound_page
Later pte_offset_map_lock is called with one of these tail pages
overwriting its first_page pointer:
do_fork
copy_process
dup_mm
copy_page_range
copy_pte_range
pte_alloc_map_lock
pte_offset_map_lock
Finally kmem_cache_free is called for that tail page, which calls
slab_free(s, virt_to_head_page(x),... but virt_to_head_page here
returns NULL, because the page's first_page pointer was overwritten
earlier:
exit_mmap
free_pgtables
free_pgd_range
free_pud_range
free_pmd_range
free_pte_range
pte_free
kmem_cache_free
slab_free
__slab_free
__slab_free touches NULL struct page, that's it.
Changing allocator to SLAB or enabling DEBUG_SPINLOCK
fixes that crash.
My question is, is CONFIG_SLUB supposed to work with
USE_SPLIT_PTLOCKS (and if yes what's wrong in my case)?
--
Thanks.
-- Max
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next reply other threads:[~2013-10-13 21:12 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-13 21:12 Max Filippov [this message]
2013-10-14 7:12 ` Kirill A. Shutemov
2013-10-14 11:49 ` Max Filippov
2013-10-14 11:43 ` Kirill A. Shutemov
2013-10-15 17:53 ` Chris Zankel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAMo8BfKqWPbDCMwCoH6BO6uXyYwr0Z1=AaMJDRLQt66FLb7LAg@mail.gmail.com' \
--to=jcmvbkbc@gmail.com \
--cc=cl@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mpm@selenic.com \
--cc=penberg@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox