Re: [PATCH 2/4] thp: fix regression in handling mlocked pages in __split_huge_pmd()

[Dan Williams <dan.j.williams@intel.com>]

On Thu, Dec 24, 2015 at 3:51 AM, Kirill A. Shutemov
<kirill.shutemov@linux.intel.com> wrote:
> This patch fixes regression caused by patch
>  "mm, dax: dax-pmd vs thp-pmd vs hugetlbfs-pmd"
>
> The patch makes pmd_trans_huge() check and "page = pmd_page(*pmd)" after
> __split_huge_pmd_locked(). It can never succeed, since the pmd already
> points to a page table. As result the page is never get munlocked.
>
> It causes crashes like this:
>  http://lkml.kernel.org/r/5661FBB6.6050307@oracle.com
>
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> Reported-by: Sasha Levin <sasha.levin@oracle.com>
> Cc: Dan Williams <dan.j.williams@intel.com>
> ---
>  mm/huge_memory.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 99f2a0ecb621..1a988d9b86ef 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -3024,14 +3024,12 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
>         ptl = pmd_lock(mm, pmd);
>         if (unlikely(!pmd_trans_huge(*pmd) && !pmd_devmap(*pmd)))
>                 goto out;
> -       __split_huge_pmd_locked(vma, pmd, haddr, false);
> -
> -       if (pmd_trans_huge(*pmd))
> -               page = pmd_page(*pmd);
> -       if (page && PageMlocked(page))
> +       page = pmd_page(*pmd);
> +       if (PageMlocked(page))
>                 get_page(page);
>         else
>                 page = NULL;
> +       __split_huge_pmd_locked(vma, pmd, haddr, false);

Since dax pmd mappings may not have a backing struct page I think this
additionally needs the following:

8<-----
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 4eae97325e95..c4eccfa836f4 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -3025,11 +3025,13 @@ void __split_huge_pmd(struct vm_area_struct
*vma, pmd_t *pmd,
       ptl = pmd_lock(mm, pmd);
       if (unlikely(!pmd_trans_huge(*pmd) && !pmd_devmap(*pmd)))
               goto out;
-       page = pmd_page(*pmd);
-       if (PageMlocked(page))
-               get_page(page);
-       else
-               page = NULL;
+       else if (pmd_trans_huge(*pmd)) {
+               page = pmd_page(*pmd);
+               if (PageMlocked(page))
+                       get_page(page);
+               else
+                       page = NULL;
+       }
       __split_huge_pmd_locked(vma, pmd, haddr, false);
out:
       spin_unlock(ptl);

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>