Re: [PATCH v2 1/2] hugetlbfs: use i_mmap_rwsem for more pmd sharing synchronization

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



FYI,

The device is x86_64 device running i386 kernel image.

- Naresh

On Mon, 30 Mar 2020 at 19:00, Naresh Kamboju <naresh.kamboju@xxxxxxxxxx> wrote:
>
> On i386 running LTP hugetlb tests found kernel BUG at fs/hugetlbfs/inode.c:458
> Running Linux version 5.6.0-rc7-next-20200330
> And hugemmap test failed due to ENOMEM.
>
> steps to reproduce:
>         # cd /opt/ltp
>         # ./runltp -f hugetlb
>
> [   48.007281] ------------[ cut here ]------------
> [   48.013251] kernel BUG at fs/hugetlbfs/inode.c:458!
> [   48.018160] invalid opcode: 0000 [#1] SMP
> [   48.022180] CPU: 0 PID: 626 Comm: hugemmap01 Not tainted
> 5.6.0-rc7-next-20200330 #1
> [   48.029845] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS
> 2.2 05/23/2018
> [   48.037246] EIP: remove_inode_hugepages+0x23d/0x3d0
> [   48.042117] Code: 89 f2 e8 86 2e ef ff 8b 95 4c ff ff ff 89 85 48
> ff ff ff 85 d2 0f 85 32 ff ff ff 89 d8 e8 4b b5 eb ff 84 c0 0f 84 49
> ff ff ff <0f> 0b 90 89 d8 83 c7 01 e8 c6 e6 e9 ff 0f b6 55 b0 39 fa 77
> b4 84
> [   48.060855] EAX: 00000001 EBX: f670c000 ECX: 0554f960 EDX: c4f2af87
> [   48.067111] ESI: 00000000 EDI: 00000000 EBP: f3c23f08 ESP: f3c23e24
> [   48.073368] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00010202
> [   48.080147] CR0: 80050033 CR2: b7800000 CR3: 229ac000 CR4: 003406d0
> [   48.086403] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
> [   48.092680] DR6: fffe0ff0 DR7: 00000400
> [   48.096508] Call Trace:
> [   48.098955]  ? link_path_walk.part.0+0x213/0x360
> [   48.103574]  ? fsnotify_destroy_marks+0x1a/0x126
> [   48.108192]  ? __inode_wait_for_writeback+0x55/0xa0
> [   48.113064]  ? var_wake_function+0x40/0x40
> [   48.117152]  hugetlbfs_evict_inode+0x16/0x40
> [   48.121416]  evict+0xa0/0x170
> [   48.124381]  iput+0x108/0x1c0
> [   48.127346]  do_unlinkat+0x166/0x260
> [   48.130915]  __ia32_sys_unlink+0x1a/0x20
> [   48.134833]  do_fast_syscall_32+0x6b/0x270
> [   48.138925]  entry_SYSENTER_32+0xa5/0xf8
> [   48.142848] EIP: 0xb7fa4cbd
> [   48.145641] Code: 0a 01 00 00 89 da 89 f3 e8 14 00 00 00 89 d3 5b
> 5e 5d c3 8b 04 24 c3 8b 1c 24 c3 8b 34 24 c3 90 90 51 52 55 89 e5 0f
> 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d 76 00 58 b8 77 00 00 00 cd 80 90
> 8d 76
> [   48.164376] EAX: ffffffda EBX: 08069460 ECX: 0000000a EDX: 00000000
> [   48.170633] ESI: 00000000 EDI: 00000000 EBP: 00000001 ESP: bff5b58c
> [   48.176893] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b EFLAGS: 00000282
> [   48.183678] Modules linked in: x86_pkg_temp_thermal
> [   48.188579] ---[ end trace 81151001af9fe013 ]---
> [   48.193214] EIP: remove_inode_hugepages+0x23d/0x3d0
> [   48.198092] Code: 89 f2 e8 86 2e ef ff 8b 95 4c ff ff ff 89 85 48
> ff ff ff 85 d2 0f 85 32 ff ff ff 89 d8 e8 4b b5 eb ff 84 c0 0f 84 49
> ff ff ff <0f> 0b 90 89 d8 83 c7 01 e8 c6 e6 e9 ff 0f b6 55 b0 39 fa 77
> b4 84
> [   48.216839] EAX: 00000001 EBX: f670c000 ECX: 0554f960 EDX: c4f2af87
> [   48.223112] ESI: 00000000 EDI: 00000000 EBP: f3c23f08 ESP: f3c23e24
> [   48.229378] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00010202
> [   48.236156] CR0: 80050033 CR2: b7800000 CR3: 229ac000 CR4: 003406d0
> [   48.242424] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
> [   48.248701] DR6: fffe0ff0 DR7: 00000400
> tlb.failed -T /opt/ltp/output/LTP_RUN_ON-LTP_hugetlb.log.tconf
> LOG File: /lava-1318949/1/tests/1_ltp-hugetlb-tests/automated/linux/ltp/output/LTP_hugetlb.log
> [   48.265189] mm/pgtable-generic.c:50: bad pgd 470000e7
> FAILED COMMAND F[   48.271614] ------------[ cut here ]------------
> [   48.277555] kernel BUG at fs/hugetlbfs/inode.c:458!
> ile: /lava-13189[   48.282532] invalid opcode: 0000 [#2] SMP
> [   48.287877] CPU: 2 PID: 630 Comm: hugemmap04 Tainted: G      D
>      5.6.0-rc7-next-20200330 #1
> [   48.296905] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS
> 2.2 05/23/2018
> [   48.304291] EIP: remove_inode_hugepages+0x23d/0x3d0
> [   48.309160] Code: 89 f2 e8 86 2e ef ff 8b 95 4c ff ff ff 89 85 48
> ff ff ff 85 d2 0f 85 32 ff ff ff 89 d8 e8 4b b5 eb ff 84 c0 0f 84 49
> ff ff ff <0f> 0b 90 89 d8 83 c7 01 e8 c6 e6 e9 ff 0f b6 55 b0 39 fa 77
> b4 84
> [   48.327898] EAX: 00000001 EBX: f6716000 ECX: fab2b28e EDX: f670c003
> [   48.334155] ESI: 00000000 EDI: 00000000 EBP: f3c23f08 ESP: f3c23e24
> [   48.340412] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00010202
> [   48.347190] CR0: 80050033 CR2: 98000000 CR3: 22d7b000 CR4: 003406d0
> [   48.353448] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
> [   48.359739] DR6: fffe0ff0 DR7: 00000400
> [   48.363571] Call Trace:
> [   48.366015]  ? link_path_walk.part.0+0x213/0x360
> [   48.370635]  ? fsnotify_destroy_marks+0x1a/0x126
> [   48.375252]  ? __inode_wait_for_writeback+0x55/0xa0
> [   48.380124]  ? var_wake_function+0x40/0x40
> [   48.384212]  hugetlbfs_evict_inode+0x16/0x40
> [   48.388479]  evict+0xa0/0x170
> [   48.391452]  iput+0x108/0x1c0
> [   48.394415]  do_unlinkat+0x166/0x260
> [   48.397986]  __ia32_sys_unlink+0x1a/0x20
> [   48.401903]  do_fast_syscall_32+0x6b/0x270
> [   48.405995]  entry_SYSENTER_32+0xa5/0xf8
> [   48.409918] EIP: 0xb7f60cbd
> [   48.412747] Code: 0a 01 00 00 89 da 89 f3 e8 14 00 00 00 89 d3 5b
> 5e 5d c3 8b 04 24 c3 8b 1c 24 c3 8b 34 24 c3 90 90 51 52 55 89 e5 0f
> 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d 76 00 58 b8 77 00 00 00 cd 80 90
> 8d 76
> [   48.431490] EAX: ffffffda EBX: 08069480 ECX: 0000000a EDX: 00000000
> [   48.437752] ESI: 00000000 EDI: 00000000 EBP: 00000001 ESP: bf98df3c
> [   48.444014] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b EFLAGS: 00000282
> [   48.450789] Modules linked in: x86_pkg_temp_thermal
> 49/1/tests/1_ltp[   48.455835] ---[ end trace 81151001af9fe014 ]---
> [   48.461751] EIP: remove_inode_hugepages+0x23d/0x3d0
> -hugetlb-tests/a[   48.466751] Code: 89 f2 e8 86 2e ef ff 8b 95 4c ff
> ff ff 89 85 48 ff ff ff 85 d2 0f 85 32 ff ff ff 89 d8 e8 4b b5 eb ff
> 84 c0 0f 84 49 ff ff ff <0f> 0b 90 89 d8 83 c7 01 e8 c6 e6 e9 ff 0f b6
> 55 b0 39 fa 77 b4 84
> utomated/linux/l[   48.486889] EAX: 00000001 EBX: f670c000 ECX:
> 0554f960 EDX: c4f2af87
> [   48.494465] ESI: 00000000 EDI: 00000000 EBP: f3c23f08 ESP: f3c23e24
> tp/output/LTP_hu[   48.500835] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS:
> 0068 EFLAGS: 00010202
> [   48.508903] CR0: 80050033 CR2: 98000000 CR3: 22d7b000 CR4: 003406d0
> getlb.failed
> TC[   48.515234] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
> [   48.522821] DR6: fffe0ff0 DR7: 00000400
> ONF COMMAND File: /opt/ltp/output/LTP_RUN_ON-LTP_hugetlb.log.tconf
> Running tests.......
> tst_test.c:1118: INFO: Timeout per run is 0h 15m 00s
> mem.c:814: INFO: set nr_hugepage[   48.541741]
> mm/pgtable-generic.c:50: bad pgd 308000e7
> [   48.547014] mm/pgtable-generic.c:50: bad pgd 080000e7
> s to 128
> hugemmap01.c:73: PASS:[   48.554531] mm/pgtable-generic.c:50: bad pgd 2f4000e7
> [   48.559962] mm/pgtable-generic.c:50: bad pgd 0a8000e7
> [   48.565020] mm/pgtable-generic.c:50: bad pgd 0c8000e7
> [   48.570072] mm/pgtable-generic.c:50: bad pgd 074000e7
> [   48.575123] mm/pgtable-generic.c:50: bad pgd 2fc000e7
> [   48.580177] mm/pgtable-generic.c:50: bad pgd 0a0000e7
> [   48.585230] mm/pgtable-generic.c:50: bad pgd 2f0000e7
>  call succeeded
> tst_test.c:1163: BROK: Test kil[   48.593614] mm/pgtable-generic.c:50:
> bad pgd 118000e7
> [   48.599561] mm/pgtable-generic.c:50: bad pgd 028000e7
> led by SIGSEGV![   48.604794] mm/pgtable-generic.c:50: bad pgd 2d4000e7
> [   48.611118] mm/pgtable-generic.c:50: bad pgd 13c000e7
> tst_tmpdir.c:33[   48.616260] mm/pgtable-generic.c:50: bad pgd 2cc000e7
> [   48.622651] mm/pgtable-generic.c:50: bad pgd 054000e7
> 0: WARN: tst_rmd[   48.627871] mm/pgtable-generic.c:50: bad pgd 030000e7
> [   48.634219] mm/pgtable-generic.c:50: bad pgd 050000e7
> ir: rmobj(/scrat[   48.639363] mm/pgtable-generic.c:50: bad pgd 164000e7
> ch/ltp-wqVj4yjKn5/AlcDqC) failed:
> remove(/scratch/ltp-wqVj4yjKn5/AlcDqC) failed; errno=16: EBUSY
> Summary:
> passed   1
> failed   0
> skipped  0
> warnings 0
> ts[   48.658868] mm/pgtable-generic.c:50: bad pgd 318000e7
> [   48.664680] mm/pgtable-generic.c:50: bad pgd 2e4000e7
> [   48.669784] mm/pgtable-generic.c:50: bad pgd 130000e7
> [   48.674884] mm/pgtable-generic.c:50: bad pgd 300000e7
> [   48.679971] mm/pgtable-generic.c:50: bad pgd 288000e7
> [   48.685075] mm/pgtable-generic.c:50: bad pgd 304000e7
> [   48.690146] mm/pgtable-generic.c:50: bad pgd 2c0000e7
> [   48.695250] mm/pgtable-generic.c:50: bad pgd 26c000e7
> [   48.700356] mm/pgtable-generic.c:50: bad pgd 260000e7
> [   48.705460] mm/pgtable-generic.c:50: bad pgd 060000e7
> [   48.710565] mm/pgtable-generic.c:50: bad pgd 280000e7
> [   48.715681] mm/pgtable-generic.c:50: bad pgd 258000e7
> [   48.720747] mm/pgtable-generic.c:50: bad pgd 254000e7
> [   48.725852] mm/pgtable-generic.c:50: bad pgd 2ac000e7
> [   48.730956] mm/pgtable-generic.c:50: bad pgd 2b0000e7
> [   48.736061] mm/pgtable-generic.c:50: bad pgd 270000e7
> [   48.741132] mm/pgtable-generic.c:50: bad pgd 29c000e7
> [   48.746185] mm/pgtable-generic.c:50: bad pgd 27c000e7
> [   48.751289] mm/pgtable-generic.c:50: bad pgd 2b8000e7
> [   48.756341] mm/pgtable-generic.c:50: bad pgd 2ec000e7
> [   48.761446] mm/pgtable-generic.c:50: bad pgd 278000e7
> [   48.766507] mm/pgtable-generic.c:50: bad pgd 0f8000e7
> [   48.771611] mm/pgtable-generic.c:50: bad pgd 2e8000e7
> [   48.776680] mm/pgtable-generic.c:50: bad pgd 28c000e7
> [   48.781778] mm/pgtable-generic.c:50: bad pgd 24c000e7
> [   48.786881] mm/pgtable-generic.c:50: bad pgd 10c000e7
> [   48.791988] mm/pgtable-generic.c:50: bad pgd 2b4000e7
> [   48.797040] mm/pgtable-generic.c:50: bad pgd 264000e7
> [   48.802145] mm/pgtable-generic.c:50: bad pgd 294000e7
> [   48.807213] mm/pgtable-generic.c:50: bad pgd 2a8000e7
> [   48.812257] mm/pgtable-generic.c:50: bad pgd 250000e7
> [   48.817311] mm/pgtable-generic.c:50: bad pgd 30c000e7
> [   48.822365] mm/pgtable-generic.c:50: bad pgd 284000e7
> t_test.c:1118: INFO: Timeout per run is 0h 15m 00s
> mem.c:814: I[   48.832133] mm/pgtable-generic.c:50: bad pgd 37c000e7
> [   48.838103] mm/pgtable-generic.c:50: bad pgd 2a0000e7
> [   48.843211] mm/pgtable-generic.c:50: bad pgd 01c000e7
> [   48.848267] mm/pgtable-generic.c:50: bad pgd 374000e7
> [   48.853322] mm/pgtable-generic.c:50: bad pgd 2c4000e7
> [   48.858389] mm/pgtable-generic.c:50: bad pgd 298000e7
> [   48.863433] mm/pgtable-generic.c:50: bad pgd 378000e7
> [   48.868480] mm/pgtable-generic.c:50: bad pgd 2a4000e7
> [   48.873532] mm/pgtable-generic.c:50: bad pgd 370000e7
> [   48.878582] mm/pgtable-generic.c:50: bad pgd 2d0000e7
> [   48.883628] mm/pgtable-generic.c:50: bad pgd 23c000e7
> [   48.888681] mm/pgtable-generic.c:50: bad pgd 2f8000e7
> [   48.893734] mm/pgtable-generic.c:50: bad pgd 238000e7
> NFO: set nr_hugepages to 128
> hugemmap02.c:117: CONF: huge mmap failed to test the scenario
> mem.c:814: INFO: set nr_hugepages to 128
> Summary:
> passed   0
> failed   0
> skipp[   48.913525] mm/pgtable-generic.c:50: bad pgd 418000e7
> [   48.919156] mm/pgtable-generic.c:50: bad pgd 3fc000e7
> [   48.924258] mm/pgtable-generic.c:50: bad pgd 3d0000e7
> [   48.929334] mm/pgtable-generic.c:50: bad pgd 3f4000e7
> [   48.934404] mm/pgtable-generic.c:50: bad pgd 3d8000e7
> [   48.939475] mm/pgtable-generic.c:50: bad pgd 414000e7
> [   48.944527] mm/pgtable-generic.c:50: bad pgd 3f8000e7
> [   48.949580] mm/pgtable-generic.c:50: bad pgd 3f0000e7
> [   48.954632] mm/pgtable-generic.c:50: bad pgd 428000e7
> [   48.959741] mm/pgtable-generic.c:50: bad pgd 400000e7
> [   48.964791] mm/pgtable-generic.c:50: bad pgd 3c0000e7
> [   48.969842] mm/pgtable-generic.c:50: bad pgd 408000e7
> [   48.974897] mm/pgtable-generic.c:50: bad pgd 40c000e7
> [   48.979949] mm/pgtable-generic.c:50: bad pgd 404000e7
> [   48.985001] mm/pgtable-generic.c:50: bad pgd 3b8000e7
> [   48.990054] mm/pgtable-generic.c:50: bad pgd 3c4000e7
> [   48.995104] mm/pgtable-generic.c:50: bad pgd 3c8000e7
> [   49.000149] mm/pgtable-generic.c:50: bad pgd 3cc000e7
> [   49.005202] mm/pgtable-generic.c:50: bad pgd 3e4000e7
> [   49.010256] mm/pgtable-generic.c:50: bad pgd 3e8000e7
> [   49.015308] mm/pgtable-generic.c:50: bad pgd 3ac000e7
> [   49.020359] mm/pgtable-generic.c:50: bad pgd 420000e7
> [   49.025404] mm/pgtable-generic.c:50: bad pgd 380000e7
> [   49.030456] mm/pgtable-generic.c:50: bad pgd 388000e7
> [   49.035510] mm/pgtable-generic.c:50: bad pgd 394000e7
> [   49.040561] mm/pgtable-generic.c:50: bad pgd 3b4000e7
> [   49.045606] mm/pgtable-generic.c:50: bad pgd 3a4000e7
> [   49.050659] mm/pgtable-generic.c:50: bad pgd 3a8000e7
> [   49.055738] mm/pgtable-generic.c:50: bad pgd 39c000e7
> [   49.060789] mm/pgtable-generic.c:50: bad pgd 3bc000e7
> [   49.065835] mm/pgtable-generic.c:50: bad pgd 390000e7
> [   49.070886] mm/pgtable-generic.c:50: bad pgd 398000e7
> [   49.075930] mm/pgtable-generic.c:50: bad pgd 410000e7
> [   49.080982] mm/pgtable-generic.c:50: bad pgd 42c000e7
> [   49.086026] mm/pgtable-generic.c:50: bad pgd 3d4000e7
> [   49.091071] mm/pgtable-generic.c:50: bad pgd 3a0000e7
> [   49.096123] mm/pgtable-generic.c:50: bad pgd 3e0000e7
> [   49.101167] mm/pgtable-generic.c:50: bad pgd 41c000e7
> [   49.106219] mm/pgtable-generic.c:50: bad pgd 3b0000e7
> [   49.111274] mm/pgtable-generic.c:50: bad pgd 384000e7
> [   49.116325] mm/pgtable-generic.c:50: bad pgd 38c000e7
> [   49.121376] mm/pgtable-generic.c:50: bad pgd 3dc000e7
> ed  1
> warnings [   49.126578] hugemmap06[638]: segfault at b5c00000 ip
> 0804aaf8 sp a97fc340 error 6 in hugemmap06[8048000+20000]
> [   49.127037] hugemmap06[636]: segfault at b1400000 ip 0804aaf8 sp
> aa7fe340 error 6 in hugemmap06[8048000+20000]
> 0
> tst_test.c:11[   49.137857] hugemmap06[641]: segfault at b5c00000 ip
> 0804aaf8 sp a7ff9340 error 6 in hugemmap06[8048000+20000]
> [   49.137861] Code: 2d 24 94 06 08 8d 42 01 31 ff 89 44 24 04 8d 74
> 26 00 e8 2b f8 ff ff 83 c7 01 99 f7 7e 04 89 d3 e8 1d f8 ff ff 8b 16
> 0f af dd <88> 04 1a 39 7c 24 04 75 df 83 44 24 08 01 8b 44 24 08 39 44
> 24 0c
> 18: INFO: Timeou[   49.137877] hugemmap06[635]: segfault at ab000000
> ip 0804aaf8 sp aafff340 error 6 in hugemmap06[8048000+20000]
> [   49.137879] Code: 2d 24 94 06 08 8d 42 01 31 ff 89 44 24 04 8d 74
> 26 00 e8 2b f8 ff ff 83 c7 01 99 f7 7e 04 89 d3 e8 1d f8 ff ff 8b 16
> 0f af dd <88> 04 1a 39 7c 24 04 75 df 83 44 24 08 01 8b 44 24 08 39 44
> 24 0c
> [   49.137903] hugemmap06[640]: segfault at ab000000 ip 0804aaf8 sp
> a87fa340 error 6
> [   49.137905] Code: 2d 24 94 06 08 8d 42 01 31 ff 89 44 24 04 8d 74
> 26 00 e8 2b f8 ff ff 83 c7 01 99 f7 7e 04 89 d3 e8 1d f8 ff ff 8b 16
> 0f af dd <88> 04 1a 39 7c 24 04 75 df 83 44 24 08 01 8b 44 24 08 39 44
> 24 0c
> [   49.137942] audit: type=1701 audit(1585561970.177:3):
> auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=634
> comm=\"hugemmap06\" exe=\"/opt/ltp/testcases/bin/hugemmap06\" sig=11
> res=1
> [   49.137943] audit: type=1701 audit(1585561970.177:4):
> auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=634
> comm=\"hugemmap06\" exe=\"/opt/ltp/testcases/bin/hugemmap06\" sig=11
> res=1
> [   49.137944] audit: type=1701 audit(1585561970.177:5):
> auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=634
> comm=\"hugemmap06\" exe=\"/opt/ltp/testcases/bin/hugemmap06\" sig=11
> res=1
> [   49.147844] Code: 2d 24 94 06 08 8d 42 01 31 ff 89 44 24 04 8d 74
> 26 00 e8 2b f8 ff ff 83 c7 01 99 f7 7e 04 89 d3 e8 1d f8 ff ff 8b 16
> 0f af dd <88> 04 1a 39 7c 24 04 75 df 83 44 24 08 01 8b 44 24 08 39 44
> 24 0c
> [   49.147876] audit: type=1701 audit(1585561970.186:6):
> auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=634
> comm=\"hugemmap06\" exe=\"/opt/ltp/testcases/bin/hugemmap06\" sig=11
> res=1
> [   49.148265] hugemmap06[639]: segfault at b5c00000 ip 0804aaf8 sp
> a8ffb340 error 6
> [   49.159218] Code: 2d 24 94 06 08 8d 42 01 31 ff 89 44 24 04 8d 74
> 26 00 e8 2b f8 ff ff 83 c7 01 99 f7 7e 04 89 d3 e8 1d f8 ff ff 8b 16
> 0f af dd <88> 04 1a 39 7c 24 04 75 df 83 44 24 08 01 8b 44 24 08 39 44
> 24 0c
> [   49.345938] Code: 2d 24 94 06 08 8d 42 01 31 ff 89 44 24 04 8d 74
> 26 00 e8 2b f8 ff ff 83 c7 01 99 f7 7e 04 89 d3 e8 1d f8 ff ff 8b 16
> 0f af dd <88> 04 1a 39 7c 24 04 75 df 83 44 24 08 01 8b 44 24 08 39 44
> 24 0c
> t per run is 0h 15m 00s
> mem.c:8[   49.367033] mm/pgtable-generic.c:50: bad pgd 3ec000e7
> [   49.372582] mm/pgtable-generic.c:50: bad pgd 430000e7
> [   49.377635] mm/pgtable-generic.c:50: bad pgd 274000e7
> [   49.382698] mm/pgtable-generic.c:50: bad pgd 328000e7
> [   49.387773] mm/pgtable-generic.c:50: bad pgd 25c000e7
> [   49.392825] mm/pgtable-generic.c:50: bad pgd 31c000e7
> [   49.397878] mm/pgtable-generic.c:50: bad pgd 424000e7
> 14: INFO: set nr_hugepages to 128
> hugemmap04.c:72: INFO: Size of huge pages is 4096 KB
> hugemmap04.c:76: INFO: Total amount of free huge pages is 127
> hugemmap04.c:78: INFO: Max number allowed for 1 mmap file in 32-bits is 128
> hugemmap04.c:91: PASS: Succeeded mapping file using 127 pages
> tst_test.c:1163: BROK: Test killed by SIGSEGV!
> tst_tmpdir.c:330: WARN: tst_rmdir:
> rmobj(/scratch/ltp-wqVj4yjKn5/wfn6NW) failed:
> remove(/scratch/ltp-wqVj4yjKn5/wfn6NW) failed; errno=16: EBUSY
> Summary:
> passed   1
> failed   0
> skipped  0
> warnings 0
> tst_test.c:1118: INFO: Timeout per run is 0h 15m 00s
> hugemmap05.c:223: INFO: original nr_hugepages is 128
> hugemmap05.c:236: INFO: original nr_overcommit_hugepages is 0
> hugemmap05.c:89: BROK: mmap((nil),805306368,3,1,6,0) failed: ENOMEM (12)
> hugemmap05.c:180: INFO: restore nr_hugepages to 128.
> hugemmap05.c:189: INFO: restore nr_overcommit_hugepages to 0.
>
> ref:
> https://lkft.validation.linaro.org/scheduler/job/1319125#L1534
> https://lkft.validation.linaro.org/scheduler/job/1318949#L1532
>
> On Tue, 17 Mar 2020 at 02:28, Mike Kravetz <mike.kravetz@xxxxxxxxxx> wrote:
> >
> > While looking at BUGs associated with invalid huge page map counts,
> > it was discovered and observed that a huge pte pointer could become
> > 'invalid' and point to another task's page table.  Consider the
> > following:
> >
> > A task takes a page fault on a shared hugetlbfs file and calls
> > huge_pte_alloc to get a ptep.  Suppose the returned ptep points to a
> > shared pmd.
> >
> > Now, another task truncates the hugetlbfs file.  As part of truncation,
> > it unmaps everyone who has the file mapped.  If the range being
> > truncated is covered by a shared pmd, huge_pmd_unshare will be called.
> > For all but the last user of the shared pmd, huge_pmd_unshare will
> > clear the pud pointing to the pmd.  If the task in the middle of the
> > page fault is not the last user, the ptep returned by huge_pte_alloc
> > now points to another task's page table or worse.  This leads to bad
> > things such as incorrect page map/reference counts or invalid memory
> > references.
> >
> > To fix, expand the use of i_mmap_rwsem as follows:
> > - i_mmap_rwsem is held in read mode whenever huge_pmd_share is called.
> >   huge_pmd_share is only called via huge_pte_alloc, so callers of
> >   huge_pte_alloc take i_mmap_rwsem before calling.  In addition, callers
> >   of huge_pte_alloc continue to hold the semaphore until finished with
> >   the ptep.
> > - i_mmap_rwsem is held in write mode whenever huge_pmd_unshare is called.
> >
> > One problem with this scheme is that it requires taking i_mmap_rwsem
> > before taking the page lock during page faults.  This is not the order
> > specified in the rest of mm code.  Handling of hugetlbfs pages is mostly
> > isolated today.  Therefore, we use this alternative locking order for
> > PageHuge() pages.
> >          mapping->i_mmap_rwsem
> >            hugetlb_fault_mutex (hugetlbfs specific page fault mutex)
> >              page->flags PG_locked (lock_page)
> >
> > To help with lock ordering issues, hugetlb_page_mapping_lock_write()
> > is introduced to write lock the i_mmap_rwsem associated with a page.
> >
> > In most cases it is easy to get address_space via vma->vm_file->f_mapping.
> > However, in the case of migration or memory errors for anon pages we do
> > not have an associated vma.  A new routine _get_hugetlb_page_mapping()
> > will use anon_vma to get address_space in these cases.
> >
> > Signed-off-by: Mike Kravetz <mike.kravetz@xxxxxxxxxx>
> > ---
> > v2 - Fixed a hang that could be reproduced via a ltp move_pages12 caused
> >      by a bad return path in unmap_and_move_huge_page.
> >
> >  fs/hugetlbfs/inode.c    |   2 +
> >  include/linux/fs.h      |   5 ++
> >  include/linux/hugetlb.h |   8 +++
> >  mm/hugetlb.c            | 156 +++++++++++++++++++++++++++++++++++++---
> >  mm/memory-failure.c     |  29 +++++++-
> >  mm/migrate.c            |  25 ++++++-
> >  mm/rmap.c               |  17 ++++-
> >  mm/userfaultfd.c        |  11 ++-
> >  8 files changed, 234 insertions(+), 19 deletions(-)
> >
> > diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
> > index aff8642f0c2e..ce9d354ea5c2 100644
> > --- a/fs/hugetlbfs/inode.c
> > +++ b/fs/hugetlbfs/inode.c
> > @@ -450,7 +450,9 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
> >                         if (unlikely(page_mapped(page))) {
> >                                 BUG_ON(truncate_op);
> >
> > +                               mutex_unlock(&hugetlb_fault_mutex_table[hash]);
> >                                 i_mmap_lock_write(mapping);
> > +                               mutex_lock(&hugetlb_fault_mutex_table[hash]);
> >                                 hugetlb_vmdelete_list(&mapping->i_mmap,
> >                                         index * pages_per_huge_page(h),
> >                                         (index + 1) * pages_per_huge_page(h));
> > diff --git a/include/linux/fs.h b/include/linux/fs.h
> > index 8c14396bf7a6..6070616f1351 100644
> > --- a/include/linux/fs.h
> > +++ b/include/linux/fs.h
> > @@ -526,6 +526,11 @@ static inline void i_mmap_lock_write(struct address_space *mapping)
> >         down_write(&mapping->i_mmap_rwsem);
> >  }
> >
> > +static inline int i_mmap_trylock_write(struct address_space *mapping)
> > +{
> > +       return down_write_trylock(&mapping->i_mmap_rwsem);
> > +}
> > +
> >  static inline void i_mmap_unlock_write(struct address_space *mapping)
> >  {
> >         up_write(&mapping->i_mmap_rwsem);
> > diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
> > index b831e9fa1a26..ad96515f2a88 100644
> > --- a/include/linux/hugetlb.h
> > +++ b/include/linux/hugetlb.h
> > @@ -154,6 +154,8 @@ u32 hugetlb_fault_mutex_hash(struct address_space *mapping, pgoff_t idx);
> >
> >  pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud);
> >
> > +struct address_space *hugetlb_page_mapping_lock_write(struct page *hpage);
> > +
> >  extern int sysctl_hugetlb_shm_group;
> >  extern struct list_head huge_boot_pages;
> >
> > @@ -196,6 +198,12 @@ static inline unsigned long hugetlb_total_pages(void)
> >         return 0;
> >  }
> >
> > +static inline struct address_space *hugetlb_page_mapping_lock_write(
> > +                                                       struct page *hpage)
> > +{
> > +       return NULL;
> > +}
> > +
> >  static inline int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr,
> >                                         pte_t *ptep)
> >  {
> > diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> > index d8ebd876871d..1709fbfd6b4e 100644
> > --- a/mm/hugetlb.c
> > +++ b/mm/hugetlb.c
> > @@ -1558,6 +1558,106 @@ int PageHeadHuge(struct page *page_head)
> >         return page_head[1].compound_dtor == HUGETLB_PAGE_DTOR;
> >  }
> >
> > +/*
> > + * Find address_space associated with hugetlbfs page.
> > + * Upon entry page is locked and page 'was' mapped although mapped state
> > + * could change.  If necessary, use anon_vma to find vma and associated
> > + * address space.  The returned mapping may be stale, but it can not be
> > + * invalid as page lock (which is held) is required to destroy mapping.
> > + */
> > +static struct address_space *_get_hugetlb_page_mapping(struct page *hpage)
> > +{
> > +       struct anon_vma *anon_vma;
> > +       pgoff_t pgoff_start, pgoff_end;
> > +       struct anon_vma_chain *avc;
> > +       struct address_space *mapping = page_mapping(hpage);
> > +
> > +       /* Simple file based mapping */
> > +       if (mapping)
> > +               return mapping;
> > +
> > +       /*
> > +        * Even anonymous hugetlbfs mappings are associated with an
> > +        * underlying hugetlbfs file (see hugetlb_file_setup in mmap
> > +        * code).  Find a vma associated with the anonymous vma, and
> > +        * use the file pointer to get address_space.
> > +        */
> > +       anon_vma = page_lock_anon_vma_read(hpage);
> > +       if (!anon_vma)
> > +               return mapping;  /* NULL */
> > +
> > +       /* Use first found vma */
> > +       pgoff_start = page_to_pgoff(hpage);
> > +       pgoff_end = pgoff_start + hpage_nr_pages(hpage) - 1;
> > +       anon_vma_interval_tree_foreach(avc, &anon_vma->rb_root,
> > +                                       pgoff_start, pgoff_end) {
> > +               struct vm_area_struct *vma = avc->vma;
> > +
> > +               mapping = vma->vm_file->f_mapping;
> > +               break;
> > +       }
> > +
> > +       anon_vma_unlock_read(anon_vma);
> > +       return mapping;
> > +}
> > +
> > +/*
> > + * Find and lock address space (mapping) in write mode.
> > + *
> > + * Upon entry, the page is locked which allows us to find the mapping
> > + * even in the case of an anon page.  However, locking order dictates
> > + * the i_mmap_rwsem be acquired BEFORE the page lock.  This is hugetlbfs
> > + * specific.  So, we first try to lock the sema while still holding the
> > + * page lock.  If this works, great!  If not, then we need to drop the
> > + * page lock and then acquire i_mmap_rwsem and reacquire page lock.  Of
> > + * course, need to revalidate state along the way.
> > + */
> > +struct address_space *hugetlb_page_mapping_lock_write(struct page *hpage)
> > +{
> > +       struct address_space *mapping, *mapping2;
> > +
> > +       mapping = _get_hugetlb_page_mapping(hpage);
> > +retry:
> > +       if (!mapping)
> > +               return mapping;
> > +
> > +       /*
> > +        * If no contention, take lock and return
> > +        */
> > +       if (i_mmap_trylock_write(mapping))
> > +               return mapping;
> > +
> > +       /*
> > +        * Must drop page lock and wait on mapping sema.
> > +        * Note:  Once page lock is dropped, mapping could become invalid.
> > +        * As a hack, increase map count until we lock page again.
> > +        */
> > +       atomic_inc(&hpage->_mapcount);
> > +       unlock_page(hpage);
> > +       i_mmap_lock_write(mapping);
> > +       lock_page(hpage);
> > +       atomic_add_negative(-1, &hpage->_mapcount);
> > +
> > +       /* verify page is still mapped */
> > +       if (!page_mapped(hpage)) {
> > +               i_mmap_unlock_write(mapping);
> > +               return NULL;
> > +       }
> > +
> > +       /*
> > +        * Get address space again and verify it is the same one
> > +        * we locked.  If not, drop lock and retry.
> > +        */
> > +       mapping2 = _get_hugetlb_page_mapping(hpage);
> > +       if (mapping2 != mapping) {
> > +               i_mmap_unlock_write(mapping);
> > +               mapping = mapping2;
> > +               goto retry;
> > +       }
> > +
> > +       return mapping;
> > +}
> > +
> >  pgoff_t __basepage_index(struct page *page)
> >  {
> >         struct page *page_head = compound_head(page);
> > @@ -3586,6 +3686,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
> >         int cow;
> >         struct hstate *h = hstate_vma(vma);
> >         unsigned long sz = huge_page_size(h);
> > +       struct address_space *mapping = vma->vm_file->f_mapping;
> >         struct mmu_notifier_range range;
> >         int ret = 0;
> >
> > @@ -3596,6 +3697,14 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
> >                                         vma->vm_start,
> >                                         vma->vm_end);
> >                 mmu_notifier_invalidate_range_start(&range);
> > +       } else {
> > +               /*
> > +                * For shared mappings i_mmap_rwsem must be held to call
> > +                * huge_pte_alloc, otherwise the returned ptep could go
> > +                * away if part of a shared pmd and another thread calls
> > +                * huge_pmd_unshare.
> > +                */
> > +               i_mmap_lock_read(mapping);
> >         }
> >
> >         for (addr = vma->vm_start; addr < vma->vm_end; addr += sz) {
> > @@ -3673,6 +3782,8 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
> >
> >         if (cow)
> >                 mmu_notifier_invalidate_range_end(&range);
> > +       else
> > +               i_mmap_unlock_read(mapping);
> >
> >         return ret;
> >  }
> > @@ -4121,13 +4232,15 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm,
> >                         };
> >
> >                         /*
> > -                        * hugetlb_fault_mutex must be dropped before
> > -                        * handling userfault.  Reacquire after handling
> > -                        * fault to make calling code simpler.
> > +                        * hugetlb_fault_mutex and i_mmap_rwsem must be
> > +                        * dropped before handling userfault.  Reacquire
> > +                        * after handling fault to make calling code simpler.
> >                          */
> >                         hash = hugetlb_fault_mutex_hash(mapping, idx);
> >                         mutex_unlock(&hugetlb_fault_mutex_table[hash]);
> > +                       i_mmap_unlock_read(mapping);
> >                         ret = handle_userfault(&vmf, VM_UFFD_MISSING);
> > +                       i_mmap_lock_read(mapping);
> >                         mutex_lock(&hugetlb_fault_mutex_table[hash]);
> >                         goto out;
> >                 }
> > @@ -4292,6 +4405,11 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
> >
> >         ptep = huge_pte_offset(mm, haddr, huge_page_size(h));
> >         if (ptep) {
> > +               /*
> > +                * Since we hold no locks, ptep could be stale.  That is
> > +                * OK as we are only making decisions based on content and
> > +                * not actually modifying content here.
> > +                */
> >                 entry = huge_ptep_get(ptep);
> >                 if (unlikely(is_hugetlb_entry_migration(entry))) {
> >                         migration_entry_wait_huge(vma, mm, ptep);
> > @@ -4305,14 +4423,29 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
> >                         return VM_FAULT_OOM;
> >         }
> >
> > +       /*
> > +        * Acquire i_mmap_rwsem before calling huge_pte_alloc and hold
> > +        * until finished with ptep.  This prevents huge_pmd_unshare from
> > +        * being called elsewhere and making the ptep no longer valid.
> > +        *
> > +        * ptep could have already be assigned via huge_pte_offset.  That
> > +        * is OK, as huge_pte_alloc will return the same value unless
> > +        * something has changed.
> > +        */
> >         mapping = vma->vm_file->f_mapping;
> > -       idx = vma_hugecache_offset(h, vma, haddr);
> > +       i_mmap_lock_read(mapping);
> > +       ptep = huge_pte_alloc(mm, haddr, huge_page_size(h));
> > +       if (!ptep) {
> > +               i_mmap_unlock_read(mapping);
> > +               return VM_FAULT_OOM;
> > +       }
> >
> >         /*
> >          * Serialize hugepage allocation and instantiation, so that we don't
> >          * get spurious allocation failures if two CPUs race to instantiate
> >          * the same page in the page cache.
> >          */
> > +       idx = vma_hugecache_offset(h, vma, haddr);
> >         hash = hugetlb_fault_mutex_hash(mapping, idx);
> >         mutex_lock(&hugetlb_fault_mutex_table[hash]);
> >
> > @@ -4400,6 +4533,7 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
> >         }
> >  out_mutex:
> >         mutex_unlock(&hugetlb_fault_mutex_table[hash]);
> > +       i_mmap_unlock_read(mapping);
> >         /*
> >          * Generally it's safe to hold refcount during waiting page lock. But
> >          * here we just wait to defer the next page fault to avoid busy loop and
> > @@ -5080,10 +5214,12 @@ void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
> >   * Search for a shareable pmd page for hugetlb. In any case calls pmd_alloc()
> >   * and returns the corresponding pte. While this is not necessary for the
> >   * !shared pmd case because we can allocate the pmd later as well, it makes the
> > - * code much cleaner. pmd allocation is essential for the shared case because
> > - * pud has to be populated inside the same i_mmap_rwsem section - otherwise
> > - * racing tasks could either miss the sharing (see huge_pte_offset) or select a
> > - * bad pmd for sharing.
> > + * code much cleaner.
> > + *
> > + * This routine must be called with i_mmap_rwsem held in at least read mode.
> > + * For hugetlbfs, this prevents removal of any page table entries associated
> > + * with the address space.  This is important as we are setting up sharing
> > + * based on existing page table entries (mappings).
> >   */
> >  pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
> >  {
> > @@ -5100,7 +5236,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
> >         if (!vma_shareable(vma, addr))
> >                 return (pte_t *)pmd_alloc(mm, pud, addr);
> >
> > -       i_mmap_lock_read(mapping);
> >         vma_interval_tree_foreach(svma, &mapping->i_mmap, idx, idx) {
> >                 if (svma == vma)
> >                         continue;
> > @@ -5130,7 +5265,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
> >         spin_unlock(ptl);
> >  out:
> >         pte = (pte_t *)pmd_alloc(mm, pud, addr);
> > -       i_mmap_unlock_read(mapping);
> >         return pte;
> >  }
> >
> > @@ -5141,7 +5275,7 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
> >   * indicated by page_count > 1, unmap is achieved by clearing pud and
> >   * decrementing the ref count. If count == 1, the pte page is not shared.
> >   *
> > - * called with page table lock held.
> > + * Called with page table lock held and i_mmap_rwsem held in write mode.
> >   *
> >   * returns: 1 successfully unmapped a shared pte page
> >   *         0 the underlying pte page is not shared, or it is the last user
> > diff --git a/mm/memory-failure.c b/mm/memory-failure.c
> > index 41c634f45d45..1c961cd26c0b 100644
> > --- a/mm/memory-failure.c
> > +++ b/mm/memory-failure.c
> > @@ -954,7 +954,7 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
> >         enum ttu_flags ttu = TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS;
> >         struct address_space *mapping;
> >         LIST_HEAD(tokill);
> > -       bool unmap_success;
> > +       bool unmap_success = true;
> >         int kill = 1, forcekill;
> >         struct page *hpage = *hpagep;
> >         bool mlocked = PageMlocked(hpage);
> > @@ -1016,7 +1016,32 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
> >         if (kill)
> >                 collect_procs(hpage, &tokill, flags & MF_ACTION_REQUIRED);
> >
> > -       unmap_success = try_to_unmap(hpage, ttu);
> > +       if (!PageHuge(hpage)) {
> > +               unmap_success = try_to_unmap(hpage, ttu);
> > +       } else {
> > +               /*
> > +                * For hugetlb pages, try_to_unmap could potentially call
> > +                * huge_pmd_unshare.  Because of this, take semaphore in
> > +                * write mode here and set TTU_RMAP_LOCKED to indicate we
> > +                * have taken the lock at this higer level.
> > +                *
> > +                * Note that the call to hugetlb_page_mapping_lock_write
> > +                * is necessary even if mapping is already set.  It handles
> > +                * ugliness of potentially having to drop page lock to obtain
> > +                * i_mmap_rwsem.
> > +                */
> > +               mapping = hugetlb_page_mapping_lock_write(hpage);
> > +
> > +               if (mapping) {
> > +                       unmap_success = try_to_unmap(hpage,
> > +                                                    ttu|TTU_RMAP_LOCKED);
> > +                       i_mmap_unlock_write(mapping);
> > +               } else {
> > +                       pr_info("Memory failure: %#lx: could not find mapping for mapped huge page\n",
> > +                               pfn);
> > +                       unmap_success = false;
> > +               }
> > +       }
> >         if (!unmap_success)
> >                 pr_err("Memory failure: %#lx: failed to unmap page (mapcount=%d)\n",
> >                        pfn, page_mapcount(hpage));
> > diff --git a/mm/migrate.c b/mm/migrate.c
> > index 1fb90c0ef9c3..c0ec383b3c03 100644
> > --- a/mm/migrate.c
> > +++ b/mm/migrate.c
> > @@ -1294,6 +1294,7 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
> >         int page_was_mapped = 0;
> >         struct page *new_hpage;
> >         struct anon_vma *anon_vma = NULL;
> > +       struct address_space *mapping = NULL;
> >
> >         /*
> >          * Migratability of hugepages depends on architectures and their size.
> > @@ -1341,18 +1342,36 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
> >                 goto put_anon;
> >
> >         if (page_mapped(hpage)) {
> > +               /*
> > +                * try_to_unmap could potentially call huge_pmd_unshare.
> > +                * Because of this, take semaphore in write mode here and
> > +                * set TTU_RMAP_LOCKED to let lower levels know we have
> > +                * taken the lock.
> > +                */
> > +               mapping = hugetlb_page_mapping_lock_write(hpage);
> > +               if (unlikely(!mapping))
> > +                       goto unlock_put_anon;
> > +
> >                 try_to_unmap(hpage,
> > -                       TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS);
> > +                       TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS|
> > +                       TTU_RMAP_LOCKED);
> >                 page_was_mapped = 1;
> > +               /*
> > +                * Leave mapping locked until after subsequent call to
> > +                * remove_migration_ptes()
> > +                */
> >         }
> >
> >         if (!page_mapped(hpage))
> >                 rc = move_to_new_page(new_hpage, hpage, mode);
> >
> > -       if (page_was_mapped)
> > +       if (page_was_mapped) {
> >                 remove_migration_ptes(hpage,
> > -                       rc == MIGRATEPAGE_SUCCESS ? new_hpage : hpage, false);
> > +                       rc == MIGRATEPAGE_SUCCESS ? new_hpage : hpage, true);
> > +               i_mmap_unlock_write(mapping);
> > +       }
> >
> > +unlock_put_anon:
> >         unlock_page(new_hpage);
> >
> >  put_anon:
> > diff --git a/mm/rmap.c b/mm/rmap.c
> > index 633101a57ad9..b83864763f78 100644
> > --- a/mm/rmap.c
> > +++ b/mm/rmap.c
> > @@ -22,9 +22,10 @@
> >   *
> >   * inode->i_mutex      (while writing or truncating, not reading or faulting)
> >   *   mm->mmap_sem
> > - *     page->flags PG_locked (lock_page)
> > + *     page->flags PG_locked (lock_page)   * (see huegtlbfs below)
> >   *       hugetlbfs_i_mmap_rwsem_key (in huge_pmd_share)
> >   *         mapping->i_mmap_rwsem
> > + *           hugetlb_fault_mutex (hugetlbfs specific page fault mutex)
> >   *           anon_vma->rwsem
> >   *             mm->page_table_lock or pte_lock
> >   *               pgdat->lru_lock (in mark_page_accessed, isolate_lru_page)
> > @@ -43,6 +44,11 @@
> >   * anon_vma->rwsem,mapping->i_mutex      (memory_failure, collect_procs_anon)
> >   *   ->tasklist_lock
> >   *     pte map lock
> > + *
> > + * * hugetlbfs PageHuge() pages take locks in this order:
> > + *         mapping->i_mmap_rwsem
> > + *           hugetlb_fault_mutex (hugetlbfs specific page fault mutex)
> > + *             page->flags PG_locked (lock_page)
> >   */
> >
> >  #include <linux/mm.h>
> > @@ -1396,6 +1402,9 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
> >                 /*
> >                  * If sharing is possible, start and end will be adjusted
> >                  * accordingly.
> > +                *
> > +                * If called for a huge page, caller must hold i_mmap_rwsem
> > +                * in write mode as it is possible to call huge_pmd_unshare.
> >                  */
> >                 adjust_range_if_pmd_sharing_possible(vma, &range.start,
> >                                                      &range.end);
> > @@ -1443,6 +1452,12 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
> >                 address = pvmw.address;
> >
> >                 if (PageHuge(page)) {
> > +                       /*
> > +                        * To call huge_pmd_unshare, i_mmap_rwsem must be
> > +                        * held in write mode.  Caller needs to explicitly
> > +                        * do this outside rmap routines.
> > +                        */
> > +                       VM_BUG_ON(!(flags & TTU_RMAP_LOCKED));
> >                         if (huge_pmd_unshare(mm, &address, pvmw.pte)) {
> >                                 /*
> >                                  * huge_pmd_unshare unmapped an entire PMD
> > diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
> > index cf1217e6f956..512576e171ce 100644
> > --- a/mm/userfaultfd.c
> > +++ b/mm/userfaultfd.c
> > @@ -281,10 +281,14 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
> >                 BUG_ON(dst_addr >= dst_start + len);
> >
> >                 /*
> > -                * Serialize via hugetlb_fault_mutex
> > +                * Serialize via i_mmap_rwsem and hugetlb_fault_mutex.
> > +                * i_mmap_rwsem ensures the dst_pte remains valid even
> > +                * in the case of shared pmds.  fault mutex prevents
> > +                * races with other faulting threads.
> >                  */
> > -               idx = linear_page_index(dst_vma, dst_addr);
> >                 mapping = dst_vma->vm_file->f_mapping;
> > +               i_mmap_lock_read(mapping);
> > +               idx = linear_page_index(dst_vma, dst_addr);
> >                 hash = hugetlb_fault_mutex_hash(mapping, idx);
> >                 mutex_lock(&hugetlb_fault_mutex_table[hash]);
> >
> > @@ -292,6 +296,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
> >                 dst_pte = huge_pte_alloc(dst_mm, dst_addr, vma_hpagesize);
> >                 if (!dst_pte) {
> >                         mutex_unlock(&hugetlb_fault_mutex_table[hash]);
> > +                       i_mmap_unlock_read(mapping);
> >                         goto out_unlock;
> >                 }
> >
> > @@ -299,6 +304,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
> >                 dst_pteval = huge_ptep_get(dst_pte);
> >                 if (!huge_pte_none(dst_pteval)) {
> >                         mutex_unlock(&hugetlb_fault_mutex_table[hash]);
> > +                       i_mmap_unlock_read(mapping);
> >                         goto out_unlock;
> >                 }
> >
> > @@ -306,6 +312,7 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
> >                                                 dst_addr, src_addr, &page);
> >
> >                 mutex_unlock(&hugetlb_fault_mutex_table[hash]);
> > +               i_mmap_unlock_read(mapping);
> >                 vm_alloc_shared = vm_shared;
> >
> >                 cond_resched();
> > --
> > 2.24.1
> >




[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Bugtraq]     [Linux OMAP]     [Linux MIPS]     [eCos]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux