On Tue, Jun 07, 2022 at 02:59:59PM -0700, Andrew Morton wrote: > On Tue, 7 Jun 2022 14:36:00 +0200 David Hildenbrand <david@xxxxxxxxxx> wrote: > > > On 06.06.22 11:15, HORIGUCHI NAOYA(堀口 直也) wrote: > > >>> [ 917.864266] <TASK> > > >>> [ 917.864961] clear_huge_page+0x147/0x270 > > >>> [ 917.866236] hugetlb_fault+0x440/0xad0 > > >>> [ 917.867366] handle_mm_fault+0x270/0x290 > > >>> [ 917.868532] do_user_addr_fault+0x1c3/0x680 > > >>> [ 917.869768] exc_page_fault+0x6c/0x160 > > >>> [ 917.870912] ? asm_exc_page_fault+0x8/0x30 > > >>> [ 917.872082] asm_exc_page_fault+0x1e/0x30 > > >>> [ 917.873220] RIP: 0033:0x7f2aeb8ba367 > > >>> > > >>> I don't think of a workaround for this now ... > > >>> > > >> > > >> Could you please tell me how to reproduce this issue? > > > > > > You are familiar with qemu-monitor-command, so the following procedure > > > should work for you: > > > > > > - run a process using hugepages on your VM, > > > - check the guest physical address of the hugepage (page-types.c is helpful for this), > > > - inject a MCE with virsh qemu-monitor-command on the guest physical address, then > > > - unpoison the injected physical address. > > > > That's triggered via debugfs / HWPOISON_INJECT, right? > > > > That's a DEBUG_KERNEL option, so I'm not 100% sure if we really want to > > cc stable. Sure, the impact of the bug is limited. > > Sure, it's hardly a must-have. But let's also take the patch > complexity&risk into account. This is one dang simple patch. > > Or is it. Should these things be happening outside mf_mutex? What the > heck is the role of mf_mutex anyway? mf_mutex is to ensure that only one error handling thread can handle the pfn at one time, but set_mce_nospec() is called outside it now. So if we want to prevent the race with unmap, both of set_mce_nospec() and the new kpte check might need to be done in mf_mutex. - Naoya Horiguchi
