Andrea Arcangeli wrote: > Hi Hugh, > > On Tue, Oct 15, 2013 at 04:08:28AM -0700, Hugh Dickins wrote: > > Occasionally we hit the BUG_ON(pmd_trans_huge(*pmd)) at the end of > > __split_huge_page_pmd(): seen when doing madvise(,,MADV_DONTNEED). > > > > It's invalid: we don't always have down_write of mmap_sem there: > > a racing do_huge_pmd_wp_page() might have copied-on-write to another > > huge page before our split_huge_page() got the anon_vma lock. > > > > I don't get exactly the scenario with do_huge_pmd_wp_page(), could you > elaborate? I think the scenario is follow: CPU0: CPU1 __split_huge_page_pmd() page = pmd_page(*pmd); do_huge_pmd_wp_page() copy the page and changes pmd (the same as on CPU0) to point to newly copied page. split_huge_page(page) where page is original page, not allocated on COW. pmd still points on huge page. Hugh, have I got it correctly? -- Kirill A. Shutemov -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>