[Adding Dave and Mel] On Wed 18-12-13 17:20:55, Rik van Riel wrote: > On 12/18/2013 05:08 PM, Andrew Morton wrote: > >On Wed, 18 Dec 2013 17:03:14 -0500 Rik van Riel <riel@xxxxxxxxxx> wrote: > > > >>When hugetlbfs is started with a non-default page size, it is > >>possible that no hstate is initialized for the page sized used > >>by transparent huge pages. > >> > >>This causes copy_huge_page to crash on a null pointer. Make > >>sure we always have an hstate initialized for the page sized > >>used by THP. > >> > > > >A bit more context is needed here please - so that people can decide > >which kernel version(s) need patching. > > That is a good question. > > Looking at the git log, this might go back to 2008, > when the hugepagesz and default_hugepagesz boot > options were introduced. > > Of course, back then there was no way to use 2MB > pages together with 1GB pages. > > That did not come until transparent huge pages were > introduced back in 2011. It looks like the transparent > huge page code avoids the bug (accidentally?) by calling > copy_user_huge_page when COWing a THP, instead of > copy_huge_page, this avoids iterating over hstates[]. > > That means it should not be possible for the bug to > have been triggered until the numa balancing code > got merged. > copy_huge_page as hugetlb specific thing. It relies on hstate which is obviously not existing for THP pages. So why do we use it for thp pages in the first place? Mel, your "mm: numa: Add THP migration for the NUMA working set scanning fault case." has added check for PageTransHuge in migrate_page_copy so it uses the shared copy_huge_page now. Dave has already tried to fix it by https://lkml.org/lkml/2013/10/28/592 but this one has been dropped later with "to-be-updated". Dave do you have an alternative for your patch? -- Michal Hocko SUSE Labs -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>