On Mon, Nov 30, 2015 at 09:37:33AM -0500, Sasha Levin wrote: > Hi Kirill, > > I've hit the following while fuzzing with trinity on the latest -next kernel: > > [ 321.348184] page:ffffea0011a20080 count:1 mapcount:1 mapping:ffff8802d745f601 index:0x1802 > [ 321.350607] flags: 0x320035c00040078(uptodate|dirty|lru|active|swapbacked) > [ 321.453706] page dumped because: VM_BUG_ON_PAGE(!PageLocked(page)) > [ 321.455353] page->mem_cgroup:ffff880286620000 I think this should help: >From aadc911f047b094c68b350550556dafabf05af13 Mon Sep 17 00:00:00 2001 From: "Kirill A. Shutemov" <kirill.shutemov@xxxxxxxxxxxxxxx> Date: Fri, 20 Nov 2015 12:20:00 +0200 Subject: [PATCH] thp: fix split_huge_page vs. deferred_split_scan race Minchan[1] and Sasha[2] had reported crash in split_huge_page_to_list() called from deferred_split_scan() due VM_BUG_ON_PAGE(!PageLocked(page)). This can happen because race between deferred_split_scan() and split_huge_page(). The result of the race is that the page can be split under deferred_split_scan(). The patch prevents this by taking split_queue_lock in split_huge_page_to_list() when we check if the page can be split. If the page is suitable for splitting, we remove page from splitting queue under the same lock, before splitting starts. [1] http://lkml.kernel.org/g/20151117073539.GB32578@bbox [2] http://lkml.kernel.org/g/565C5F2D.5060003@xxxxxxxxxx Signed-off-by: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx> Reported-by: Minchan Kim <minchan@xxxxxxxxxx> Reported-by: Sasha Levin <sasha.levin@xxxxxxxxxx> --- mm/huge_memory.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index dc2b947d4f85..7c0ad4d9110b 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -3186,13 +3186,6 @@ static void __split_huge_page(struct page *page, struct list_head *list) spin_lock_irq(&zone->lru_lock); lruvec = mem_cgroup_page_lruvec(head, zone); - spin_lock(&split_queue_lock); - if (!list_empty(page_deferred_list(head))) { - split_queue_len--; - list_del(page_deferred_list(head)); - } - spin_unlock(&split_queue_lock); - /* complete memcg works before add pages to LRU */ mem_cgroup_split_huge_fixup(head); @@ -3299,12 +3292,20 @@ int split_huge_page_to_list(struct page *page, struct list_head *list) freeze_page(anon_vma, head); VM_BUG_ON_PAGE(compound_mapcount(head), head); + /* Prevent deferred_split_scan() touching ->_count */ + spin_lock(&split_queue_lock); count = page_count(head); mapcount = total_mapcount(head); if (mapcount == count - 1) { + if (!list_empty(page_deferred_list(head))) { + split_queue_len--; + list_del(page_deferred_list(head)); + } + spin_unlock(&split_queue_lock); __split_huge_page(page, list); ret = 0; } else if (IS_ENABLED(CONFIG_DEBUG_VM) && mapcount > count - 1) { + spin_unlock(&split_queue_lock); pr_alert("total_mapcount: %u, page_count(): %u\n", mapcount, count); if (PageTail(page)) @@ -3312,6 +3313,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list) dump_page(page, "total_mapcount(head) > page_count(head) - 1"); BUG(); } else { + spin_unlock(&split_queue_lock); unfreeze_page(anon_vma, head); ret = -EBUSY; } -- 2.6.2 -- Kirill A. Shutemov -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>