On Thu, Dec 24, 2015 at 10:51:43AM -0800, Dan Williams wrote: > On Thu, Dec 24, 2015 at 3:51 AM, Kirill A. Shutemov > <kirill.shutemov@xxxxxxxxxxxxxxx> wrote: > > This patch fixes regression caused by patch > > "mm, dax: dax-pmd vs thp-pmd vs hugetlbfs-pmd" > > > > The patch makes pmd_trans_huge() check and "page = pmd_page(*pmd)" after > > __split_huge_pmd_locked(). It can never succeed, since the pmd already > > points to a page table. As result the page is never get munlocked. > > > > It causes crashes like this: > > http://lkml.kernel.org/r/5661FBB6.6050307@xxxxxxxxxx > > > > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx> > > Reported-by: Sasha Levin <sasha.levin@xxxxxxxxxx> > > Cc: Dan Williams <dan.j.williams@xxxxxxxxx> > > --- > > mm/huge_memory.c | 8 +++----- > > 1 file changed, 3 insertions(+), 5 deletions(-) > > > > diff --git a/mm/huge_memory.c b/mm/huge_memory.c > > index 99f2a0ecb621..1a988d9b86ef 100644 > > --- a/mm/huge_memory.c > > +++ b/mm/huge_memory.c > > @@ -3024,14 +3024,12 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, > > ptl = pmd_lock(mm, pmd); > > if (unlikely(!pmd_trans_huge(*pmd) && !pmd_devmap(*pmd))) > > goto out; > > - __split_huge_pmd_locked(vma, pmd, haddr, false); > > - > > - if (pmd_trans_huge(*pmd)) > > - page = pmd_page(*pmd); > > - if (page && PageMlocked(page)) > > + page = pmd_page(*pmd); > > + if (PageMlocked(page)) > > get_page(page); > > else > > page = NULL; > > + __split_huge_pmd_locked(vma, pmd, haddr, false); > > Since dax pmd mappings may not have a backing struct page I think this > additionally needs the following: > > 8<----- > diff --git a/mm/huge_memory.c b/mm/huge_memory.c > index 4eae97325e95..c4eccfa836f4 100644 > --- a/mm/huge_memory.c > +++ b/mm/huge_memory.c > @@ -3025,11 +3025,13 @@ void __split_huge_pmd(struct vm_area_struct > *vma, pmd_t *pmd, > ptl = pmd_lock(mm, pmd); > if (unlikely(!pmd_trans_huge(*pmd) && !pmd_devmap(*pmd))) > goto out; > - page = pmd_page(*pmd); > - if (PageMlocked(page)) > - get_page(page); > - else > - page = NULL; > + else if (pmd_trans_huge(*pmd)) { > + page = pmd_page(*pmd); > + if (PageMlocked(page)) > + get_page(page); > + else > + page = NULL; > + } > __split_huge_pmd_locked(vma, pmd, haddr, false); > out: > spin_unlock(ptl); > Right, I've missed that. Here's updated patch. >From e960098db6cc04137a80f556feb151c8e31e52c3 Mon Sep 17 00:00:00 2001 From: "Kirill A. Shutemov" <kirill.shutemov@xxxxxxxxxxxxxxx> Date: Thu, 24 Dec 2015 13:55:08 +0300 Subject: [PATCH] thp: fix regression in handling mlocked pages in __split_huge_pmd() This patch fixes regression caused by patch "mm, dax: dax-pmd vs thp-pmd vs hugetlbfs-pmd" The patch makes pmd_trans_huge() check and "page = pmd_page(*pmd)" after __split_huge_pmd_locked(). It can never succeed, since the pmd already points to a page table. As result the page is never get munlocked. It causes crashes like this: http://lkml.kernel.org/r/5661FBB6.6050307@xxxxxxxxxx Signed-off-by: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx> Reported-by: Sasha Levin <sasha.levin@xxxxxxxxxx> Cc: Dan Williams <dan.j.williams@xxxxxxxxx> --- mm/huge_memory.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 99f2a0ecb621..3d5253ffdff8 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -3022,16 +3022,15 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, mmu_notifier_invalidate_range_start(mm, haddr, haddr + HPAGE_PMD_SIZE); ptl = pmd_lock(mm, pmd); - if (unlikely(!pmd_trans_huge(*pmd) && !pmd_devmap(*pmd))) + if (pmd_trans_huge(*pmd)) { + page = pmd_page(*pmd); + if (PageMlocked(page)) + get_page(page); + else + page = NULL; + } else if (!pmd_devmap(*pmd)) goto out; __split_huge_pmd_locked(vma, pmd, haddr, false); - - if (pmd_trans_huge(*pmd)) - page = pmd_page(*pmd); - if (page && PageMlocked(page)) - get_page(page); - else - page = NULL; out: spin_unlock(ptl); mmu_notifier_invalidate_range_end(mm, haddr, haddr + HPAGE_PMD_SIZE); -- Kirill A. Shutemov -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>