Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755502AbbHLOfd (ORCPT ); Wed, 12 Aug 2015 10:35:33 -0400 Received: from mail-wi0-f177.google.com ([209.85.212.177]:38046 "EHLO mail-wi0-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753398AbbHLOfb (ORCPT ); Wed, 12 Aug 2015 10:35:31 -0400 Date: Wed, 12 Aug 2015 17:35:09 +0300 From: "Kirill A. Shutemov" To: Hugh Dickins , David Rientjes , Vlastimil Babka Cc: "Kirill A. Shutemov" , Andrew Morton , Andrea Arcangeli , Dave Hansen , Mel Gorman , Rik van Riel , Christoph Lameter , Naoya Horiguchi , Steve Capper , "Aneesh Kumar K.V" , Johannes Weiner , Michal Hocko , Jerome Marchand , linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: Re: page-flags behavior on compound pages: a worry Message-ID: <20150812143509.GA12320@node.dhcp.inet.fi> References: <1426784902-125149-1-git-send-email-kirill.shutemov@linux.intel.com> <1426784902-125149-5-git-send-email-kirill.shutemov@linux.intel.com> <20150806153259.GA2834@node.dhcp.inet.fi> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23.1 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2183 Lines: 66 On Thu, Aug 06, 2015 at 12:24:22PM -0700, Hugh Dickins wrote: > > IIUC, the only potentially problematic callsites left are physical memory > > scanners. This code requires audit. I'll do that. > > Please. I haven't finished the exercise yet. But here's an issue I believe present in current *Linus* tree: >From e78eec7d7a8c4cba8b5952a997973f7741e704f4 Mon Sep 17 00:00:00 2001 From: "Kirill A. Shutemov" Date: Wed, 12 Aug 2015 17:09:16 +0300 Subject: [PATCH] mm: fix potential race in isolate_migratepages_block() Hugh has pointed that compound_head() call can be unsafe in some context. There's one example: CPU0 CPU1 isolate_migratepages_block() page_count() compound_head() !!PageTail() == true put_page() tail->first_page = NULL head = tail->first_page alloc_pages(__GFP_COMP) prep_compound_page() tail->first_page = head __SetPageTail(p); !!PageTail() == true The race is pure theoretical. I don't it's possible to trigger it in practice. But who knows. This can be fixed by avoiding compound_head() in unsafe context. Signed-off-by: Kirill A. Shutemov Cc: Hugh Dickins Cc: David Rientjes Cc: Vlastimil Babka --- mm/compaction.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/compaction.c b/mm/compaction.c index 86f04e556f96..bec727b700d3 100644 --- a/mm/compaction.c +++ b/mm/compaction.c @@ -787,7 +787,7 @@ isolate_migratepages_block(struct compact_control *cc, unsigned long low_pfn, * admittedly racy check. */ if (!page_mapping(page) && - page_count(page) > page_mapcount(page)) + atomic_read(&page->_count) > page_mapcount(page)) continue; /* If we already hold the lock, we can skip some rechecking */ -- Kirill A. Shutemov -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/