Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754814AbbHLOr6 (ORCPT ); Wed, 12 Aug 2015 10:47:58 -0400 Received: from mx2.suse.de ([195.135.220.15]:58792 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754244AbbHLOr5 (ORCPT ); Wed, 12 Aug 2015 10:47:57 -0400 Subject: Re: page-flags behavior on compound pages: a worry To: "Kirill A. Shutemov" , Hugh Dickins , David Rientjes References: <1426784902-125149-1-git-send-email-kirill.shutemov@linux.intel.com> <1426784902-125149-5-git-send-email-kirill.shutemov@linux.intel.com> <20150806153259.GA2834@node.dhcp.inet.fi> <20150812143509.GA12320@node.dhcp.inet.fi> Cc: "Kirill A. Shutemov" , Andrew Morton , Andrea Arcangeli , Dave Hansen , Mel Gorman , Rik van Riel , Christoph Lameter , Naoya Horiguchi , Steve Capper , "Aneesh Kumar K.V" , Johannes Weiner , Michal Hocko , Jerome Marchand , linux-kernel@vger.kernel.org, linux-mm@kvack.org From: Vlastimil Babka Message-ID: <55CB5C99.9050505@suse.cz> Date: Wed, 12 Aug 2015 16:47:53 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.1.0 MIME-Version: 1.0 In-Reply-To: <20150812143509.GA12320@node.dhcp.inet.fi> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2776 Lines: 83 On 08/12/2015 04:35 PM, Kirill A. Shutemov wrote: > On Thu, Aug 06, 2015 at 12:24:22PM -0700, Hugh Dickins wrote: >>> IIUC, the only potentially problematic callsites left are physical memory >>> scanners. This code requires audit. I'll do that. >> >> Please. > > I haven't finished the exercise yet. But here's an issue I believe present > in current *Linus* tree: > > From e78eec7d7a8c4cba8b5952a997973f7741e704f4 Mon Sep 17 00:00:00 2001 > From: "Kirill A. Shutemov" > Date: Wed, 12 Aug 2015 17:09:16 +0300 > Subject: [PATCH] mm: fix potential race in isolate_migratepages_block() > > Hugh has pointed that compound_head() call can be unsafe in some context. > There's one example: > > CPU0 CPU1 > > isolate_migratepages_block() > page_count() > compound_head() > !!PageTail() == true > put_page() > tail->first_page = NULL > head = tail->first_page > alloc_pages(__GFP_COMP) > prep_compound_page() > tail->first_page = head > __SetPageTail(p); > !!PageTail() == true > > > The race is pure theoretical. I don't it's possible to trigger it in > practice. But who knows. It's even less probable thanks to the fact that before this check we determined it's a PageLRU (and thus !PageTail). > > This can be fixed by avoiding compound_head() in unsafe context. This is OK because if page becomes tail and we read zero page count, it's not fatal. > Signed-off-by: Kirill A. Shutemov Fixes: 119d6d59dc ("mm, compaction: avoid isolating pinned pages") Potentially stable 3.15+ if theoretical races qualify. They don't per stable rules, but we seem to be bending that a lot anyway. > Cc: Hugh Dickins > Cc: David Rientjes > Cc: Vlastimil Babka Acked-by: Vlastimil Babka > --- > mm/compaction.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/mm/compaction.c b/mm/compaction.c > index 86f04e556f96..bec727b700d3 100644 > --- a/mm/compaction.c > +++ b/mm/compaction.c > @@ -787,7 +787,7 @@ isolate_migratepages_block(struct compact_control *cc, unsigned long low_pfn, > * admittedly racy check. > */ > if (!page_mapping(page) && > - page_count(page) > page_mapcount(page)) > + atomic_read(&page->_count) > page_mapcount(page)) > continue; > > /* If we already hold the lock, we can skip some rechecking */ > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/