Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S964815AbbKCP1C (ORCPT ); Tue, 3 Nov 2015 10:27:02 -0500 Received: from mga11.intel.com ([192.55.52.93]:10634 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755311AbbKCP07 (ORCPT ); Tue, 3 Nov 2015 10:26:59 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.20,239,1444719600"; d="scan'208";a="825839357" From: "Kirill A. Shutemov" To: Andrew Morton Cc: Andrea Arcangeli , Hugh Dickins , Naoya Horiguchi , Sasha Levin , Minchan Kim , linux-kernel@vger.kernel.org, linux-mm@kvack.org, "Kirill A. Shutemov" Subject: [PATCH 1/4] mm: do not crash on PageDoubleMap() for non-head pages Date: Tue, 3 Nov 2015 17:26:12 +0200 Message-Id: <1446564375-72143-2-git-send-email-kirill.shutemov@linux.intel.com> X-Mailer: git-send-email 2.6.1 In-Reply-To: <1446564375-72143-1-git-send-email-kirill.shutemov@linux.intel.com> References: <1446564375-72143-1-git-send-email-kirill.shutemov@linux.intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3708 Lines: 77 We usually don't call PageDoubleMap() on small or tail pages, but during read from /proc/kpageflags we don't protect the page from being freed under us and it can lead to VM_BUG_ON_PAGE() in PageDoubleMap(): page:ffffea00033e0000 count:0 mapcount:0 mapping: (null) index:0x700000200 flags: 0x4000000000000000() page dumped because: VM_BUG_ON_PAGE(!PageHead(page)) page->mem_cgroup:ffff88021588cc00 ------------[ cut here ]------------ kernel BUG at /src/linux-dev/include/linux/page-flags.h:552! invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC Modules linked in: cfg80211 rfkill crc32c_intel virtio_balloon serio_raw i2c_piix4 virtio_blk virtio_net ata_generic pata_acpi CPU: 0 PID: 1183 Comm: page-types Not tainted 4.2.0-mmotm-2015-10-21-14-41-151027-1418-00014-41+ #179 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 task: ffff880214a08bc0 ti: ffff880213e2c000 task.ti: ffff880213e2c000 RIP: 0010:[] [] stable_page_flags+0x336/0x340 RSP: 0018:ffff880213e2fda8 EFLAGS: 00010292 RAX: 0000000000000021 RBX: ffff8802150a39c0 RCX: 0000000000000000 RDX: ffff88021ec0ff38 RSI: ffff88021ec0d658 RDI: ffff88021ec0d658 RBP: ffff880213e2fdc8 R08: 000000000000000a R09: 000000000000132f R10: 0000000000000000 R11: 000000000000132f R12: 4000000000000000 R13: ffffea00033e6340 R14: 00007fff8449e430 R15: ffffea00033e6340 FS: 00007ff7f9525700(0000) GS:ffff88021ec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000063b800 CR3: 00000000d9e71000 CR4: 00000000000006f0 Stack: ffff8800db82df80 ffff8802150a39c0 0000000000000008 00000000000cf98d ffff880213e2fe18 ffffffff81243588 00007fff8449e430 ffff880213e2ff20 000000000063b800 ffff8802150a39c0 fffffffffffffffb ffff880213e2ff20 Call Trace: [] kpageflags_read+0xc8/0x130 [] proc_reg_read+0x48/0x70 [] __vfs_read+0x28/0xd0 [] ? security_file_permission+0xae/0xc0 [] ? rw_verify_area+0x53/0xf0 [] vfs_read+0x8a/0x130 [] SyS_pread64+0x77/0x90 [] entry_SYSCALL_64_fastpath+0x12/0x6a Code: ca 00 00 40 01 48 39 c1 48 0f 44 da e9 a2 fd ff ff 48 c7 c6 50 a6 a1 8 1 e8 58 ab f4 ff 0f 0b 48 c7 c6 90 a2 a1 81 e8 4a ab f4 ff <0f> 0b 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 e5 41 57 RIP [] stable_page_flags+0x336/0x340 RSP ---[ end trace e5d18553088c026a ]--- Let's drop the VM_BUG_ON_PAGE() from PageDoubleMap() and return false for non-head pages. The patch can be folded into "mm: rework mapcount accounting to enable 4k mapping of THPs" Signed-off-by: Kirill A. Shutemov Reported-by: Naoya Horiguchi --- include/linux/page-flags.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h index 72356fbc3f2d..26cc7a068126 100644 --- a/include/linux/page-flags.h +++ b/include/linux/page-flags.h @@ -549,8 +549,7 @@ static inline int PageTransTail(struct page *page) */ static inline int PageDoubleMap(struct page *page) { - VM_BUG_ON_PAGE(!PageHead(page), page); - return test_bit(PG_double_map, &page[1].flags); + return PageHead(page) && test_bit(PG_double_map, &page[1].flags); } static inline int TestSetPageDoubleMap(struct page *page) -- 2.6.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/