Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751658AbcDRXSr (ORCPT ); Mon, 18 Apr 2016 19:18:47 -0400 Received: from TYO202.gate.nec.co.jp ([210.143.35.52]:63851 "EHLO tyo202.gate.nec.co.jp" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750931AbcDRXSq convert rfc822-to-8bit (ORCPT ); Mon, 18 Apr 2016 19:18:46 -0400 From: Naoya Horiguchi To: Konstantin Khlebnikov CC: "linux-mm@kvack.org" , "linux-kernel@vger.kernel.org" , "Kirill A. Shutemov" , Andrew Morton Subject: Re: [PATCH] mm/memory-failure: fix race with compound page split/merge Thread-Topic: [PATCH] mm/memory-failure: fix race with compound page split/merge Thread-Index: AQHRmWeXpCWgcYOp5UGzQkolf1kCXJ+PxtEA Date: Mon, 18 Apr 2016 23:15:52 +0000 Message-ID: <20160418231551.GA18493@hori1.linux.bs1.fc.nec.co.jp> References: <146097982568.15733.13924990169211134049.stgit@buzz> In-Reply-To: <146097982568.15733.13924990169211134049.stgit@buzz> Accept-Language: en-US, ja-JP Content-Language: ja-JP X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.128.101.26] Content-Type: text/plain; charset="iso-2022-jp" Content-ID: <4B278F902506DF4D8F83D712A4EAA78F@gisp.nec.co.jp> Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1206 Lines: 45 # CCed Andrew, On Mon, Apr 18, 2016 at 02:43:45PM +0300, Konstantin Khlebnikov wrote: > Get_hwpoison_page() must recheck relation between head and tail pages. > > Signed-off-by: Konstantin Khlebnikov Looks good to me. Without this recheck, the race causes kernel to pin an irrelevant page, and finally makes kernel crash for refcount mismcach... Acked-by: Naoya Horiguchi > --- > mm/memory-failure.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/mm/memory-failure.c b/mm/memory-failure.c > index 78f5f2641b91..ca5acee53b7a 100644 > --- a/mm/memory-failure.c > +++ b/mm/memory-failure.c > @@ -888,7 +888,15 @@ int get_hwpoison_page(struct page *page) > } > } > > - return get_page_unless_zero(head); > + if (get_page_unless_zero(head)) { > + if (head == compound_head(page)) > + return 1; > + > + pr_info("MCE: %#lx cannot catch tail\n", page_to_pfn(page)); Recently Chen Yucong replaced the label "MCE:" with "Memory failure:", but the resolution is trivial, I think. Thanks, Naoya Horiguchi > + put_page(head); > + } > + > + return 0; > } > EXPORT_SYMBOL_GPL(get_hwpoison_page); > >