Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934530AbeAKPs6 (ORCPT + 1 other); Thu, 11 Jan 2018 10:48:58 -0500 Received: from smtp02.citrix.com ([66.165.176.63]:51250 "EHLO SMTP02.CITRIX.COM" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932429AbeAKPsk (ORCPT ); Thu, 11 Jan 2018 10:48:40 -0500 X-IronPort-AV: E=Sophos;i="5.46,345,1511827200"; d="scan'208";a="465426160" Subject: Re: [PATCH 1/2] xen/grant-table: Use put_page instead of free_page To: CC: Boris Ostrovsky , Juergen Gross , , References: <20180111093638.28937-1-ross.lagerwall@citrix.com> <20180111093638.28937-2-ross.lagerwall@citrix.com> From: Ross Lagerwall Message-ID: <0194fe18-b109-4160-544d-923a53e1ad82@citrix.com> Date: Thu, 11 Jan 2018 15:48:36 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <20180111093638.28937-2-ross.lagerwall@citrix.com> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: +CC netdev On 01/11/2018 09:36 AM, Ross Lagerwall wrote: > The page given to gnttab_end_foreign_access() to free could be a > compound page so use put_page() instead of free_page() since it can > handle both compound and single pages correctly. > > This bug was discovered when migrating a Xen VM with several VIFs and > CONFIG_DEBUG_VM enabled. It hits a BUG usually after fewer than 10 > iterations. All netfront devices disconnect from the backend during a > suspend/resume and this will call gnttab_end_foreign_access() if a > netfront queue has an outstanding skb. The mismatch between calling > get_page() and free_page() on a compound page causes a reference > counting error which is detected when DEBUG_VM is enabled. > > Signed-off-by: Ross Lagerwall > --- > drivers/xen/grant-table.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c > index f45114f..27be107 100644 > --- a/drivers/xen/grant-table.c > +++ b/drivers/xen/grant-table.c > @@ -382,7 +382,7 @@ static void gnttab_handle_deferred(struct timer_list *unused) > if (entry->page) { > pr_debug("freeing g.e. %#x (pfn %#lx)\n", > entry->ref, page_to_pfn(entry->page)); > - __free_page(entry->page); > + put_page(entry->page); > } else > pr_info("freeing g.e. %#x\n", entry->ref); > kfree(entry); > @@ -438,7 +438,7 @@ void gnttab_end_foreign_access(grant_ref_t ref, int readonly, > if (gnttab_end_foreign_access_ref(ref, readonly)) { > put_free_entry(ref); > if (page != 0) > - free_page(page); > + put_page(virt_to_page(page)); > } else > gnttab_add_deferred(ref, readonly, > page ? virt_to_page(page) : NULL); >