From: Liu Shixin <liushixin2@huawei.com> To: Catalin Marinas <catalin.marinas@arm.com>, Will Deacon <will@kernel.org>, Denys Vlasenko <dvlasenk@redhat.com>, Kefeng Wang <wangkefeng.wang@huawei.com>, Anshuman Khandual <anshuman.khandual@arm.com>, David Hildenbrand <dhildenb@redhat.com>, Rafael Aquini <raquini@redhat.com>, Pasha Tatashin <pasha.tatashin@soleen.com> Cc: <linux-arm-kernel@lists.infradead.org>, <linux-kernel@vger.kernel.org>, Liu Shixin <liushixin2@huawei.com> Subject: [PATCH 1/2] arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud Date: Wed, 16 Nov 2022 16:38:10 +0800 [thread overview] Message-ID: <20221116083811.464678-2-liushixin2@huawei.com> (raw) In-Reply-To: <20221116083811.464678-1-liushixin2@huawei.com> The page table check trigger BUG_ON() unexpectedly when collapse hugepage: ------------[ cut here ]------------ kernel BUG at mm/page_table_check.c:82! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 6 PID: 68 Comm: khugepaged Not tainted 6.1.0-rc3+ #750 Hardware name: linux,dummy-virt (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : page_table_check_clear.isra.0+0x258/0x3f0 lr : page_table_check_clear.isra.0+0x240/0x3f0 [...] Call trace: page_table_check_clear.isra.0+0x258/0x3f0 __page_table_check_pmd_clear+0xbc/0x108 pmdp_collapse_flush+0xb0/0x160 collapse_huge_page+0xa08/0x1080 hpage_collapse_scan_pmd+0xf30/0x1590 khugepaged_scan_mm_slot.constprop.0+0x52c/0xac8 khugepaged+0x338/0x518 kthread+0x278/0x2f8 ret_from_fork+0x10/0x20 [...] Since pmd_user_accessible_page() doesn't check if a pmd is leaf, it decrease file_map_count for a non-leaf pmd comes from collapse_huge_page(). and so trigger BUG_ON() unexpectedly. Fix this problem by using pmd_leaf() insteal of pmd_present() in pmd_user_accessible_page(). Moreover, use pud_leaf() for pud_user_accessible_page() too. Fixes: 42b2547137f5 ("arm64/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK") Reported-by: Denys Vlasenko <dvlasenk@redhat.com> Signed-off-by: Liu Shixin <liushixin2@huawei.com> --- arch/arm64/include/asm/pgtable.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h index 71a1af42f0e8..edf6625ce965 100644 --- a/arch/arm64/include/asm/pgtable.h +++ b/arch/arm64/include/asm/pgtable.h @@ -863,12 +863,12 @@ static inline bool pte_user_accessible_page(pte_t pte) static inline bool pmd_user_accessible_page(pmd_t pmd) { - return pmd_present(pmd) && (pmd_user(pmd) || pmd_user_exec(pmd)); + return pmd_leaf(pmd) && (pmd_user(pmd) || pmd_user_exec(pmd)); } static inline bool pud_user_accessible_page(pud_t pud) { - return pud_present(pud) && pud_user(pud); + return pud_leaf(pud) && pud_user(pud); } #endif -- 2.25.1
WARNING: multiple messages have this Message-ID (diff)
From: Liu Shixin <liushixin2@huawei.com> To: Catalin Marinas <catalin.marinas@arm.com>, Will Deacon <will@kernel.org>, Denys Vlasenko <dvlasenk@redhat.com>, Kefeng Wang <wangkefeng.wang@huawei.com>, Anshuman Khandual <anshuman.khandual@arm.com>, David Hildenbrand <dhildenb@redhat.com>, Rafael Aquini <raquini@redhat.com>, Pasha Tatashin <pasha.tatashin@soleen.com> Cc: <linux-arm-kernel@lists.infradead.org>, <linux-kernel@vger.kernel.org>, Liu Shixin <liushixin2@huawei.com> Subject: [PATCH 1/2] arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud Date: Wed, 16 Nov 2022 16:38:10 +0800 [thread overview] Message-ID: <20221116083811.464678-2-liushixin2@huawei.com> (raw) In-Reply-To: <20221116083811.464678-1-liushixin2@huawei.com> The page table check trigger BUG_ON() unexpectedly when collapse hugepage: ------------[ cut here ]------------ kernel BUG at mm/page_table_check.c:82! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 6 PID: 68 Comm: khugepaged Not tainted 6.1.0-rc3+ #750 Hardware name: linux,dummy-virt (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : page_table_check_clear.isra.0+0x258/0x3f0 lr : page_table_check_clear.isra.0+0x240/0x3f0 [...] Call trace: page_table_check_clear.isra.0+0x258/0x3f0 __page_table_check_pmd_clear+0xbc/0x108 pmdp_collapse_flush+0xb0/0x160 collapse_huge_page+0xa08/0x1080 hpage_collapse_scan_pmd+0xf30/0x1590 khugepaged_scan_mm_slot.constprop.0+0x52c/0xac8 khugepaged+0x338/0x518 kthread+0x278/0x2f8 ret_from_fork+0x10/0x20 [...] Since pmd_user_accessible_page() doesn't check if a pmd is leaf, it decrease file_map_count for a non-leaf pmd comes from collapse_huge_page(). and so trigger BUG_ON() unexpectedly. Fix this problem by using pmd_leaf() insteal of pmd_present() in pmd_user_accessible_page(). Moreover, use pud_leaf() for pud_user_accessible_page() too. Fixes: 42b2547137f5 ("arm64/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK") Reported-by: Denys Vlasenko <dvlasenk@redhat.com> Signed-off-by: Liu Shixin <liushixin2@huawei.com> --- arch/arm64/include/asm/pgtable.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h index 71a1af42f0e8..edf6625ce965 100644 --- a/arch/arm64/include/asm/pgtable.h +++ b/arch/arm64/include/asm/pgtable.h @@ -863,12 +863,12 @@ static inline bool pte_user_accessible_page(pte_t pte) static inline bool pmd_user_accessible_page(pmd_t pmd) { - return pmd_present(pmd) && (pmd_user(pmd) || pmd_user_exec(pmd)); + return pmd_leaf(pmd) && (pmd_user(pmd) || pmd_user_exec(pmd)); } static inline bool pud_user_accessible_page(pud_t pud) { - return pud_present(pud) && pud_user(pud); + return pud_leaf(pud) && pud_user(pud); } #endif -- 2.25.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2022-11-16 7:51 UTC|newest] Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-11-16 8:38 [PATCH 0/2] arm64: fix two bug about page table check Liu Shixin 2022-11-16 8:38 ` Liu Shixin 2022-11-16 8:38 ` Liu Shixin [this message] 2022-11-16 8:38 ` [PATCH 1/2] arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud Liu Shixin 2022-11-16 9:04 ` David Hildenbrand 2022-11-16 9:04 ` David Hildenbrand 2022-11-16 14:59 ` Pasha Tatashin 2022-11-16 14:59 ` Pasha Tatashin 2022-11-17 4:09 ` Anshuman Khandual 2022-11-17 4:09 ` Anshuman Khandual 2022-11-17 6:59 ` Liu Shixin 2022-11-17 6:59 ` Liu Shixin 2022-11-21 15:57 ` Denys Vlasenko 2022-11-21 15:57 ` Denys Vlasenko 2022-11-16 8:38 ` [PATCH 2/2] arm64/mm: fix incorrect file_map_count for invalid pmd/pud Liu Shixin 2022-11-16 8:38 ` Liu Shixin 2022-11-16 9:08 ` David Hildenbrand 2022-11-16 9:08 ` David Hildenbrand 2022-11-16 15:46 ` Mark Rutland 2022-11-16 15:46 ` Mark Rutland 2022-11-17 4:24 ` Anshuman Khandual 2022-11-17 4:24 ` Anshuman Khandual 2022-11-16 15:18 ` Pasha Tatashin 2022-11-16 15:18 ` Pasha Tatashin 2022-11-16 15:52 ` Mark Rutland 2022-11-16 15:52 ` Mark Rutland 2022-11-17 3:15 ` Liu Shixin 2022-11-17 3:15 ` Liu Shixin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20221116083811.464678-2-liushixin2@huawei.com \ --to=liushixin2@huawei.com \ --cc=anshuman.khandual@arm.com \ --cc=catalin.marinas@arm.com \ --cc=dhildenb@redhat.com \ --cc=dvlasenk@redhat.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=pasha.tatashin@soleen.com \ --cc=raquini@redhat.com \ --cc=wangkefeng.wang@huawei.com \ --cc=will@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.