From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751658AbcDRXSr (ORCPT ); Mon, 18 Apr 2016 19:18:47 -0400 Received: from TYO202.gate.nec.co.jp ([210.143.35.52]:63851 "EHLO tyo202.gate.nec.co.jp" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750931AbcDRXSq convert rfc822-to-8bit (ORCPT ); Mon, 18 Apr 2016 19:18:46 -0400 From: Naoya Horiguchi To: Konstantin Khlebnikov CC: "linux-mm@kvack.org" , "linux-kernel@vger.kernel.org" , "Kirill A. Shutemov" , Andrew Morton Subject: Re: [PATCH] mm/memory-failure: fix race with compound page split/merge Thread-Topic: [PATCH] mm/memory-failure: fix race with compound page split/merge Thread-Index: AQHRmWeXpCWgcYOp5UGzQkolf1kCXJ+PxtEA Date: Mon, 18 Apr 2016 23:15:52 +0000 Message-ID: <20160418231551.GA18493@hori1.linux.bs1.fc.nec.co.jp> References: <146097982568.15733.13924990169211134049.stgit@buzz> In-Reply-To: <146097982568.15733.13924990169211134049.stgit@buzz> Accept-Language: en-US, ja-JP Content-Language: ja-JP X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.128.101.26] Content-Type: text/plain; charset="iso-2022-jp" Content-ID: <4B278F902506DF4D8F83D712A4EAA78F@gisp.nec.co.jp> Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org # CCed Andrew, On Mon, Apr 18, 2016 at 02:43:45PM +0300, Konstantin Khlebnikov wrote: > Get_hwpoison_page() must recheck relation between head and tail pages. > > Signed-off-by: Konstantin Khlebnikov Looks good to me. Without this recheck, the race causes kernel to pin an irrelevant page, and finally makes kernel crash for refcount mismcach... Acked-by: Naoya Horiguchi > --- > mm/memory-failure.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/mm/memory-failure.c b/mm/memory-failure.c > index 78f5f2641b91..ca5acee53b7a 100644 > --- a/mm/memory-failure.c > +++ b/mm/memory-failure.c > @@ -888,7 +888,15 @@ int get_hwpoison_page(struct page *page) > } > } > > - return get_page_unless_zero(head); > + if (get_page_unless_zero(head)) { > + if (head == compound_head(page)) > + return 1; > + > + pr_info("MCE: %#lx cannot catch tail\n", page_to_pfn(page)); Recently Chen Yucong replaced the label "MCE:" with "Memory failure:", but the resolution is trivial, I think. Thanks, Naoya Horiguchi > + put_page(head); > + } > + > + return 0; > } > EXPORT_SYMBOL_GPL(get_hwpoison_page); > > From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pf0-f200.google.com (mail-pf0-f200.google.com [209.85.192.200]) by kanga.kvack.org (Postfix) with ESMTP id 9F9EF6B025E for ; Mon, 18 Apr 2016 19:18:41 -0400 (EDT) Received: by mail-pf0-f200.google.com with SMTP id c20so356089526pfc.2 for ; Mon, 18 Apr 2016 16:18:41 -0700 (PDT) Received: from tyo202.gate.nec.co.jp (TYO202.gate.nec.co.jp. [210.143.35.52]) by mx.google.com with ESMTPS id dz4si2094189pab.12.2016.04.18.16.18.40 for (version=TLS1 cipher=AES128-SHA bits=128/128); Mon, 18 Apr 2016 16:18:40 -0700 (PDT) From: Naoya Horiguchi Subject: Re: [PATCH] mm/memory-failure: fix race with compound page split/merge Date: Mon, 18 Apr 2016 23:15:52 +0000 Message-ID: <20160418231551.GA18493@hori1.linux.bs1.fc.nec.co.jp> References: <146097982568.15733.13924990169211134049.stgit@buzz> In-Reply-To: <146097982568.15733.13924990169211134049.stgit@buzz> Content-Language: ja-JP Content-Type: text/plain; charset="iso-2022-jp" Content-ID: <4B278F902506DF4D8F83D712A4EAA78F@gisp.nec.co.jp> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: owner-linux-mm@kvack.org List-ID: To: Konstantin Khlebnikov Cc: "linux-mm@kvack.org" , "linux-kernel@vger.kernel.org" , "Kirill A. Shutemov" , Andrew Morton # CCed Andrew, On Mon, Apr 18, 2016 at 02:43:45PM +0300, Konstantin Khlebnikov wrote: > Get_hwpoison_page() must recheck relation between head and tail pages. >=20 > Signed-off-by: Konstantin Khlebnikov Looks good to me. Without this recheck, the race causes kernel to pin an irrelevant page, and finally makes kernel crash for refcount mismcach... Acked-by: Naoya Horiguchi > --- > mm/memory-failure.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) >=20 > diff --git a/mm/memory-failure.c b/mm/memory-failure.c > index 78f5f2641b91..ca5acee53b7a 100644 > --- a/mm/memory-failure.c > +++ b/mm/memory-failure.c > @@ -888,7 +888,15 @@ int get_hwpoison_page(struct page *page) > } > } > =20 > - return get_page_unless_zero(head); > + if (get_page_unless_zero(head)) { > + if (head =3D=3D compound_head(page)) > + return 1; > + > + pr_info("MCE: %#lx cannot catch tail\n", page_to_pfn(page)); Recently Chen Yucong replaced the label "MCE:" with "Memory failure:", but the resolution is trivial, I think. Thanks, Naoya Horiguchi > + put_page(head); > + } > + > + return 0; > } > EXPORT_SYMBOL_GPL(get_hwpoison_page); > =20 > = -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org