From: Andrew Morton <akpm@linux-foundation.org> To: chris@chrisdown.name, guro@fb.com, hannes@cmpxchg.org, mhocko@suse.com, mm-commits@vger.kernel.org, stable@vger.kernel.org, tj@kernel.org Subject: [merged] mm-memcontrol-handle-div0-crash-race-condition-in-memorylow.patch removed from -mm tree Date: Fri, 26 Jun 2020 20:33:46 -0700 [thread overview] Message-ID: <20200627033346.uM9eRcQFS%akpm@linux-foundation.org> (raw) In-Reply-To: <20200625202807.b630829d6fa55388148bee7d@linux-foundation.org> The patch titled Subject: mm: memcontrol: handle div0 crash race condition in memory.low has been removed from the -mm tree. Its filename was mm-memcontrol-handle-div0-crash-race-condition-in-memorylow.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Johannes Weiner <hannes@cmpxchg.org> Subject: mm: memcontrol: handle div0 crash race condition in memory.low Tejun reports seeing rare div0 crashes in memory.low stress testing: [37228.504582] RIP: 0010:mem_cgroup_calculate_protection+0xed/0x150 [37228.505059] Code: 0f 46 d1 4c 39 d8 72 57 f6 05 16 d6 42 01 40 74 1f 4c 39 d8 76 1a 4c 39 d1 76 15 4c 29 d1 4c 29 d8 4d 29 d9 31 d2 48 0f af c1 <49> f7 f1 49 01 c2 4c 89 96 38 01 00 00 5d c3 48 0f af c7 31 d2 49 [37228.506254] RSP: 0018:ffffa14e01d6fcd0 EFLAGS: 00010246 [37228.506769] RAX: 000000000243e384 RBX: 0000000000000000 RCX: 0000000000008f4b [37228.507319] RDX: 0000000000000000 RSI: ffff8b89bee84000 RDI: 0000000000000000 [37228.507869] RBP: ffffa14e01d6fcd0 R08: ffff8b89ca7d40f8 R09: 0000000000000000 [37228.508376] R10: 0000000000000000 R11: 00000000006422f7 R12: 0000000000000000 [37228.508881] R13: ffff8b89d9617000 R14: ffff8b89bee84000 R15: ffffa14e01d6fdb8 [37228.509397] FS: 0000000000000000(0000) GS:ffff8b8a1f1c0000(0000) knlGS:0000000000000000 [37228.509917] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [37228.510442] CR2: 00007f93b1fc175b CR3: 000000016100a000 CR4: 0000000000340ea0 [37228.511076] Call Trace: [37228.511561] shrink_node+0x1e5/0x6c0 [37228.512044] balance_pgdat+0x32d/0x5f0 [37228.512521] kswapd+0x1d7/0x3d0 [37228.513346] ? wait_woken+0x80/0x80 [37228.514170] kthread+0x11c/0x160 [37228.514983] ? balance_pgdat+0x5f0/0x5f0 [37228.515797] ? kthread_park+0x90/0x90 [37228.516593] ret_from_fork+0x1f/0x30 This happens when parent_usage == siblings_protected. We check that usage is bigger than protected, which should imply parent_usage being bigger than siblings_protected. However, we don't read (or even update) these values atomically, and they can be out of sync as the memory state changes under us. A bit of fluctuation around the target protection isn't a big deal, but we need to handle the div0 case. Check the parent state explicitly to make sure we have a reasonable positive value for the divisor. Link: http://lkml.kernel.org/r/20200615140658.601684-1-hannes@cmpxchg.org Fixes: 8a931f801340 ("mm: memcontrol: recursive memory.low protection") Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Reported-by: Tejun Heo <tj@kernel.org> Acked-by: Michal Hocko <mhocko@suse.com> Acked-by: Chris Down <chris@chrisdown.name> Cc: Roman Gushchin <guro@fb.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> --- mm/memcontrol.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/mm/memcontrol.c~mm-memcontrol-handle-div0-crash-race-condition-in-memorylow +++ a/mm/memcontrol.c @@ -6360,11 +6360,16 @@ static unsigned long effective_protectio * We're using unprotected memory for the weight so that if * some cgroups DO claim explicit protection, we don't protect * the same bytes twice. + * + * Check both usage and parent_usage against the respective + * protected values. One should imply the other, but they + * aren't read atomically - make sure the division is sane. */ if (!(cgrp_dfl_root.flags & CGRP_ROOT_MEMORY_RECURSIVE_PROT)) return ep;
WARNING: multiple messages have this Message-ID (diff)
From: Andrew Morton <akpm@linux-foundation.org> To: chris@chrisdown.name, guro@fb.com, hannes@cmpxchg.org, mhocko@suse.com, mm-commits@vger.kernel.org, stable@vger.kernel.org, tj@kernel.org Subject: [merged] mm-memcontrol-handle-div0-crash-race-condition-in-memorylow.patch removed from -mm tree Date: Fri, 26 Jun 2020 20:33:46 -0700 [thread overview] Message-ID: <20200627033346.uM9eRcQFS%akpm@linux-foundation.org> (raw) In-Reply-To: <20200625202807.b630829d6fa55388148bee7d@linux-foundation.org> The patch titled Subject: mm: memcontrol: handle div0 crash race condition in memory.low has been removed from the -mm tree. Its filename was mm-memcontrol-handle-div0-crash-race-condition-in-memorylow.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Johannes Weiner <hannes@cmpxchg.org> Subject: mm: memcontrol: handle div0 crash race condition in memory.low Tejun reports seeing rare div0 crashes in memory.low stress testing: [37228.504582] RIP: 0010:mem_cgroup_calculate_protection+0xed/0x150 [37228.505059] Code: 0f 46 d1 4c 39 d8 72 57 f6 05 16 d6 42 01 40 74 1f 4c 39 d8 76 1a 4c 39 d1 76 15 4c 29 d1 4c 29 d8 4d 29 d9 31 d2 48 0f af c1 <49> f7 f1 49 01 c2 4c 89 96 38 01 00 00 5d c3 48 0f af c7 31 d2 49 [37228.506254] RSP: 0018:ffffa14e01d6fcd0 EFLAGS: 00010246 [37228.506769] RAX: 000000000243e384 RBX: 0000000000000000 RCX: 0000000000008f4b [37228.507319] RDX: 0000000000000000 RSI: ffff8b89bee84000 RDI: 0000000000000000 [37228.507869] RBP: ffffa14e01d6fcd0 R08: ffff8b89ca7d40f8 R09: 0000000000000000 [37228.508376] R10: 0000000000000000 R11: 00000000006422f7 R12: 0000000000000000 [37228.508881] R13: ffff8b89d9617000 R14: ffff8b89bee84000 R15: ffffa14e01d6fdb8 [37228.509397] FS: 0000000000000000(0000) GS:ffff8b8a1f1c0000(0000) knlGS:0000000000000000 [37228.509917] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [37228.510442] CR2: 00007f93b1fc175b CR3: 000000016100a000 CR4: 0000000000340ea0 [37228.511076] Call Trace: [37228.511561] shrink_node+0x1e5/0x6c0 [37228.512044] balance_pgdat+0x32d/0x5f0 [37228.512521] kswapd+0x1d7/0x3d0 [37228.513346] ? wait_woken+0x80/0x80 [37228.514170] kthread+0x11c/0x160 [37228.514983] ? balance_pgdat+0x5f0/0x5f0 [37228.515797] ? kthread_park+0x90/0x90 [37228.516593] ret_from_fork+0x1f/0x30 This happens when parent_usage == siblings_protected. We check that usage is bigger than protected, which should imply parent_usage being bigger than siblings_protected. However, we don't read (or even update) these values atomically, and they can be out of sync as the memory state changes under us. A bit of fluctuation around the target protection isn't a big deal, but we need to handle the div0 case. Check the parent state explicitly to make sure we have a reasonable positive value for the divisor. Link: http://lkml.kernel.org/r/20200615140658.601684-1-hannes@cmpxchg.org Fixes: 8a931f801340 ("mm: memcontrol: recursive memory.low protection") Signed-off-by: Johannes Weiner <hannes@cmpxchg.org> Reported-by: Tejun Heo <tj@kernel.org> Acked-by: Michal Hocko <mhocko@suse.com> Acked-by: Chris Down <chris@chrisdown.name> Cc: Roman Gushchin <guro@fb.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> --- mm/memcontrol.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/mm/memcontrol.c~mm-memcontrol-handle-div0-crash-race-condition-in-memorylow +++ a/mm/memcontrol.c @@ -6360,11 +6360,16 @@ static unsigned long effective_protectio * We're using unprotected memory for the weight so that if * some cgroups DO claim explicit protection, we don't protect * the same bytes twice. + * + * Check both usage and parent_usage against the respective + * protected values. One should imply the other, but they + * aren't read atomically - make sure the division is sane. */ if (!(cgrp_dfl_root.flags & CGRP_ROOT_MEMORY_RECURSIVE_PROT)) return ep; - - if (parent_effective > siblings_protected && usage > protected) { + if (parent_effective > siblings_protected && + parent_usage > siblings_protected && + usage > protected) { unsigned long unclaimed; unclaimed = parent_effective - siblings_protected; _ Patches currently in -mm which might be from hannes@cmpxchg.org are mm-memcontrol-decouple-reference-counting-from-page-accounting.patch
next prev parent reply other threads:[~2020-06-27 3:33 UTC|newest] Thread overview: 84+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-06-26 3:28 incoming Andrew Morton 2020-06-26 3:29 ` [patch 01/32] openrisc: fix boot oops when DEBUG_VM is enabled Andrew Morton 2020-06-26 3:29 ` [patch 02/32] mm: do_swap_page(): fix up the error code Andrew Morton 2020-06-26 3:29 ` [patch 03/32] mm, compaction: make capture control handling safe wrt interrupts Andrew Morton 2020-06-26 3:29 ` [patch 04/32] kexec: do not verify the signature without the lockdown or mandatory signature Andrew Morton 2020-06-26 3:29 ` [patch 05/32] ocfs2: avoid inode removal while nfsd is accessing it Andrew Morton 2020-06-26 3:29 ` [patch 06/32] ocfs2: load global_inode_alloc Andrew Morton 2020-06-26 3:29 ` [patch 07/32] ocfs2: fix panic on nfs server over ocfs2 Andrew Morton 2020-06-26 3:29 ` [patch 08/32] ocfs2: fix value of OCFS2_INVALID_SLOT Andrew Morton 2020-06-26 3:29 ` [patch 09/32] lib: fix test_hmm.c reference after free Andrew Morton 2020-06-26 3:29 ` [patch 10/32] linux/bits.h: fix unsigned less than zero warnings Andrew Morton [not found] ` <CAHk-=wiZrhVUq3N17=GVzMQNQUKi65x=-djTM2A+fz8UdQxgEg@mail.gmail.com> [not found] ` <CADRDgG6SXwngT5gS2EY1Y0xnPdYth-FicQyTnPyqiwpmw52eQg@mail.gmail.com> 2020-06-26 13:23 ` Andy Shevchenko 2020-06-26 14:03 ` Arnd Bergmann 2020-06-26 14:09 ` Andy Shevchenko 2020-06-26 14:43 ` Arnd Bergmann 2020-06-26 15:21 ` Kees Cook 2020-06-27 22:01 ` Linus Torvalds 2020-07-08 19:07 ` [PATCH] kbuild: Move -Wtype-limits to W=2 Rikard Falkeborn 2020-07-08 20:00 ` Andy Shevchenko 2020-06-26 3:29 ` [patch 11/32] mm, slab: fix sign conversion problem in memcg_uncharge_slab() Andrew Morton 2020-06-26 3:29 ` Andrew Morton 2020-06-26 3:29 ` [patch 12/32] mm/slab: use memzero_explicit() in kzfree() Andrew Morton 2020-06-26 3:29 ` [patch 13/32] slub: cure list_slab_objects() from double fix Andrew Morton 2020-06-26 3:29 ` [patch 14/32] mm: fix swap cache node allocation mask Andrew Morton 2020-06-26 3:29 ` Andrew Morton 2020-06-26 3:30 ` [patch 15/32] mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages() Andrew Morton 2020-06-26 3:30 ` [patch 16/32] mm/debug_vm_pgtable: fix build failure with powerpc 8xx Andrew Morton 2020-06-26 3:30 ` [patch 17/32] make asm-generic/cacheflush.h more standalone Andrew Morton 2020-06-26 3:30 ` [patch 18/32] media: omap3isp: remove cacheflush.h Andrew Morton 2020-06-26 3:30 ` [patch 19/32] mm/vmalloc.c: fix a warning while make xmldocs Andrew Morton 2020-06-26 3:30 ` [patch 20/32] mm: memcontrol: handle div0 crash race condition in memory.low Andrew Morton 2020-06-26 3:30 ` Andrew Morton 2020-06-26 3:30 ` [patch 21/32] mm/memcontrol.c: add missed css_put() Andrew Morton 2020-06-26 3:30 ` [patch 22/32] mm/memcontrol.c: prevent missed memory.low load tears Andrew Morton 2020-06-26 3:30 ` [patch 23/32] docs: mm/gup: minor documentation update Andrew Morton 2020-06-26 3:30 ` [patch 24/32] doc: THP CoW fault no longer allocate THP Andrew Morton 2020-06-26 3:30 ` [patch 25/32] mm: workingset: age nonresident information alongside anonymous pages Andrew Morton 2020-06-26 3:30 ` [patch 26/32] mm/swap: fix for "mm: workingset: age nonresident information alongside anonymous pages" Andrew Morton 2020-06-26 3:30 ` [patch 27/32] mm/memory: fix IO cost for anonymous page Andrew Morton 2020-06-26 3:30 ` [patch 28/32] x86/hyperv: allocate the hypercall page with only read and execute bits Andrew Morton 2020-06-26 3:30 ` [patch 29/32] arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page Andrew Morton 2020-06-26 3:30 ` [patch 30/32] mm: remove vmalloc_exec Andrew Morton 2020-06-26 3:30 ` [patch 31/32] mm/memory_hotplug.c: fix false softlockup during pfn range removal Andrew Morton 2020-06-26 3:30 ` [patch 32/32] MAINTAINERS: update info for sparse Andrew Morton 2020-06-26 6:51 ` incoming Linus Torvalds 2020-06-26 7:31 ` incoming Linus Torvalds 2020-06-26 17:39 ` incoming Konstantin Ryabitsev 2020-06-26 17:40 ` incoming Konstantin Ryabitsev 2020-06-27 3:32 ` + linux-next-git-rejects.patch added to -mm tree Andrew Morton 2020-06-27 3:32 ` [merged] dma-remap-align-the-size-in-dma_common__remap.patch removed from " Andrew Morton 2020-06-27 3:32 ` [merged] openrisc-fix-boot-oops-when-debug_vm-is-enabled.patch " Andrew Morton 2020-06-27 3:33 ` [merged] mm-do_swap_page-fix-up-the-error-code-instantiation.patch " Andrew Morton 2020-06-27 3:33 ` [merged] mm-compaction-make-capture-control-handling-safe-wrt-interrupts.patch " Andrew Morton 2020-06-27 3:33 ` [merged] kexec-do-not-verify-the-signature-without-the-lockdown-or-mandatory-signature.patch " Andrew Morton 2020-06-27 3:33 ` [merged] ocfs2-avoid-inode-removed-while-nfsd-access-it.patch " Andrew Morton 2020-06-27 3:33 ` [merged] ocfs2-load-global_inode_alloc.patch " Andrew Morton 2020-06-27 3:33 ` [merged] ocfs2-fix-panic-on-nfs-server-over-ocfs2.patch " Andrew Morton 2020-06-27 3:33 ` Andrew Morton 2020-06-27 3:33 ` [merged] ocfs2-fix-value-of-ocfs2_invalid_slot.patch " Andrew Morton 2020-06-27 3:33 ` [merged] lib-fix-test_hmmc-reference-after-free.patch " Andrew Morton 2020-06-27 3:33 ` [merged] mm-slab-fix-sign-conversion-problem-in-memcg_uncharge_slab.patch " Andrew Morton 2020-06-27 3:33 ` [merged] mm-slab-use-memzero_explicit-in-kzfree.patch " Andrew Morton 2020-06-27 3:33 ` [merged] slub-cure-list_slab_objects-from-double-fix.patch " Andrew Morton 2020-06-27 3:33 ` [merged] mm-fix-swap-cache-node-allocation-mask.patch " Andrew Morton 2020-06-27 3:33 ` Andrew Morton 2020-06-27 3:33 ` [merged] mm-memoryc-properly-pte_offset_map_lock-unlock-in-vm_insert_pages.patch " Andrew Morton 2020-06-27 3:33 ` [merged] mm-debug_vm_pgtable-fix-build-failure-with-powerpc-8xx.patch " Andrew Morton 2020-06-27 3:33 ` [merged] make-asm-generic-cacheflushh-more-standalone.patch " Andrew Morton 2020-06-27 3:33 ` [merged] media-omap3isp-remove-cacheflushh.patch " Andrew Morton 2020-06-27 3:33 ` [merged] mm-fix-a-warning-while-make-xmldocs.patch " Andrew Morton 2020-06-27 3:33 ` Andrew Morton [this message] 2020-06-27 3:33 ` [merged] mm-memcontrol-handle-div0-crash-race-condition-in-memorylow.patch " Andrew Morton 2020-06-27 3:33 ` [merged] mm-memcontrol-fix-do-not-put-the-css-reference.patch " Andrew Morton 2020-06-27 3:33 ` [merged] mm-memcg-prevent-missed-memorylow-load-tears.patch " Andrew Morton 2020-06-27 3:33 ` [merged] docs-mm-gup-minor-documentation-update.patch " Andrew Morton 2020-06-27 3:33 ` [merged] doc-thp-cow-fault-no-longer-allocate-thp.patch " Andrew Morton 2020-06-27 3:33 ` [merged] mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch " Andrew Morton 2020-06-27 3:34 ` [merged] mm-swap-fix-for-mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch " Andrew Morton 2020-06-27 3:34 ` [merged] mm-memory-fix-io-cost-for-anonymous-page.patch " Andrew Morton 2020-06-27 3:34 ` [merged] x86-hyperv-allocate-the-hypercall-page-with-only-read-and-execute-bits.patch " Andrew Morton 2020-06-27 3:34 ` [merged] arm64-use-page_kernel_rox-directly-in-alloc_insn_page.patch " Andrew Morton 2020-06-27 3:34 ` [merged] mm-remove-vmalloc_exec.patch " Andrew Morton 2020-06-27 3:34 ` [merged] mm-fix-false-softlockup-during-pfn-range-removal.patch " Andrew Morton 2020-06-27 3:34 ` [merged] maintainers-update-info-for-sparse.patch " Andrew Morton
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200627033346.uM9eRcQFS%akpm@linux-foundation.org \ --to=akpm@linux-foundation.org \ --cc=chris@chrisdown.name \ --cc=guro@fb.com \ --cc=hannes@cmpxchg.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mhocko@suse.com \ --cc=mm-commits@vger.kernel.org \ --cc=stable@vger.kernel.org \ --cc=tj@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.