All of lore.kernel.org
 help / color / mirror / Atom feed
From: Vlastimil Babka <vbabka@suse.cz>
To: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>,
	Andrew Morton <akpm@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org,
	Minchan Kim <minchan@kernel.org>,
	David Rientjes <rientjes@google.com>,
	Mel Gorman <mgorman@techsingularity.net>
Subject: Re: [PATCH] mm/compaction: avoid VM_BUG_ON(PageSlab()) in page_mapcount()
Date: Wed, 13 May 2020 23:35:26 +0200	[thread overview]
Message-ID: <88698909-22b8-79fa-c11f-3931c41cb20b@suse.cz> (raw)
In-Reply-To: <9420f90c-e423-475c-4b79-8287b76149d9@yandex-team.ru>

On 5/13/20 9:28 PM, Konstantin Khlebnikov wrote:
> On 13/05/2020 21.32, Andrew Morton wrote:
>> On Wed, 13 May 2020 17:05:25 +0300 Konstantin Khlebnikov <khlebnikov@yandex-team.ru> wrote:
>> 
>>> Function isolate_migratepages_block() runs some checks out of lru_lock
>>> when choose pages for migration. After checking PageLRU() it checks extra
>>> page references by comparing page_count() and page_mapcount(). Between
>>> these two checks page could be removed from lru, freed and taken by slab.
>>>
>>> As a result this race triggers VM_BUG_ON(PageSlab()) in page_mapcount().
>>> Race window is tiny. For certain workload this happens around once a year.
>>>
>>>
>>>   page:ffffea0105ca9380 count:1 mapcount:0 mapping:ffff88ff7712c180 index:0x0 compound_mapcount: 0
>>>   flags: 0x500000000008100(slab|head)
>>>   raw: 0500000000008100 dead000000000100 dead000000000200 ffff88ff7712c180
>>>   raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
>>>   page dumped because: VM_BUG_ON_PAGE(PageSlab(page))
>>>   ------------[ cut here ]------------
>>>   kernel BUG at ./include/linux/mm.h:628!
>>>   invalid opcode: 0000 [#1] SMP NOPTI
>>>   CPU: 77 PID: 504 Comm: kcompactd1 Tainted: G        W         4.19.109-27 #1
>>>   Hardware name: Yandex T175-N41-Y3N/MY81-EX0-Y3N, BIOS R05 06/20/2019
>>>   RIP: 0010:isolate_migratepages_block+0x986/0x9b0
>>>
>>>
>>> To fix just opencode page_mapcount() in racy check for 0-order case and
>>> recheck carefully under lru_lock when page cannot escape from lru.
>>>
>>> Also add checking extra references for file pages and swap cache.
>> 
>> It sounds like a cc:stable is appropriate?
> 
> Yep, but probably I'm missing something.
> 
> It seems bug is there for a long time and nobody seen it.
> Am I the only one using COONFIG_DEBUG_VM=y everywhere? =)

Unless things changed, Fedora kernels had it enabled, AFAIK

  reply	other threads:[~2020-05-13 21:35 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-13 14:05 [PATCH] mm/compaction: avoid VM_BUG_ON(PageSlab()) in page_mapcount() Konstantin Khlebnikov
2020-05-13 18:32 ` Andrew Morton
2020-05-13 19:28   ` Konstantin Khlebnikov
2020-05-13 21:35     ` Vlastimil Babka [this message]
2020-05-23  1:34 ` Andrew Morton
2020-05-23 13:55   ` Konstantin Khlebnikov
2020-05-23 13:55     ` Konstantin Khlebnikov
2020-05-24  1:01 ` Hugh Dickins
2020-05-24  1:01   ` Hugh Dickins
2020-05-24 11:21   ` Konstantin Khlebnikov
2020-05-24 19:12     ` Hugh Dickins
2020-05-24 19:12       ` Hugh Dickins
2020-06-02  4:05   ` Hugh Dickins
2020-06-02  4:05     ` Hugh Dickins
2020-06-02  4:13     ` Andrew Morton
2020-06-02 11:28     ` Alex Shi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=88698909-22b8-79fa-c11f-3931c41cb20b@suse.cz \
    --to=vbabka@suse.cz \
    --cc=akpm@linux-foundation.org \
    --cc=khlebnikov@yandex-team.ru \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=mgorman@techsingularity.net \
    --cc=minchan@kernel.org \
    --cc=rientjes@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.