* Re: [Qestion] Hit a WARN_ON_ONCE in try_to_unmap_one when runing syzkaller
[not found] <5C87D848.7030802@huawei.com>
@ 2019-03-14 6:27 ` Naoya Horiguchi
2019-03-14 7:54 ` zhong jiang
0 siblings, 1 reply; 2+ messages in thread
From: Naoya Horiguchi @ 2019-03-14 6:27 UTC (permalink / raw)
To: zhong jiang
Cc: Minchan Kim, LKML, Michal Hocko, Linux Memory Management List,
Vlastimil Babka, linux-arm-kernel
Hi,
On Wed, Mar 13, 2019 at 12:03:20AM +0800, zhong jiang wrote:
...
>
> Minchan has changed the conditon check from BUG_ON to WARN_ON_ONCE in try_to_unmap_one.
> However, It is still an abnormal condition when PageSwapBacked is not equal to PageSwapCache.
>
> But Is there any case it will meet the conditon in the mainline.
>
> It is assumed that PageSwapBacked(page) is true in the anonymous page, This is to say, PageSwapcache
> is false. however, That is impossible because we will update the pte for hwpoison entry.
>
> Because page is locked , Its page flags should not be changed except for PageSwapBacked
try_to_unmap_one() from hwpoison_user_mappings() could reach the
WARN_ON_ONCE() only if TTU_IGNORE_HWPOISON is set, because PageHWPoison()
is set at the beginning of memory_failure().
Clearing TTU_IGNORE_HWPOISON might happen on the following two paths:
static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
int flags, struct page **hpagep)
{
...
if (PageSwapCache(p)) {
pr_err("Memory failure: %#lx: keeping poisoned page in swap cache\n",
pfn);
ttu |= TTU_IGNORE_HWPOISON;
}
...
mapping = page_mapping(hpage);
if (!(flags & MF_MUST_KILL) && !PageDirty(hpage) && mapping &&
mapping_cap_writeback_dirty(mapping)) {
if (page_mkclean(hpage)) {
SetPageDirty(hpage);
} else {
kill = 0;
ttu |= TTU_IGNORE_HWPOISON;
pr_info("Memory failure: %#lx: corrupted page was clean: dropped without side effects\n",
pfn);
}
}
...
unmap_success = try_to_unmap(hpage, ttu);
...
So either of the above "ttu |= TTU_IGNORE_HWPOISON" should be executed.
I'm not sure which one, but both paths show printk messages, so if you
could have kernel message log, that might help ...
Thanks,
Naoya Horiguchi
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [Qestion] Hit a WARN_ON_ONCE in try_to_unmap_one when runing syzkaller
2019-03-14 6:27 ` [Qestion] Hit a WARN_ON_ONCE in try_to_unmap_one when runing syzkaller Naoya Horiguchi
@ 2019-03-14 7:54 ` zhong jiang
0 siblings, 0 replies; 2+ messages in thread
From: zhong jiang @ 2019-03-14 7:54 UTC (permalink / raw)
To: Naoya Horiguchi
Cc: Minchan Kim, Hugh Dickins, LKML, Michal Hocko,
Linux Memory Management List, Vlastimil Babka, linux-arm-kernel
On 2019/3/14 14:27, Naoya Horiguchi wrote:
> Hi,
>
> On Wed, Mar 13, 2019 at 12:03:20AM +0800, zhong jiang wrote:
> ...
>> Minchan has changed the conditon check from BUG_ON to WARN_ON_ONCE in try_to_unmap_one.
>> However, It is still an abnormal condition when PageSwapBacked is not equal to PageSwapCache.
>>
>> But Is there any case it will meet the conditon in the mainline.
>>
>> It is assumed that PageSwapBacked(page) is true in the anonymous page, This is to say, PageSwapcache
>> is false. however, That is impossible because we will update the pte for hwpoison entry.
>>
>> Because page is locked , Its page flags should not be changed except for PageSwapBacked
> try_to_unmap_one() from hwpoison_user_mappings() could reach the
> WARN_ON_ONCE() only if TTU_IGNORE_HWPOISON is set, because PageHWPoison()
> is set at the beginning of memory_failure().
>
> Clearing TTU_IGNORE_HWPOISON might happen on the following two paths:
>
> static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
> int flags, struct page **hpagep)
> {
> ...
>
> if (PageSwapCache(p)) {
> pr_err("Memory failure: %#lx: keeping poisoned page in swap cache\n",
> pfn);
> ttu |= TTU_IGNORE_HWPOISON;
> }
> ...
>
> mapping = page_mapping(hpage);
> if (!(flags & MF_MUST_KILL) && !PageDirty(hpage) && mapping &&
> mapping_cap_writeback_dirty(mapping)) {
> if (page_mkclean(hpage)) {
> SetPageDirty(hpage);
> } else {
> kill = 0;
> ttu |= TTU_IGNORE_HWPOISON;
> pr_info("Memory failure: %#lx: corrupted page was clean: dropped without side effects\n",
> pfn);
> }
> }
> ...
>
> unmap_success = try_to_unmap(hpage, ttu);
> ...
>
> So either of the above "ttu |= TTU_IGNORE_HWPOISON" should be executed.
> I'm not sure which one, but both paths show printk messages, so if you
> could have kernel message log, that might help ...
Thank you for your response.
Unfortunately, I lost the printk log. I was looking for it before and support us for further analysis.
It's very weird to get there. Assume that TTU_IGNORE_HWPOSISON is set. There is the two case.
First, PageSwapCache is set and page has been locked. Theoretically WARN_ON_ONCE should not be triggered.
Second, We should assume the page belongs to file page.:-(
I will go on reproducing the issue and get the printk message log.
Thanks
zhong jiang
> Thanks,
> Naoya Horiguchi
>
> .
>
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-03-14 7:54 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <5C87D848.7030802@huawei.com>
2019-03-14 6:27 ` [Qestion] Hit a WARN_ON_ONCE in try_to_unmap_one when runing syzkaller Naoya Horiguchi
2019-03-14 7:54 ` zhong jiang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).