From: "Kirill A. Shutemov" <kirill@shutemov.name>
To: Artem Savkov <artem.savkov@gmail.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
Andrew Morton <akpm@linux-foundation.org>,
Andrea Arcangeli <aarcange@redhat.com>,
Hugh Dickins <hughd@google.com>,
Dave Hansen <dave.hansen@intel.com>, Mel Gorman <mgorman@suse.de>,
Rik van Riel <riel@redhat.com>, Vlastimil Babka <vbabka@suse.cz>,
Christoph Lameter <cl@gentwo.org>,
Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>,
Steve Capper <steve.capper@linaro.org>,
"Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>,
Johannes Weiner <hannes@cmpxchg.org>,
Michal Hocko <mhocko@suse.cz>,
Jerome Marchand <jmarchan@redhat.com>,
Sasha Levin <sasha.levin@oracle.com>,
linux-kernel@vger.kernel.org, linux-mm@kvack.org
Subject: Re: [PATCHv12 14/37] futex, thp: remove special case for THP in get_futex_key
Date: Thu, 22 Oct 2015 12:49:45 +0300 [thread overview]
Message-ID: <20151022094945.GE10597@node.shutemov.name> (raw)
In-Reply-To: <20151022082433.GA29487@littlebeast.usersys.redhat.com>
On Thu, Oct 22, 2015 at 10:24:33AM +0200, Artem Savkov wrote:
> On Tue, Oct 06, 2015 at 06:23:41PM +0300, Kirill A. Shutemov wrote:
> > With new THP refcounting, we don't need tricks to stabilize huge page.
> > If we've got reference to tail page, it can't split under us.
> >
> > This patch effectively reverts a5b338f2b0b1.
> >
> > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> > Tested-by: Sasha Levin <sasha.levin@oracle.com>
> > Tested-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> > Acked-by: Jerome Marchand <jmarchan@redhat.com>
> > ---
> > kernel/futex.c | 61 ++++++++++++----------------------------------------------
> > 1 file changed, 12 insertions(+), 49 deletions(-)
>
> This patch breaks compound page futexes with the following panic:
>
> [ 33.465456] general protection fault: 0000 [#1] SMP
> [ 33.465991] CPU: 1 PID: 523 Comm: tst Not tainted 4.3.0-rc6-next-20151022 #139
> [ 33.466585] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153950- 04/01/2014
> [ 33.467370] task: ffff88007bf13a80 ti: ffff88006bdac000 task.ti: ffff88006bdac000
> [ 33.467960] RIP: 0010:[<ffffffff81132b3a>] [<ffffffff81132b3a>] get_futex_key+0x2ba/0x410
> [ 33.468332] RSP: 0018:ffff88006bdafc18 EFLAGS: 00010202
> [ 33.468332] RAX: dead000000000000 RBX: ffffea0001a50040 RCX: 0000000000000001
> [ 33.468332] RDX: ffffea0001a50001 RSI: 0000000000000000 RDI: ffffea0001a50040
> [ 33.468332] RBP: ffff88006bdafc58 R08: 0000000000000000 R09: 0000000000000000
> [ 33.468332] R10: 0000000000000000 R11: 0000000000000001 R12: 00007f4983601000
> [ 33.468332] R13: 0000000000000001 R14: ffff88006bdafd70 R15: 0000000000000000
> [ 33.468332] FS: 00007f4983fa4700(0000) GS:ffff88007fd00000(0000) knlGS:0000000000000000
> [ 33.468332] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [ 33.468332] CR2: 00007f4983601000 CR3: 000000007becb000 CR4: 00000000000006a0
> [ 33.468332] Stack:
> [ 33.468332] ffff88006bf2ed00 00000000831169c0 ffffea0001a50040 00007f4983601000
> [ 33.468332] ffff88006bdafce8 ffff88006bdafd38 ffff88006bdafd70 ffff88007bf13a80
> [ 33.468332] ffff88006bdafcb0 ffffffff8113329a ffff88006bdafd80 0000000000000000
> [ 33.468332] Call Trace:
> [ 33.468332] [<ffffffff8113329a>] futex_wait_setup+0x4a/0x1d0
> [ 33.468332] [<ffffffff81133540>] futex_wait+0x120/0x330
> [ 33.468332] [<ffffffff8111def0>] ? enqueue_hrtimer+0x50/0x50
> [ 33.468332] [<ffffffff8113587e>] do_futex+0x11e/0x1050
> [ 33.468332] [<ffffffff810e9825>] ? __lock_acquire+0x8c5/0x2830
> [ 33.468332] [<ffffffff8105da35>] ? kvm_clock_read+0x35/0x50
> [ 33.468332] [<ffffffff8105da91>] ? kvm_clock_get_cycles+0x11/0x20
> [ 33.468332] [<ffffffff81136860>] SyS_futex+0xb0/0x240
> [ 33.468332] [<ffffffff81cc3db2>] entry_SYSCALL_64_fastpath+0x12/0x76
> [ 33.468332] Code: 48 83 05 c9 e2 54 02 01 e9 56 ff ff ff 48 8b 57 20 f6 c2 01 0f 85 43 01 00 00 a8 01 0f 85 d2 00 00 00 41 83 4e 10 01 48 8b 47 08 <48> 8b 10 49 89 56 08 48 8b 07 f6 c4 40 0f 84 82 00 00 00 48 83
> [ 33.468332] RIP [<ffffffff81132b3a>] get_futex_key+0x2ba/0x410
> [ 33.468332] RSP <ffff88006bdafc18>
> [ 33.483135] ---[ end trace 537578e223c13ed1 ]---
> [ 33.483502] Kernel panic - not syncing: Fatal exception
> [ 33.484020] Kernel Offset: disabled
> [ 33.484313] ---[ end Kernel panic - not syncing: Fatal exception
>
> This can be triggered with the following reproducer (based on
> futex_wake04 test from ltp):
>
> #include <errno.h>
> #include <stdio.h>
> #include <stdint.h>
> #include <unistd.h>
> #include <linux/futex.h>
> #include <sys/mman.h>
> #include <sys/syscall.h>
> #include <sys/time.h>
>
> #define HPGSZ 2097152
> int main(int argc, char **argv) {
> long ret = 0;
> void *addr;
> uint32_t *futex;
> int pgsz = getpagesize();
>
> addr = mmap(NULL, HPGSZ, PROT_WRITE | PROT_READ,
> MAP_SHARED | MAP_ANONYMOUS | MAP_HUGETLB, -1, 0);
> if (addr == MAP_FAILED) {
> fprintf(stderr, "Failed to alloc hugepage\n");
> return -1;
> }
>
> futex = (uint32_t *)((char *)addr + pgsz);
> *futex = 0;
>
> ret = syscall(SYS_futex, futex, FUTEX_WAIT, *futex, NULL, NULL, 0);
> if (ret < 0) {
> perror("Syscall failed");
> }
>
> munmap(addr, HPGSZ);
>
> return 0;
> }
Thanks for report. Patch below fixes the issue for me.
Could you test it as well?
diff --git a/kernel/futex.c b/kernel/futex.c
index 470c06c3299a..b29add22c454 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -470,6 +470,7 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
unsigned long address = (unsigned long)uaddr;
struct mm_struct *mm = current->mm;
struct page *page;
+ struct address_space *mapping;
int err, ro = 0;
/*
@@ -535,7 +536,8 @@ again:
* shmem_writepage move it from filecache to swapcache beneath us:
* an unlikely race, but we do need to retry for page->mapping.
*/
- if (!page->mapping) {
+ mapping = compound_head(page)->mapping;
+ if (!mapping) {
int shmem_swizzled = PageSwapCache(page);
unlock_page(page);
put_page(page);
@@ -566,7 +568,7 @@ again:
key->private.address = address;
} else {
key->both.offset |= FUT_OFF_INODE; /* inode-based key */
- key->shared.inode = page->mapping->host;
+ key->shared.inode = mapping->host;
key->shared.pgoff = basepage_index(page);
}
--
Kirill A. Shutemov
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2015-10-22 9:49 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-10-06 15:23 [PATCHv12 00/37] THP refcounting redesign Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 01/37] mm, proc: adjust PSS calculation Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 02/37] rmap: add argument to charge compound page Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 03/37] memcg: adjust to support new THP refcounting Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 04/37] mm, thp: adjust conditions when we can reuse the page on WP fault Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 05/37] mm: adjust FOLL_SPLIT for new refcounting Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 06/37] mm: handle PTE-mapped tail pages in gerneric fast gup implementaiton Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 07/37] thp, mlock: do not allow huge pages in mlocked area Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 08/37] khugepaged: ignore pmd tables with THP mapped with ptes Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 09/37] thp: rename split_huge_page_pmd() to split_huge_pmd() Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 10/37] mm, vmstats: new THP splitting event Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 11/37] mm: temporally mark THP broken Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 12/37] thp: drop all split_huge_page()-related code Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 13/37] mm: drop tail page refcounting Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 14/37] futex, thp: remove special case for THP in get_futex_key Kirill A. Shutemov
2015-10-22 8:24 ` Artem Savkov
2015-10-22 9:49 ` Kirill A. Shutemov [this message]
2015-10-22 10:33 ` Artem Savkov
2015-10-06 15:23 ` [PATCHv12 15/37] ksm: prepare to new THP semantics Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 16/37] mm, thp: remove compound_lock Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 17/37] arm64, thp: remove infrastructure for handling splitting PMDs Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 18/37] arm, " Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 19/37] mips, " Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 20/37] powerpc, " Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 21/37] s390, " Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 22/37] sparc, " Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 23/37] tile, " Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 24/37] x86, " Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 25/37] mm, " Kirill A. Shutemov
2015-10-08 8:52 ` Vineet Gupta
2015-10-09 9:25 ` Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 26/37] mm: rework mapcount accounting to enable 4k mapping of THPs Kirill A. Shutemov
2015-10-27 6:18 ` Naoya Horiguchi
2015-10-27 9:30 ` Kirill A. Shutemov
2015-10-27 23:24 ` Naoya Horiguchi
2015-10-29 21:50 ` Kirill A. Shutemov
2015-10-30 8:33 ` Naoya Horiguchi
2015-10-29 8:19 ` Naoya Horiguchi
2015-10-29 21:20 ` Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 27/37] mm: differentiate page_mapped() from page_mapcount() for compound pages Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 28/37] mm, numa: skip PTE-mapped THP on numa fault Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 29/37] thp: implement split_huge_pmd() Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 30/37] thp: add option to setup migration entries during PMD split Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 31/37] thp, mm: split_huge_page(): caller need to lock page Kirill A. Shutemov
2015-10-06 15:23 ` [PATCHv12 32/37] thp: reintroduce split_huge_page() Kirill A. Shutemov
2015-11-18 16:24 ` Sasha Levin
2015-11-18 19:05 ` Kirill A. Shutemov
2015-11-27 4:26 ` Sasha Levin
2015-10-06 15:24 ` [PATCHv12 33/37] migrate_pages: try to split pages on qeueuing Kirill A. Shutemov
2015-10-06 15:24 ` [PATCHv12 34/37] thp: introduce deferred_split_huge_page() Kirill A. Shutemov
2016-01-21 1:22 ` Andrea Arcangeli
2016-01-21 12:09 ` [PATCH 0/3] Couple of fixes for deferred_split_huge_page() Kirill A. Shutemov
2016-01-21 12:09 ` [PATCH 1/3] thp: make split_queue per-node Kirill A. Shutemov
2016-01-21 12:09 ` [PATCH 2/3] thp: change deferred_split_count() to return number of THP in queue Kirill A. Shutemov
2016-01-22 14:31 ` Andrea Arcangeli
2016-01-22 15:20 ` Kirill A. Shutemov
2016-01-21 12:09 ` [PATCH 3/3] thp: limit number of object to scan on deferred_split_scan() Kirill A. Shutemov
2016-02-04 13:11 ` Kirill A. Shutemov
2016-01-21 22:52 ` [PATCH 0/3] Couple of fixes for deferred_split_huge_page() Andrea Arcangeli
2015-10-06 15:24 ` [PATCHv12 35/37] mm: re-enable THP Kirill A. Shutemov
2015-10-06 15:24 ` [PATCHv12 36/37] thp: update documentation Kirill A. Shutemov
2015-10-06 15:24 ` [PATCHv12 37/37] thp: allow mlocked THP again Kirill A. Shutemov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20151022094945.GE10597@node.shutemov.name \
--to=kirill@shutemov.name \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=aneesh.kumar@linux.vnet.ibm.com \
--cc=artem.savkov@gmail.com \
--cc=cl@gentwo.org \
--cc=dave.hansen@intel.com \
--cc=hannes@cmpxchg.org \
--cc=hughd@google.com \
--cc=jmarchan@redhat.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mgorman@suse.de \
--cc=mhocko@suse.cz \
--cc=n-horiguchi@ah.jp.nec.com \
--cc=riel@redhat.com \
--cc=sasha.levin@oracle.com \
--cc=steve.capper@linaro.org \
--cc=vbabka@suse.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).