* [RFC PATCH 0/1] "Bad page state" while freeing gigantic pages
@ 2020-12-08 18:28 Gerald Schaefer
2020-12-08 18:28 ` [RFC PATCH 1/1] mm/hugetlb: clear compound_nr before " Gerald Schaefer
2020-12-08 18:35 ` [RFC PATCH 0/1] "Bad page state" while " Christian Borntraeger
0 siblings, 2 replies; 4+ messages in thread
From: Gerald Schaefer @ 2020-12-08 18:28 UTC (permalink / raw)
To: Matthew Wilcox, Mike Kravetz
Cc: Andrew Morton, LKML, linux-mm, Christian Borntraeger, Heiko Carstens
The following "Bad page state" occurs on s390 when freeing gigantic pages:
[ 276.681603] BUG: Bad page state in process bash pfn:380001
[ 276.681614] page:00000000c35f0856 refcount:0 mapcount:0 mapping:00000000126b68aa index:0x0 pfn:0x380001
[ 276.681620] aops:0x0
[ 276.681622] flags: 0x3ffff00000000000()
[ 276.681626] raw: 3ffff00000000000 0000000000000100 0000000000000122 0000000100000000
[ 276.681628] raw: 0000000000000000 0000000000000000 ffffffff00000000 0000000000000000
[ 276.681630] page dumped because: non-NULL mapping
[ 276.681632] Modules linked in:
[ 276.681637] CPU: 6 PID: 616 Comm: bash Not tainted 5.10.0-rc7-next-20201208 #1
[ 276.681639] Hardware name: IBM 3906 M03 703 (LPAR)
[ 276.681641] Call Trace:
[ 276.681648] [<0000000458c252b6>] show_stack+0x6e/0xe8
[ 276.681652] [<000000045971cf60>] dump_stack+0x90/0xc8
[ 276.681656] [<0000000458e8b186>] bad_page+0xd6/0x130
[ 276.681658] [<0000000458e8cdea>] free_pcppages_bulk+0x26a/0x800
[ 276.681661] [<0000000458e8e67e>] free_unref_page+0x6e/0x90
[ 276.681663] [<0000000458e8ea6c>] free_contig_range+0x94/0xe8
[ 276.681666] [<0000000458ea5e54>] update_and_free_page+0x1c4/0x2c8
[ 276.681669] [<0000000458ea784e>] free_pool_huge_page+0x11e/0x138
[ 276.681671] [<0000000458ea8530>] set_max_huge_pages+0x228/0x300
[ 276.681673] [<0000000458ea86c0>] nr_hugepages_store_common+0xb8/0x130
[ 276.681678] [<0000000458fd5b6a>] kernfs_fop_write+0xd2/0x218
[ 276.681681] [<0000000458ef9da0>] vfs_write+0xb0/0x2b8
[ 276.681684] [<0000000458efa15c>] ksys_write+0xac/0xe0
[ 276.681687] [<000000045972c5ca>] system_call+0xe6/0x288
[ 276.681730] Disabling lock debugging due to kernel taint
I bisected it to commit 1378a5ee451a ("mm: store compound_nr as well as
compound_order"), and it seems that the new compound_nr overlaying
page->mapping is not properly cleared, which then triggers the non-NULL
mapping warning.
This is because only the compound_order is cleared in
destroy_compound_gigantic_page(), and compound_nr is set to 1U << order == 1
for order 0 in set_compound_order(page, 0).
For some reason, I can not reproduce this on x86, but I do not see where
this could be an arch-sepcific issue. Still, I might be missing something,
and my proposed patch also looks a bit ugly (at least to me), hence this
RFC. Any comments?
BTW, for "normal sized" hugepages, this is not an issue, as page->mapping
seems to be cleared explicitly in this case, in free_tail_pages_check(),
but the freeing path for normal hugepages is quite different from that for
gigantic pages using free_contig_range(). So a "page[1].mapping = NULL"
might also be an option, instead of the "page[1].compound_nr = 0" in my
patch, but that looks even more ugly, since it would clear more than
needed.
Gerald Schaefer (1):
mm/hugetlb: clear compound_nr before freeing gigantic pages
mm/hugetlb.c | 1 +
1 file changed, 1 insertion(+)
--
2.17.1
^ permalink raw reply [flat|nested] 4+ messages in thread
* [RFC PATCH 1/1] mm/hugetlb: clear compound_nr before freeing gigantic pages
2020-12-08 18:28 [RFC PATCH 0/1] "Bad page state" while freeing gigantic pages Gerald Schaefer
@ 2020-12-08 18:28 ` Gerald Schaefer
2020-12-08 18:55 ` Matthew Wilcox
2020-12-08 18:35 ` [RFC PATCH 0/1] "Bad page state" while " Christian Borntraeger
1 sibling, 1 reply; 4+ messages in thread
From: Gerald Schaefer @ 2020-12-08 18:28 UTC (permalink / raw)
To: Matthew Wilcox, Mike Kravetz
Cc: Andrew Morton, LKML, linux-mm, Christian Borntraeger, Heiko Carstens
Commit 1378a5ee451a ("mm: store compound_nr as well as compound_order")
added compound_nr counter to first tail struct page, overlaying with
page->mapping. The overlay itself is fine, but while freeing gigantic
hugepages via free_contig_range(), a "bad page" check will trigger for
non-NULL page->mapping on the first tail page:
[ 276.681603] BUG: Bad page state in process bash pfn:380001
[ 276.681614] page:00000000c35f0856 refcount:0 mapcount:0 mapping:00000000126b68aa index:0x0 pfn:0x380001
[ 276.681620] aops:0x0
[ 276.681622] flags: 0x3ffff00000000000()
[ 276.681626] raw: 3ffff00000000000 0000000000000100 0000000000000122 0000000100000000
[ 276.681628] raw: 0000000000000000 0000000000000000 ffffffff00000000 0000000000000000
[ 276.681630] page dumped because: non-NULL mapping
[ 276.681632] Modules linked in:
[ 276.681637] CPU: 6 PID: 616 Comm: bash Not tainted 5.10.0-rc7-next-20201208 #1
[ 276.681639] Hardware name: IBM 3906 M03 703 (LPAR)
[ 276.681641] Call Trace:
[ 276.681648] [<0000000458c252b6>] show_stack+0x6e/0xe8
[ 276.681652] [<000000045971cf60>] dump_stack+0x90/0xc8
[ 276.681656] [<0000000458e8b186>] bad_page+0xd6/0x130
[ 276.681658] [<0000000458e8cdea>] free_pcppages_bulk+0x26a/0x800
[ 276.681661] [<0000000458e8e67e>] free_unref_page+0x6e/0x90
[ 276.681663] [<0000000458e8ea6c>] free_contig_range+0x94/0xe8
[ 276.681666] [<0000000458ea5e54>] update_and_free_page+0x1c4/0x2c8
[ 276.681669] [<0000000458ea784e>] free_pool_huge_page+0x11e/0x138
[ 276.681671] [<0000000458ea8530>] set_max_huge_pages+0x228/0x300
[ 276.681673] [<0000000458ea86c0>] nr_hugepages_store_common+0xb8/0x130
[ 276.681678] [<0000000458fd5b6a>] kernfs_fop_write+0xd2/0x218
[ 276.681681] [<0000000458ef9da0>] vfs_write+0xb0/0x2b8
[ 276.681684] [<0000000458efa15c>] ksys_write+0xac/0xe0
[ 276.681687] [<000000045972c5ca>] system_call+0xe6/0x288
[ 276.681730] Disabling lock debugging due to kernel taint
This is because only the compound_order is cleared in
destroy_compound_gigantic_page(), and compound_nr is set to 1U << order == 1
for order 0 in set_compound_order(page, 0).
Fix this by explicitly clearing compound_nr for first tail page after calling
set_compound_order(page, 0).
Cc: <stable@vger.kernel.org> # 5.9+
Fixes: 1378a5ee451a ("mm: store compound_nr as well as compound_order")
Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
---
mm/hugetlb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 1f3bf1710b66..3bcc0bc7e02a 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1216,6 +1216,7 @@ static void destroy_compound_gigantic_page(struct page *page,
}
set_compound_order(page, 0);
+ page[1].compound_nr = 0;
__ClearPageHead(page);
}
--
2.17.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [RFC PATCH 0/1] "Bad page state" while freeing gigantic pages
2020-12-08 18:28 [RFC PATCH 0/1] "Bad page state" while freeing gigantic pages Gerald Schaefer
2020-12-08 18:28 ` [RFC PATCH 1/1] mm/hugetlb: clear compound_nr before " Gerald Schaefer
@ 2020-12-08 18:35 ` Christian Borntraeger
1 sibling, 0 replies; 4+ messages in thread
From: Christian Borntraeger @ 2020-12-08 18:35 UTC (permalink / raw)
To: Gerald Schaefer, Matthew Wilcox, Mike Kravetz
Cc: Andrew Morton, LKML, linux-mm, Heiko Carstens
On 08.12.20 19:28, Gerald Schaefer wrote:
> The following "Bad page state" occurs on s390 when freeing gigantic pages:
>
> [ 276.681603] BUG: Bad page state in process bash pfn:380001
> [ 276.681614] page:00000000c35f0856 refcount:0 mapcount:0 mapping:00000000126b68aa index:0x0 pfn:0x380001
> [ 276.681620] aops:0x0
> [ 276.681622] flags: 0x3ffff00000000000()
> [ 276.681626] raw: 3ffff00000000000 0000000000000100 0000000000000122 0000000100000000
> [ 276.681628] raw: 0000000000000000 0000000000000000 ffffffff00000000 0000000000000000
> [ 276.681630] page dumped because: non-NULL mapping
> [ 276.681632] Modules linked in:
> [ 276.681637] CPU: 6 PID: 616 Comm: bash Not tainted 5.10.0-rc7-next-20201208 #1
> [ 276.681639] Hardware name: IBM 3906 M03 703 (LPAR)
> [ 276.681641] Call Trace:
> [ 276.681648] [<0000000458c252b6>] show_stack+0x6e/0xe8
> [ 276.681652] [<000000045971cf60>] dump_stack+0x90/0xc8
> [ 276.681656] [<0000000458e8b186>] bad_page+0xd6/0x130
> [ 276.681658] [<0000000458e8cdea>] free_pcppages_bulk+0x26a/0x800
> [ 276.681661] [<0000000458e8e67e>] free_unref_page+0x6e/0x90
> [ 276.681663] [<0000000458e8ea6c>] free_contig_range+0x94/0xe8
> [ 276.681666] [<0000000458ea5e54>] update_and_free_page+0x1c4/0x2c8
> [ 276.681669] [<0000000458ea784e>] free_pool_huge_page+0x11e/0x138
> [ 276.681671] [<0000000458ea8530>] set_max_huge_pages+0x228/0x300
> [ 276.681673] [<0000000458ea86c0>] nr_hugepages_store_common+0xb8/0x130
> [ 276.681678] [<0000000458fd5b6a>] kernfs_fop_write+0xd2/0x218
> [ 276.681681] [<0000000458ef9da0>] vfs_write+0xb0/0x2b8
> [ 276.681684] [<0000000458efa15c>] ksys_write+0xac/0xe0
> [ 276.681687] [<000000045972c5ca>] system_call+0xe6/0x288
> [ 276.681730] Disabling lock debugging due to kernel taint
>
> I bisected it to commit 1378a5ee451a ("mm: store compound_nr as well as
> compound_order"), and it seems that the new compound_nr overlaying
> page->mapping is not properly cleared, which then triggers the non-NULL
> mapping warning.
>
> This is because only the compound_order is cleared in
> destroy_compound_gigantic_page(), and compound_nr is set to 1U << order == 1
> for order 0 in set_compound_order(page, 0).
>
> For some reason, I can not reproduce this on x86, but I do not see where
> this could be an arch-sepcific issue. Still, I might be missing something,
> and my proposed patch also looks a bit ugly (at least to me), hence this
> RFC. Any comments?
>
> BTW, for "normal sized" hugepages, this is not an issue, as page->mapping
> seems to be cleared explicitly in this case, in free_tail_pages_check(),
> but the freeing path for normal hugepages is quite different from that for
> gigantic pages using free_contig_range(). So a "page[1].mapping = NULL"
> might also be an option, instead of the "page[1].compound_nr = 0" in my
> patch, but that looks even more ugly, since it would clear more than
> needed.
>
> Gerald Schaefer (1):
> mm/hugetlb: clear compound_nr before freeing gigantic pages
>
> mm/hugetlb.c | 1 +
> 1 file changed, 1 insertion(+)
I cant see the patch?
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [RFC PATCH 1/1] mm/hugetlb: clear compound_nr before freeing gigantic pages
2020-12-08 18:28 ` [RFC PATCH 1/1] mm/hugetlb: clear compound_nr before " Gerald Schaefer
@ 2020-12-08 18:55 ` Matthew Wilcox
0 siblings, 0 replies; 4+ messages in thread
From: Matthew Wilcox @ 2020-12-08 18:55 UTC (permalink / raw)
To: Gerald Schaefer
Cc: Mike Kravetz, Andrew Morton, LKML, linux-mm,
Christian Borntraeger, Heiko Carstens
On Tue, Dec 08, 2020 at 07:28:13PM +0100, Gerald Schaefer wrote:
> This is because only the compound_order is cleared in
> destroy_compound_gigantic_page(), and compound_nr is set to 1U << order == 1
> for order 0 in set_compound_order(page, 0).
I didn't realise there was a separate destroy path for gigantic pages.
Thanks for catching and fixing this.
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-12-08 18:55 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-12-08 18:28 [RFC PATCH 0/1] "Bad page state" while freeing gigantic pages Gerald Schaefer
2020-12-08 18:28 ` [RFC PATCH 1/1] mm/hugetlb: clear compound_nr before " Gerald Schaefer
2020-12-08 18:55 ` Matthew Wilcox
2020-12-08 18:35 ` [RFC PATCH 0/1] "Bad page state" while " Christian Borntraeger
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).