From: Vlastimil Babka <firstname.lastname@example.org> To: Hugh Dickins <email@example.com>, Mel Gorman <firstname.lastname@example.org> Cc: Andrew Morton <email@example.com>, Li Wang <firstname.lastname@example.org>, Alex Shi <email@example.com>, firstname.lastname@example.org, email@example.com Subject: Re: [PATCH] mm, page_alloc: capture page in task context only Date: Fri, 12 Jun 2020 12:30:53 +0200 [thread overview] Message-ID: <firstname.lastname@example.org> (raw) In-Reply-To: <alpine.LSU.email@example.com> On 6/10/20 10:48 PM, Hugh Dickins wrote: > While stressing compaction, one run oopsed on NULL capc->cc in > __free_one_page()'s task_capc(zone): compact_zone_order() had been > interrupted, and a page was being freed in the return from interrupt. > > Though you would not expect it from the source, both gccs I was using > (a 4.8.1 and a 7.5.0) had chosen to compile compact_zone_order() with > the ".cc = &cc" implemented by mov %rbx,-0xb0(%rbp) immediately before > callq compact_zone - long after the "current->capture_control = &capc". > An interrupt in between those finds capc->cc NULL (zeroed by an earlier > rep stos). Ugh, nasty. Same here with gcc 10. > This could presumably be fixed by a barrier() before setting > current->capture_control in compact_zone_order(); but would also need > more care on return from compact_zone(), in order not to risk leaking > a page captured by interrupt just before capture_control is reset. I was hoping a WRITE_ONCE(current->capture_control) would be enough, but apparently it's not (I tried). > Maybe that is the preferable fix, but I felt safer for task_capc() to > exclude the rather surprising possibility of capture at interrupt time. > Fixes: 5e1f0f098b46 ("mm, compaction: capture a page under direct compaction") > Cc: firstname.lastname@example.org # 5.1+ > Signed-off-by: Hugh Dickins <email@example.com> Acked-by: Vlastimil Babka <firstname.lastname@example.org> But perhaps I would also make sure that we don't expose the half initialized capture_control and run into this problem again later. It's not like this is a fast path where barriers hurt. Something like this then? (with added comments) diff --git a/mm/compaction.c b/mm/compaction.c index fd988b7e5f2b..c89e26817278 100644 --- a/mm/compaction.c +++ b/mm/compaction.c @@ -2316,15 +2316,17 @@ static enum compact_result compact_zone_order(struct zone *zone, int order, .page = NULL, }; - current->capture_control = &capc; + barrier(); + + WRITE_ONCE(current->capture_control, &capc); ret = compact_zone(&cc, &capc); VM_BUG_ON(!list_empty(&cc.freepages)); VM_BUG_ON(!list_empty(&cc.migratepages)); - *capture = capc.page; - current->capture_control = NULL; + WRITE_ONCE(current->capture_control, NULL); + *capture = READ_ONCE(capc.page); return ret; }
next prev parent reply other threads:[~2020-06-12 10:30 UTC|newest] Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-06-10 20:48 Hugh Dickins 2020-06-11 15:43 ` Mel Gorman 2020-06-12 10:30 ` Vlastimil Babka [this message] 2020-06-15 21:03 ` Hugh Dickins 2020-06-16 7:45 ` Vlastimil Babka 2020-06-16 8:26 ` [PATCH 1/2] mm, compaction: make capture control handling safe wrt interrupts Vlastimil Babka 2020-06-16 8:26 ` [PATCH 2/2] mm, page_alloc: use unlikely() in task_capc() Vlastimil Babka 2020-06-16 20:29 ` Hugh Dickins 2020-06-17 9:55 ` Vlastimil Babka 2020-06-22 8:58 ` Mel Gorman 2020-06-16 20:18 ` [PATCH 1/2] mm, compaction: make capture control handling safe wrt interrupts Hugh Dickins
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --subject='Re: [PATCH] mm, page_alloc: capture page in task context only' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).