From: Mike Kravetz <mike.kravetz@oracle.com>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org,
Zi Yan <ziy@nvidia.com>, Davidlohr Bueso <dbueso@suse.de>,
"Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
Andrea Arcangeli <aarcange@redhat.com>,
Matthew Wilcox <willy@infradead.org>,
Oscar Salvador <osalvador@suse.de>,
Joao Martins <joao.m.martins@oracle.com>,
stable@vger.kernel.org
Subject: Re: [PATCH 1/2] hugetlb: fix update_and_free_page contig page struct assumption
Date: Wed, 17 Feb 2021 11:38:15 -0800 [thread overview]
Message-ID: <1da7b36c-f86a-90e9-cfa2-4ce49bd6f1d1@oracle.com> (raw)
In-Reply-To: <20210217110252.185c7f5cd5a87c3f7b0c0144@linux-foundation.org>
On 2/17/21 11:02 AM, Andrew Morton wrote:
> On Wed, 17 Feb 2021 10:49:25 -0800 Mike Kravetz <mike.kravetz@oracle.com> wrote:
>
>> page structs are not guaranteed to be contiguous for gigantic pages. The
>> routine update_and_free_page can encounter a gigantic page, yet it assumes
>> page structs are contiguous when setting page flags in subpages.
>>
>> If update_and_free_page encounters non-contiguous page structs, we can
>> see “BUG: Bad page state in process …” errors.
>>
>> Non-contiguous page structs are generally not an issue. However, they can
>> exist with a specific kernel configuration and hotplug operations. For
>> example: Configure the kernel with CONFIG_SPARSEMEM and
>> !CONFIG_SPARSEMEM_VMEMMAP. Then, hotplug add memory for the area where the
>> gigantic page will be allocated.
>> Zi Yan outlined steps to reproduce here [1].
>>
>> [1] https://lore.kernel.org/linux-mm/16F7C58B-4D79-41C5-9B64-A1A1628F4AF2@nvidia.com/
>>
>> Fixes: 944d9fec8d7a ("hugetlb: add support for gigantic page allocation at runtime")
>
> June 2014. That's a long lurk time for a bug. I wonder if some later
> commit revealed it.
>
> I guess it doesn't matter a lot, but some -stable kernel maintainers
> might wonder if they really need this fix...
I am not sure how common a CONFIG_SPARSEMEM and !CONFIG_SPARSEMEM_VMEMMAP
config is. On the more popular architectures, this is not the default.
But, you can build a kernel with such options. And, then you need to
hotplug memory add and allocate a gigantic page there.
It is unlikely to happen, but possible since Zi could force the BUG.
The copy_huge_page_from_user bug requires the same non-normal configuration
and is just as unlikely to occurr. But, since it can overwrite somewhat
random pages I would feel better if it was fixed.
--
Mike Kravetz
next prev parent reply other threads:[~2021-02-17 19:39 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-17 18:49 [PATCH 1/2] hugetlb: fix update_and_free_page contig page struct assumption Mike Kravetz
2021-02-17 18:49 ` [PATCH 2/2] hugetlb: fix copy_huge_page_from_user " Mike Kravetz
2021-02-17 19:02 ` [PATCH 1/2] hugetlb: fix update_and_free_page " Andrew Morton
2021-02-17 19:38 ` Mike Kravetz [this message]
2021-02-18 14:45 ` Matthew Wilcox
2021-02-18 17:25 ` Jason Gunthorpe
2021-02-18 17:27 ` Zi Yan
2021-02-18 17:32 ` Jason Gunthorpe
2021-02-18 17:40 ` Zi Yan
2021-02-18 17:51 ` Mike Kravetz
2021-02-18 18:50 ` Zi Yan
2021-02-18 17:34 ` Mike Kravetz
2021-02-18 21:43 ` Mike Kravetz
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1da7b36c-f86a-90e9-cfa2-4ce49bd6f1d1@oracle.com \
--to=mike.kravetz@oracle.com \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=dbueso@suse.de \
--cc=joao.m.martins@oracle.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=osalvador@suse.de \
--cc=stable@vger.kernel.org \
--cc=willy@infradead.org \
--cc=ziy@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).