From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933710AbcFQMZN (ORCPT ); Fri, 17 Jun 2016 08:25:13 -0400 Received: from mail-lf0-f66.google.com ([209.85.215.66]:36005 "EHLO mail-lf0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932412AbcFQMZK (ORCPT ); Fri, 17 Jun 2016 08:25:10 -0400 Date: Fri, 17 Jun 2016 15:25:06 +0300 From: "Kirill A. Shutemov" To: Mike Kravetz Cc: Michal Hocko , zhongjiang , akpm@linux-foundation.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] mm: fix account pmd page to the process Message-ID: <20160617122506.GC6534@node.shutemov.name> References: <1466076971-24609-1-git-send-email-zhongjiang@huawei.com> <20160616154214.GA12284@dhcp22.suse.cz> <20160616154324.GN6836@dhcp22.suse.cz> <71df66ac-df29-9542-bfa9-7c94f374df5b@oracle.com> <20160616163119.GP6836@dhcp22.suse.cz> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23.1 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jun 16, 2016 at 09:47:46AM -0700, Mike Kravetz wrote: > On 06/16/2016 09:31 AM, Michal Hocko wrote: > > On Thu 16-06-16 09:05:23, Mike Kravetz wrote: > >> On 06/16/2016 08:43 AM, Michal Hocko wrote: > >>> [It seems that this patch has been sent several times and this > >>> particular copy didn't add Kirill who has added this code CC him now] > >>> > >>> On Thu 16-06-16 17:42:14, Michal Hocko wrote: > >>>> On Thu 16-06-16 19:36:11, zhongjiang wrote: > >>>>> From: zhong jiang > >>>>> > >>>>> when a process acquire a pmd table shared by other process, we > >>>>> increase the account to current process. otherwise, a race result > >>>>> in other tasks have set the pud entry. so it no need to increase it. > >>>>> > >>>>> Signed-off-by: zhong jiang > >>>>> --- > >>>>> mm/hugetlb.c | 5 ++--- > >>>>> 1 file changed, 2 insertions(+), 3 deletions(-) > >>>>> > >>>>> diff --git a/mm/hugetlb.c b/mm/hugetlb.c > >>>>> index 19d0d08..3b025c5 100644 > >>>>> --- a/mm/hugetlb.c > >>>>> +++ b/mm/hugetlb.c > >>>>> @@ -4189,10 +4189,9 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) > >>>>> if (pud_none(*pud)) { > >>>>> pud_populate(mm, pud, > >>>>> (pmd_t *)((unsigned long)spte & PAGE_MASK)); > >>>>> - } else { > >>>>> + } else > >>>>> put_page(virt_to_page(spte)); > >>>>> - mm_inc_nr_pmds(mm); > >>>>> - } > >>>> > >>>> The code is quite puzzling but is this correct? Shouldn't we rather do > >>>> mm_dec_nr_pmds(mm) in that path to undo the previous inc? > >> > >> I agree that the code is quite puzzling. :( > >> > >> However, if this were an issue I would have expected to see some reports. > >> Oracle DB makes use of this feature (shared page tables) and if the pmd > >> count is wrong we would catch it in check_mm() at exit time. > >> > >> Upon closer examination, I believe the code in question is never executed. > >> Note the callers of huge_pmd_share. The calling code looks like: > >> > >> if (want_pmd_share() && pud_none(*pud)) > >> pte = huge_pmd_share(mm, addr, pud); > >> else > >> pte = (pte_t *)pmd_alloc(mm, pud, addr); > >> > >> Therefore, we do not call huge_pmd_share unless pud_none(*pud). The > >> code in question is only executed when !pud_none(*pud). > > > > My understanding is that the check is needed after we retake page lock > > because we might have raced with other thread. But it's been quite some > > time since I've looked at hugetlb locking and page table sharing code. > > That is correct, we could have raced. Duh! > > In the case of a race, the other thread would have incremented the > PMD count already. Your suggestion of decrementing pmd count in > this case seems to be the correct approach. But, I need to think > about this some more. Yes, I made mistake by increasing nr_pmds, not descreasing here. Testcase: #include #include #include #include #include #include #include #include #define HPGSZ 2097152UL int main(int argc, char **argv) { char *addr; system("echo 1024 > /proc/sys/vm/nr_hugepages"); addr = mmap(NULL, 1024*HPGSZ, PROT_WRITE | PROT_READ, MAP_SHARED | MAP_ANONYMOUS | MAP_HUGETLB | MAP_POPULATE, -1, 0); if (addr == MAP_FAILED) { fprintf(stderr, "Failed to alloc hugepage\n"); return -1; } addr[0] = 1; fork(); printf("addr[0]: %d\n", addr[0]); sleep(1); return 0; } You can simulate race by replacing 'if (pud_none(*pud))' with "if (0)". It would produce "BUG: non-zero nr_pmds on freeing mm: 2" on the test-case. Fix: >>From fd22922e7b4664e83653a84331f0a95b985bff0c Mon Sep 17 00:00:00 2001 From: "Kirill A. Shutemov" Date: Fri, 17 Jun 2016 15:07:03 +0300 Subject: [PATCH] hugetlb: fix nr_pmds accounting with shared page tables We account HugeTLB's shared page table to all processes who share it. The accounting happens during huge_pmd_share(). If somebody populates pud entry under us, we should decrease pagetable's refcount and decrease nr_pmds of the process. By mistake, I increase nr_pmds again in this case. :-/ It will lead to "BUG: non-zero nr_pmds on freeing mm: 2" on process' exit. Let's fix this by increasing nr_pmds only when we're sure that the page table will be used. Signed-off-by: Kirill A. Shutemov Reported-by: zhongjiang Fixes: dc6c9a35b66b ("mm: account pmd page tables to the process") Cc: [4.0+] --- mm/hugetlb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index e197cd7080e6..ed6a537f0878 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -4216,7 +4216,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) if (saddr) { spte = huge_pte_offset(svma->vm_mm, saddr); if (spte) { - mm_inc_nr_pmds(mm); get_page(virt_to_page(spte)); break; } @@ -4231,9 +4230,9 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud) if (pud_none(*pud)) { pud_populate(mm, pud, (pmd_t *)((unsigned long)spte & PAGE_MASK)); + mm_inc_nr_pmds(mm); } else { put_page(virt_to_page(spte)); - mm_inc_nr_pmds(mm); } spin_unlock(ptl); out: -- Kirill A. Shutemov