From: Andrew Morton <akpm@linux-foundation.org>
To: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org,
Michal Hocko <mhocko@suse.com>,
Heiko Carstens <hca@linux.ibm.com>,
Sven Schnelle <svens@linux.ibm.com>
Subject: Re: [RFC] linux-next panic in hugepage_subpool_put_pages()
Date: Tue, 23 Feb 2021 15:58:06 -0800 [thread overview]
Message-ID: <20210223155806.8e2284682df5d08ce9b3da68@linux-foundation.org> (raw)
In-Reply-To: <3c536d3c-a180-301b-5cb7-c737a178a9d7@oracle.com>
On Tue, 23 Feb 2021 10:06:12 -0800 Mike Kravetz <mike.kravetz@oracle.com> wrote:
> On 2/23/21 6:57 AM, Gerald Schaefer wrote:
> > Hi,
> >
> > LTP triggered a panic on s390 in hugepage_subpool_put_pages() with
> > linux-next 5.12.0-20210222, see below.
> >
> > It crashes on the spin_lock(&spool->lock) at the beginning, because the
> > passed-in *spool points to 0000004e00000000, which is not addressable
> > memory. It rather looks like some flags and not a proper address. I suspect
> > some relation to the recent rework in that area, e.g. commit f1280272ae4d
> > ("hugetlb: use page.private for hugetlb specific page flags").
> >
> > __free_huge_page() calls hugepage_subpool_put_pages() and takes *spool from
> > hugetlb_page_subpool(page), which was changed by that commit to use
> > page[1]->private now.
> >
>
> Thanks Gerald,
>
> Yes, I believe f1280272ae4d is the root cause of this issue. In that
> commit, the subpool pointer was moved from page->private of the head
> page to page->private of the first subpage. The page allocator will
> initialize (zero) the private field of the head page, but not that of
> subpages. So, that bad subpool pointer is likely an old page->private
> value for the page.
>
> That strange call path from set_max_huge_pages to __free_huge_page is
> actually how the code puts newly allocated pages on it's interfal free
> list.
>
> I will do a bit more verification and put together a patch (it should
> be simple).
There's also Michel's documentation request:
https://lkml.kernel.org/r/20210127102645.GH827@dhcp22.suse.cz
next prev parent reply other threads:[~2021-02-24 0:52 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-23 14:57 [RFC] linux-next panic in hugepage_subpool_put_pages() Gerald Schaefer
2021-02-23 16:45 ` Gerald Schaefer
2021-02-23 18:06 ` Mike Kravetz
2021-02-23 23:58 ` Andrew Morton [this message]
2021-02-24 1:29 ` Mike Kravetz
2021-02-24 2:08 ` Andrew Morton
2021-02-24 4:04 ` [PATCH] hugetlb: document the new location of page subpool pointer Mike Kravetz
2021-02-24 8:20 ` Oscar Salvador
2021-02-24 8:48 ` [External] " Muchun Song
2021-02-24 10:06 ` David Hildenbrand
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210223155806.8e2284682df5d08ce9b3da68@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=gerald.schaefer@linux.ibm.com \
--cc=hca@linux.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@suse.com \
--cc=mike.kravetz@oracle.com \
--cc=svens@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).