From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752059AbbKIWzo (ORCPT ); Mon, 9 Nov 2015 17:55:44 -0500 Received: from aserp1040.oracle.com ([141.146.126.69]:23790 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751512AbbKIWzm (ORCPT ); Mon, 9 Nov 2015 17:55:42 -0500 Subject: Re: [PATCH] mm/hugetlb: Unmap pages if page fault raced with hole punch To: Hugh Dickins References: <1446158038-25815-1-git-send-email-mike.kravetz@oracle.com> <56339EBA.4070508@oracle.com> <5633D984.7080307@oracle.com> From: Mike Kravetz Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrew Morton , Dave Hansen , Naoya Horiguchi , Davidlohr Bueso Message-ID: <5641244F.3060108@oracle.com> Date: Mon, 9 Nov 2015 14:55:11 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Source-IP: aserv0021.oracle.com [141.146.126.233] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 11/08/2015 11:42 PM, Hugh Dickins wrote: > On Fri, 30 Oct 2015, Mike Kravetz wrote: >> >> The 'next = start' code is actually from the original truncate_hugepages >> routine. This functionality was combined with that needed for hole punch >> to create remove_inode_hugepages(). >> >> The following code was in truncate_hugepages: >> >> next = start; >> while (1) { >> if (!pagevec_lookup(&pvec, mapping, next, PAGEVEC_SIZE)) { >> if (next == start) >> break; >> next = start; >> continue; >> } >> >> >> So, in the truncate case pages starting at 'start' are deleted until >> pagevec_lookup fails. Then, we call pagevec_lookup() again. If no >> pages are found we are done. Else, we repeat the whole process. >> >> Does anyone recall the reason for going back and looking for pages at >> index'es already deleted? Git doesn't help as that was part of initial >> commit. My thought is that truncate can race with page faults. The >> truncate code sets inode offset before unmapping and deleting pages. >> So, faults after the new offset is set should fail. But, I suppose a >> fault could race with setting offset and deleting of pages. Does this >> sound right? Or, is there some other reason I am missing? > > I believe your thinking is correct. But remember that > truncate_inode_pages_range() is shared by almost all filesystems, > and different filesystems have different internal locking conventions, > and different propensities to such a race: it's trying to cover for > all of them. > > Typically, writing is well serialized (by i_mutex) against truncation, > but faulting (like reading) sails through without enough of a lock. > We resort to i_size checks to avoid the worst of it, but there's often > a corner or two in which those checks are not quite good enough - > it's easy to check i_size at the beginning, but it needs to be checked > again at the end too, and what's been done undone - can be awkward. Well, it looks like the hugetlb_no_page() routine is checking i_size both before and after. It appears to be doing the right thing to handle the race, but I need to stare at the code some more to make sure. Because of the way the truncate code went back and did an extra lookup when done with the range, I assumed it was covering some race. However, that may not be the case. > > I hope that in the case of hugetlbfs, since you already have the > additional fault_mutex to handle races between faults and punching, > it should be possible to get away without that "pincer" restarting. Yes, it looks like this may work as a straight loop over the range of pages. I just need to study the code some more to make sure I am not missing something. -- Mike Kravetz > > Hugh > >> >> I would like to continue having remove_inode_hugepages handle both the >> truncate and hole punch case. So, what to make sure the code correctly >> handles both cases. >> >> -- >> Mike Kravetz