LKML Archive on lore.kernel.org
 help / color / Atom feed
From: Andrei Vagin <avagin@gmail.com>
To: Punit Agrawal <punit.agrawal@arm.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
	Vlastimil Babka <vbabka@suse.cz>,
	Steve Capper <steve.capper@arm.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	linux-mm@kvack.org, LKML <linux-kernel@vger.kernel.org>,
	Stephen Rothwell <sfr@canb.auug.org.au>,
	Cyrill Gorcunov <gorcunov@openvz.org>
Subject: Re: linux-next: BUG: Bad page state in process ip6tables-save pfn:1499f4
Date: Tue, 27 Jun 2017 11:24:34 -0700
Message-ID: <CANaxB-x56KxttrijCg5f4U5286Sr=r1hDHYOnShE4Lw+3umSkQ@mail.gmail.com> (raw)
In-Reply-To: <87lgodl6c8.fsf@e105922-lin.cambridge.arm.com>

On Tue, Jun 27, 2017 at 9:53 AM, Punit Agrawal <punit.agrawal@arm.com> wrote:
> "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> writes:
>
>> On Tue, Jun 27, 2017 at 09:18:15AM +0200, Vlastimil Babka wrote:
>>> On 06/24/2017 05:08 PM, Andrei Vagin wrote:
>>> > On Fri, Jun 23, 2017 at 05:17:44PM -0700, Andrei Vagin wrote:
>>> >> On Thu, Jun 22, 2017 at 11:21:03PM -0700, Andrei Vagin wrote:
>>> >>> Hello,
>>> >>>
>>> >>> We run CRIU tests for linux-next and today they triggered a kernel
>>> >>> bug. I want to mention that this kernel is built with kasan. This bug
>>> >>> was triggered in travis-ci. I can't reproduce it on my host. Without
>>> >>> kasan, kernel crashed but it is impossible to get a kernel log for
>>> >>> this case.
>>> >>
>>> >> We use this tree
>>> >> https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/
>>> >>
>>> >> This issue isn't reproduced on the akpm-base branch and
>>> >> it is reproduced each time on the akpm branch. I didn't
>>> >> have time today to bisect it, will do on Monday.
>>> >
>>> > c3aab7b2d4e8434d53bc81770442c14ccf0794a8 is the first bad commit
>>> >
>>> > commit c3aab7b2d4e8434d53bc81770442c14ccf0794a8
>>> > Merge: 849c34f 93a7379
>>> > Author: Stephen Rothwell
>>> > Date:   Fri Jun 23 16:40:07 2017 +1000
>>> >
>>> >     Merge branch 'akpm-current/current'
>>>
>>> Hm is it really the merge of mmotm itself and not one of the patches in
>>> mmotm?
>>> Anyway smells like THP, adding Kirill.
>>
>> Okay, it took a while to figure it out.
>
> I'm sorry you had to go chasing for this one again.
>
> I'd found the same issue while investigating an ltp failure on arm64[0] and
> sent a fix[1]. The fix is effectively the same as your patch below.
>
> Andrew picked up the patch from v5 posting and I can see it in today's
> next[2].

Our tests passed on today's next:
https://travis-ci.org/avagin/criu/jobs/247377006

Thanks,
Andrei

>
>
> [0] http://lists.infradead.org/pipermail/linux-arm-kernel/2017-June/510318.html
> [1] https://patchwork.kernel.org/patch/9766193/
> [2] https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/mm/gup.c?h=next-20170627&id=d31945b5d4ab4490fb5f961dd5b066cc9f560eb3
>
>>
>> The bug is in patch "mm, gup: ensure real head page is ref-counted when
>> using hugepages". We should look for a head *before* the loop. Otherwise
>> 'page' may point to the first page beyond the compound page.
>>
>> The patch below should help.
>>
>> If no objections, Andrew, could you fold it into the problematic patch?
>>
>> diff --git a/mm/gup.c b/mm/gup.c
>> index d8db6e5016a8..6f9ca86b3d03 100644
>> --- a/mm/gup.c
>> +++ b/mm/gup.c
>> @@ -1424,6 +1424,7 @@ static int gup_huge_pmd(pmd_t orig, pmd_t *pmdp, unsigned long addr,
>>
>>       refs = 0;
>>       page = pmd_page(orig) + ((addr & ~PMD_MASK) >> PAGE_SHIFT);
>> +     head = compound_head(page);
>>       do {
>>               pages[*nr] = page;
>>               (*nr)++;
>> @@ -1431,7 +1432,6 @@ static int gup_huge_pmd(pmd_t orig, pmd_t *pmdp, unsigned long addr,
>>               refs++;
>>       } while (addr += PAGE_SIZE, addr != end);
>>
>> -     head = compound_head(page);
>>       if (!page_cache_add_speculative(head, refs)) {
>>               *nr -= refs;
>>               return 0;
>> @@ -1462,6 +1462,7 @@ static int gup_huge_pud(pud_t orig, pud_t *pudp, unsigned long addr,
>>
>>       refs = 0;
>>       page = pud_page(orig) + ((addr & ~PUD_MASK) >> PAGE_SHIFT);
>> +     head = compound_head(page);
>>       do {
>>               pages[*nr] = page;
>>               (*nr)++;
>> @@ -1469,7 +1470,6 @@ static int gup_huge_pud(pud_t orig, pud_t *pudp, unsigned long addr,
>>               refs++;
>>       } while (addr += PAGE_SIZE, addr != end);
>>
>> -     head = compound_head(page);
>>       if (!page_cache_add_speculative(head, refs)) {
>>               *nr -= refs;
>>               return 0;
>> @@ -1499,6 +1499,7 @@ static int gup_huge_pgd(pgd_t orig, pgd_t *pgdp, unsigned long addr,
>>       BUILD_BUG_ON(pgd_devmap(orig));
>>       refs = 0;
>>       page = pgd_page(orig) + ((addr & ~PGDIR_MASK) >> PAGE_SHIFT);
>> +     head = compound_head(page);
>>       do {
>>               pages[*nr] = page;
>>               (*nr)++;
>> @@ -1506,7 +1507,6 @@ static int gup_huge_pgd(pgd_t orig, pgd_t *pgdp, unsigned long addr,
>>               refs++;
>>       } while (addr += PAGE_SIZE, addr != end);
>>
>> -     head = compound_head(page);
>>       if (!page_cache_add_speculative(head, refs)) {
>>               *nr -= refs;
>>               return 0;

  parent reply index

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-06-23  6:21 Andrei Vagin
2017-06-24  0:17 ` Andrei Vagin
2017-06-24 15:08   ` Andrei Vagin
2017-06-27  7:18     ` Vlastimil Babka
2017-06-27 16:37       ` Kirill A. Shutemov
2017-06-27 16:53         ` Punit Agrawal
2017-06-27 17:04           ` Kirill A. Shutemov
2017-06-28 11:32             ` Punit Agrawal
2017-06-27 18:24           ` Andrei Vagin [this message]
2017-06-27 18:39         ` valdis.kletnieks

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CANaxB-x56KxttrijCg5f4U5286Sr=r1hDHYOnShE4Lw+3umSkQ@mail.gmail.com' \
    --to=avagin@gmail.com \
    --cc=akpm@linux-foundation.org \
    --cc=gorcunov@openvz.org \
    --cc=kirill.shutemov@linux.intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=punit.agrawal@arm.com \
    --cc=sfr@canb.auug.org.au \
    --cc=steve.capper@arm.com \
    --cc=vbabka@suse.cz \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org linux-kernel@archiver.kernel.org
	public-inbox-index lkml


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/ public-inbox