From: Andrew Morton <akpm@linux-foundation.org>
To: chris@chrisdown.name, guro@fb.com, hannes@cmpxchg.org,
mhocko@suse.com, mm-commits@vger.kernel.org,
stable@vger.kernel.org, tj@kernel.org
Subject: [merged] mm-memcontrol-handle-div0-crash-race-condition-in-memorylow.patch removed from -mm tree
Date: Fri, 26 Jun 2020 20:33:46 -0700 [thread overview]
Message-ID: <20200627033346.uM9eRcQFS%akpm@linux-foundation.org> (raw)
In-Reply-To: <20200625202807.b630829d6fa55388148bee7d@linux-foundation.org>
The patch titled
Subject: mm: memcontrol: handle div0 crash race condition in memory.low
has been removed from the -mm tree. Its filename was
mm-memcontrol-handle-div0-crash-race-condition-in-memorylow.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Johannes Weiner <hannes@cmpxchg.org>
Subject: mm: memcontrol: handle div0 crash race condition in memory.low
Tejun reports seeing rare div0 crashes in memory.low stress testing:
[37228.504582] RIP: 0010:mem_cgroup_calculate_protection+0xed/0x150
[37228.505059] Code: 0f 46 d1 4c 39 d8 72 57 f6 05 16 d6 42 01 40 74 1f 4c 39 d8 76 1a 4c 39 d1 76 15 4c 29 d1 4c 29 d8 4d 29 d9 31 d2 48 0f af c1 <49> f7 f1 49 01 c2 4c 89 96 38 01 00 00 5d c3 48 0f af c7 31 d2 49
[37228.506254] RSP: 0018:ffffa14e01d6fcd0 EFLAGS: 00010246
[37228.506769] RAX: 000000000243e384 RBX: 0000000000000000 RCX: 0000000000008f4b
[37228.507319] RDX: 0000000000000000 RSI: ffff8b89bee84000 RDI: 0000000000000000
[37228.507869] RBP: ffffa14e01d6fcd0 R08: ffff8b89ca7d40f8 R09: 0000000000000000
[37228.508376] R10: 0000000000000000 R11: 00000000006422f7 R12: 0000000000000000
[37228.508881] R13: ffff8b89d9617000 R14: ffff8b89bee84000 R15: ffffa14e01d6fdb8
[37228.509397] FS: 0000000000000000(0000) GS:ffff8b8a1f1c0000(0000) knlGS:0000000000000000
[37228.509917] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[37228.510442] CR2: 00007f93b1fc175b CR3: 000000016100a000 CR4: 0000000000340ea0
[37228.511076] Call Trace:
[37228.511561] shrink_node+0x1e5/0x6c0
[37228.512044] balance_pgdat+0x32d/0x5f0
[37228.512521] kswapd+0x1d7/0x3d0
[37228.513346] ? wait_woken+0x80/0x80
[37228.514170] kthread+0x11c/0x160
[37228.514983] ? balance_pgdat+0x5f0/0x5f0
[37228.515797] ? kthread_park+0x90/0x90
[37228.516593] ret_from_fork+0x1f/0x30
This happens when parent_usage == siblings_protected. We check that usage
is bigger than protected, which should imply parent_usage being bigger
than siblings_protected. However, we don't read (or even update) these
values atomically, and they can be out of sync as the memory state changes
under us. A bit of fluctuation around the target protection isn't a big
deal, but we need to handle the div0 case.
Check the parent state explicitly to make sure we have a reasonable
positive value for the divisor.
Link: http://lkml.kernel.org/r/20200615140658.601684-1-hannes@cmpxchg.org
Fixes: 8a931f801340 ("mm: memcontrol: recursive memory.low protection")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Reported-by: Tejun Heo <tj@kernel.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Chris Down <chris@chrisdown.name>
Cc: Roman Gushchin <guro@fb.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
mm/memcontrol.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/mm/memcontrol.c~mm-memcontrol-handle-div0-crash-race-condition-in-memorylow
+++ a/mm/memcontrol.c
@@ -6360,11 +6360,16 @@ static unsigned long effective_protectio
* We're using unprotected memory for the weight so that if
* some cgroups DO claim explicit protection, we don't protect
* the same bytes twice.
+ *
+ * Check both usage and parent_usage against the respective
+ * protected values. One should imply the other, but they
+ * aren't read atomically - make sure the division is sane.
*/
if (!(cgrp_dfl_root.flags & CGRP_ROOT_MEMORY_RECURSIVE_PROT))
return ep;
next prev parent reply other threads:[~2020-06-27 3:33 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-26 3:28 incoming Andrew Morton
2020-06-26 3:29 ` [patch 01/32] openrisc: fix boot oops when DEBUG_VM is enabled Andrew Morton
2020-06-26 3:29 ` [patch 02/32] mm: do_swap_page(): fix up the error code Andrew Morton
2020-06-26 3:29 ` [patch 03/32] mm, compaction: make capture control handling safe wrt interrupts Andrew Morton
2020-06-26 3:29 ` [patch 04/32] kexec: do not verify the signature without the lockdown or mandatory signature Andrew Morton
2020-06-26 3:29 ` [patch 05/32] ocfs2: avoid inode removal while nfsd is accessing it Andrew Morton
2020-06-26 3:29 ` [patch 06/32] ocfs2: load global_inode_alloc Andrew Morton
2020-06-26 3:29 ` [patch 07/32] ocfs2: fix panic on nfs server over ocfs2 Andrew Morton
2020-06-26 3:29 ` [patch 08/32] ocfs2: fix value of OCFS2_INVALID_SLOT Andrew Morton
2020-06-26 3:29 ` [patch 09/32] lib: fix test_hmm.c reference after free Andrew Morton
2020-06-26 3:29 ` [patch 10/32] linux/bits.h: fix unsigned less than zero warnings Andrew Morton
2020-06-26 3:29 ` [patch 11/32] mm, slab: fix sign conversion problem in memcg_uncharge_slab() Andrew Morton
2020-06-26 3:29 ` [patch 12/32] mm/slab: use memzero_explicit() in kzfree() Andrew Morton
2020-06-26 3:29 ` [patch 13/32] slub: cure list_slab_objects() from double fix Andrew Morton
2020-06-26 3:29 ` [patch 14/32] mm: fix swap cache node allocation mask Andrew Morton
2020-06-26 3:30 ` [patch 15/32] mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages() Andrew Morton
2020-06-26 3:30 ` [patch 16/32] mm/debug_vm_pgtable: fix build failure with powerpc 8xx Andrew Morton
2020-06-26 3:30 ` [patch 17/32] make asm-generic/cacheflush.h more standalone Andrew Morton
2020-06-26 3:30 ` [patch 18/32] media: omap3isp: remove cacheflush.h Andrew Morton
2020-06-26 3:30 ` [patch 19/32] mm/vmalloc.c: fix a warning while make xmldocs Andrew Morton
2020-06-26 3:30 ` [patch 20/32] mm: memcontrol: handle div0 crash race condition in memory.low Andrew Morton
2020-06-26 3:30 ` [patch 21/32] mm/memcontrol.c: add missed css_put() Andrew Morton
2020-06-26 3:30 ` [patch 22/32] mm/memcontrol.c: prevent missed memory.low load tears Andrew Morton
2020-06-26 3:30 ` [patch 23/32] docs: mm/gup: minor documentation update Andrew Morton
2020-06-26 3:30 ` [patch 24/32] doc: THP CoW fault no longer allocate THP Andrew Morton
2020-06-26 3:30 ` [patch 25/32] mm: workingset: age nonresident information alongside anonymous pages Andrew Morton
2020-06-26 3:30 ` [patch 26/32] mm/swap: fix for "mm: workingset: age nonresident information alongside anonymous pages" Andrew Morton
2020-06-26 3:30 ` [patch 27/32] mm/memory: fix IO cost for anonymous page Andrew Morton
2020-06-26 3:30 ` [patch 28/32] x86/hyperv: allocate the hypercall page with only read and execute bits Andrew Morton
2020-06-26 3:30 ` [patch 29/32] arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page Andrew Morton
2020-06-26 3:30 ` [patch 30/32] mm: remove vmalloc_exec Andrew Morton
2020-06-26 3:30 ` [patch 31/32] mm/memory_hotplug.c: fix false softlockup during pfn range removal Andrew Morton
2020-06-26 3:30 ` [patch 32/32] MAINTAINERS: update info for sparse Andrew Morton
2020-06-27 3:32 ` + linux-next-git-rejects.patch added to -mm tree Andrew Morton
2020-06-27 3:32 ` [merged] dma-remap-align-the-size-in-dma_common__remap.patch removed from " Andrew Morton
2020-06-27 3:32 ` [merged] openrisc-fix-boot-oops-when-debug_vm-is-enabled.patch " Andrew Morton
2020-06-27 3:33 ` [merged] mm-do_swap_page-fix-up-the-error-code-instantiation.patch " Andrew Morton
2020-06-27 3:33 ` [merged] mm-compaction-make-capture-control-handling-safe-wrt-interrupts.patch " Andrew Morton
2020-06-27 3:33 ` [merged] kexec-do-not-verify-the-signature-without-the-lockdown-or-mandatory-signature.patch " Andrew Morton
2020-06-27 3:33 ` [merged] ocfs2-avoid-inode-removed-while-nfsd-access-it.patch " Andrew Morton
2020-06-27 3:33 ` [merged] ocfs2-load-global_inode_alloc.patch " Andrew Morton
2020-06-27 3:33 ` [merged] ocfs2-fix-panic-on-nfs-server-over-ocfs2.patch " Andrew Morton
2020-06-27 3:33 ` [merged] ocfs2-fix-value-of-ocfs2_invalid_slot.patch " Andrew Morton
2020-06-27 3:33 ` [merged] lib-fix-test_hmmc-reference-after-free.patch " Andrew Morton
2020-06-27 3:33 ` [merged] mm-slab-fix-sign-conversion-problem-in-memcg_uncharge_slab.patch " Andrew Morton
2020-06-27 3:33 ` [merged] mm-slab-use-memzero_explicit-in-kzfree.patch " Andrew Morton
2020-06-27 3:33 ` [merged] slub-cure-list_slab_objects-from-double-fix.patch " Andrew Morton
2020-06-27 3:33 ` [merged] mm-fix-swap-cache-node-allocation-mask.patch " Andrew Morton
2020-06-27 3:33 ` [merged] mm-memoryc-properly-pte_offset_map_lock-unlock-in-vm_insert_pages.patch " Andrew Morton
2020-06-27 3:33 ` [merged] mm-debug_vm_pgtable-fix-build-failure-with-powerpc-8xx.patch " Andrew Morton
2020-06-27 3:33 ` [merged] make-asm-generic-cacheflushh-more-standalone.patch " Andrew Morton
2020-06-27 3:33 ` [merged] media-omap3isp-remove-cacheflushh.patch " Andrew Morton
2020-06-27 3:33 ` [merged] mm-fix-a-warning-while-make-xmldocs.patch " Andrew Morton
2020-06-27 3:33 ` Andrew Morton [this message]
2020-06-27 3:33 ` [merged] mm-memcontrol-fix-do-not-put-the-css-reference.patch " Andrew Morton
2020-06-27 3:33 ` [merged] mm-memcg-prevent-missed-memorylow-load-tears.patch " Andrew Morton
2020-06-27 3:33 ` [merged] docs-mm-gup-minor-documentation-update.patch " Andrew Morton
2020-06-27 3:33 ` [merged] doc-thp-cow-fault-no-longer-allocate-thp.patch " Andrew Morton
2020-06-27 3:33 ` [merged] mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch " Andrew Morton
2020-06-27 3:34 ` [merged] mm-swap-fix-for-mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch " Andrew Morton
2020-06-27 3:34 ` [merged] mm-memory-fix-io-cost-for-anonymous-page.patch " Andrew Morton
2020-06-27 3:34 ` [merged] x86-hyperv-allocate-the-hypercall-page-with-only-read-and-execute-bits.patch " Andrew Morton
2020-06-27 3:34 ` [merged] arm64-use-page_kernel_rox-directly-in-alloc_insn_page.patch " Andrew Morton
2020-06-27 3:34 ` [merged] mm-remove-vmalloc_exec.patch " Andrew Morton
2020-06-27 3:34 ` [merged] mm-fix-false-softlockup-during-pfn-range-removal.patch " Andrew Morton
2020-06-27 3:34 ` [merged] maintainers-update-info-for-sparse.patch " Andrew Morton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200627033346.uM9eRcQFS%akpm@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=chris@chrisdown.name \
--cc=guro@fb.com \
--cc=hannes@cmpxchg.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mhocko@suse.com \
--cc=mm-commits@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).