From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752914AbbJLBvf (ORCPT ); Sun, 11 Oct 2015 21:51:35 -0400 Received: from LGEAMRELO13.lge.com ([156.147.23.53]:48642 "EHLO lgeamrelo13.lge.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752451AbbJLBvd (ORCPT ); Sun, 11 Oct 2015 21:51:33 -0400 X-Original-SENDERIP: 156.147.1.151 X-Original-MAILFROM: minchan@kernel.org X-Original-SENDERIP: 10.177.223.161 X-Original-MAILFROM: minchan@kernel.org From: Minchan Kim To: Andrew Morton Cc: "Kirill A. Shutemov" , Mel Gorman , Vlastimil Babka , Andrea Arcangeli , Hugh Dickins , Rik van Riel , linux-kernel@vger.kernel.org, linux-mm@kvack.org, Minchan Kim Subject: [PATCH] thp: use is_zero_pfn after pte_present check Date: Mon, 12 Oct 2015 10:54:16 +0900 Message-Id: <1444614856-18543-1-git-send-email-minchan@kernel.org> X-Mailer: git-send-email 1.9.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Use is_zero_pfn on pteval only after pte_present check on pteval (It might be better idea to introduce is_zero_pte where checks pte_present first). Otherwise, it could work with swap or migration entry and if pte_pfn's result is equal to zero_pfn by chance, we lose user's data in __collapse_huge_page_copy. So if you're luck, the application is segfaulted and finally you could see below message when the application is exit. BUG: Bad rss-counter state mm:ffff88007f099300 idx:2 val:3 Signed-off-by: Minchan Kim --- I found this bug with MADV_FREE hard test. Sometime, I saw "Bad rss-counter" message with MM_SWAPENTS but it's really rare, once a day if I was luck or once in five days if I was unlucky so I am doing test still and just pass a few days but I hope it will fix the issue. mm/huge_memory.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 4b06b8db9df2..349590aa4533 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -2665,15 +2665,25 @@ static int khugepaged_scan_pmd(struct mm_struct *mm, for (_address = address, _pte = pte; _pte < pte+HPAGE_PMD_NR; _pte++, _address += PAGE_SIZE) { pte_t pteval = *_pte; - if (pte_none(pteval) || is_zero_pfn(pte_pfn(pteval))) { + if (pte_none(pteval)) { if (!userfaultfd_armed(vma) && ++none_or_zero <= khugepaged_max_ptes_none) continue; else goto out_unmap; } + if (!pte_present(pteval)) goto out_unmap; + + if (is_zero_pfn(pte_pfn(pteval))) { + if (!userfaultfd_armed(vma) && + ++none_or_zero <= khugepaged_max_ptes_none) + continue; + else + goto out_unmap; + } + if (pte_write(pteval)) writable = true; -- 1.9.1