From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755165AbcEEMrd (ORCPT ); Thu, 5 May 2016 08:47:33 -0400 Received: from szxga01-in.huawei.com ([58.251.152.64]:29248 "EHLO szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754498AbcEEMrc (ORCPT ); Thu, 5 May 2016 08:47:32 -0400 From: Zhou Chengming To: , , , , , , CC: , , , , , , , Subject: [PATCH] ksm: fix conflict between mmput and scan_get_next_rmap_item Date: Thu, 5 May 2016 20:42:56 +0800 Message-ID: <1462452176-33462-1-git-send-email-zhouchengming1@huawei.com> X-Mailer: git-send-email 1.7.12.4 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.175.102.37] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020202.572B4018.00B1,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 2166769110c9da8d5cdb2f8f7f943199 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org A concurrency issue about KSM in the function scan_get_next_rmap_item. task A (ksmd): |task B (the mm's task): | mm = slot->mm; | down_read(&mm->mmap_sem); | | ... | | spin_lock(&ksm_mmlist_lock); | | ksm_scan.mm_slot go to the next slot; | | spin_unlock(&ksm_mmlist_lock); | |mmput() -> | ksm_exit(): | |spin_lock(&ksm_mmlist_lock); |if (mm_slot && ksm_scan.mm_slot != mm_slot) { | if (!mm_slot->rmap_list) { | easy_to_free = 1; | ... | |if (easy_to_free) { | mmdrop(mm); | ... | |So this mm_struct will be freed successfully. | up_read(&mm->mmap_sem); | As we can see above, the ksmd thread may access a mm_struct that already been freed to the kmem_cache. Suppose a fork will get this mm_struct from the kmem_cache, the ksmd thread then call up_read(&mm->mmap_sem), will cause mmap_sem.count to become -1. I changed the scan_get_next_rmap_item function refered to the khugepaged scan function. Signed-off-by: Zhou Chengming --- mm/ksm.c | 7 ++----- 1 files changed, 2 insertions(+), 5 deletions(-) diff --git a/mm/ksm.c b/mm/ksm.c index 7ee101e..6e4324d 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -1650,6 +1650,7 @@ next_mm: * because there were no VM_MERGEABLE vmas with such addresses. */ remove_trailing_rmap_items(slot, ksm_scan.rmap_list); + up_read(&mm->mmap_sem); spin_lock(&ksm_mmlist_lock); ksm_scan.mm_slot = list_entry(slot->mm_list.next, @@ -1666,16 +1667,12 @@ next_mm: */ hash_del(&slot->link); list_del(&slot->mm_list); - spin_unlock(&ksm_mmlist_lock); free_mm_slot(slot); clear_bit(MMF_VM_MERGEABLE, &mm->flags); - up_read(&mm->mmap_sem); mmdrop(mm); - } else { - spin_unlock(&ksm_mmlist_lock); - up_read(&mm->mmap_sem); } + spin_unlock(&ksm_mmlist_lock); /* Repeat until we've completed scanning the whole list */ slot = ksm_scan.mm_slot; -- 1.7.7