From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935809AbdCXLu1 (ORCPT ); Fri, 24 Mar 2017 07:50:27 -0400 Received: from mga09.intel.com ([134.134.136.24]:38438 "EHLO mga09.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935627AbdCXLuU (ORCPT ); Fri, 24 Mar 2017 07:50:20 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.36,214,1486454400"; d="scan'208";a="947783337" Date: Fri, 24 Mar 2017 14:47:09 +0300 From: "Kirill A. Shutemov" To: Peter Zijlstra Cc: "Kirill A. Shutemov" , Ingo Molnar , x86@kernel.org, Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Fengguang Wu , linux-kernel@vger.kernel.org, linux-mm@kvack.org, LKP , Linus Torvalds , "Aneesh Kumar K.V" Subject: Re: [x86/mm/gup] 2947ba054a [ 71.329069] kernel BUG at include/linux/pagemap.h:151! Message-ID: <20170324114709.pcytvyb3d6ajux33@black.fi.intel.com> References: <20170319225124.xodpqjldom6ceazz@wfg-t540p.sh.intel.com> <20170324102436.xltop6udkx5pg4oq@node.shutemov.name> <20170324105153.xvy5rcuawicqoanl@hirez.programming.kicks-ass.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170324105153.xvy5rcuawicqoanl@hirez.programming.kicks-ass.net> User-Agent: NeoMutt/20161126 (1.7.0) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Mar 24, 2017 at 11:51:53AM +0100, Peter Zijlstra wrote: > On Fri, Mar 24, 2017 at 01:24:36PM +0300, Kirill A. Shutemov wrote: > > > I'm not sure what is the best way to fix this. > > Few options: > > - Drop the VM_BUG(); > > - Bump preempt count during __get_user_pages_fast(); > > - Use get_page() instead of page_cache_get_speculative() on x86. > > > > Any opinions? > > I think I'm in favour of the first; either remove or amend to include > irqs_disabled() or so. > > This in favour of keeping the variants of GUP down. Something like this? -------------------8<----------------------- >>From d2f416a3ee3e5dbb10e59d0b374d382fdc4ba082 Mon Sep 17 00:00:00 2001 From: "Kirill A. Shutemov" Date: Fri, 24 Mar 2017 14:13:05 +0300 Subject: [PATCH] mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative 0day triggered this: kernel BUG at include/linux/pagemap.h:151! invalid opcode: 0000 [#1] CPU: 0 PID: 458 Comm: trinity-c0 Not tainted 4.11.0-rc2-00251-g2947ba0 #1 task: ffff88001f19ab00 task.stack: ffff88001f084000 RIP: 0010:gup_pud_range+0x56f/0x63d RSP: 0018:ffff88001f087ba8 EFLAGS: 00010046 RAX: 0000000080000000 RBX: 000000000164e000 RCX: ffff88001e0badc0 RDX: dead000000000100 RSI: 0000000000000001 RDI: ffff88001e0badc0 RBP: ffff88001f087c38 R08: ffff88001f087cf8 R09: ffff88001f087c6c R10: 0000000000000000 R11: ffff88001f19b0f0 R12: ffff88001f087c6c R13: ffff88001e0badc0 R14: 800000001e7b7867 R15: 0000000000000000 FS: 00007f7ea7b60700(0000) GS:ffffffffae02f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000013eb130 CR3: 0000000017ddb000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 00000000000d0602 Call Trace: __get_user_pages_fast+0x107/0x136 get_user_pages_fast+0x78/0x89 get_futex_key+0xfd/0x350 ? simple_write_end+0x83/0xbe futex_requeue+0x1a3/0x585 do_futex+0x834/0x86f ? kvm_clock_read+0x16/0x1e ? paravirt_sched_clock+0x9/0xd ? lock_release+0x11e/0x328 SyS_futex+0x125/0x135 ? write_seqcount_end+0x1a/0x1f ? vtime_account_user+0x4b/0x50 do_syscall_64+0x61/0x74 entry_SYSCALL64_slow_path+0x25/0x25 It' VM_BUG_ON() due to false-negative in_atomic(). We call page_cache_get_speculative() with disabled local interrupts. It should be atomic enough. Let's check for disabled interrupts in the VM_BUG_ON() too. Signed-off-by: Kirill A. Shutemov Reported-by: Fengguang Wu --- include/linux/pagemap.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h index f84cf5f76366..e7bbd9d4dc6c 100644 --- a/include/linux/pagemap.h +++ b/include/linux/pagemap.h @@ -148,7 +148,7 @@ static inline int page_cache_get_speculative(struct page *page) #ifdef CONFIG_TINY_RCU # ifdef CONFIG_PREEMPT_COUNT - VM_BUG_ON(!in_atomic()); + VM_BUG_ON(!in_atomic() && !irqs_disabled()); # endif /* * Preempt must be disabled here - we rely on rcu_read_lock doing @@ -186,7 +186,7 @@ static inline int page_cache_add_speculative(struct page *page, int count) #if !defined(CONFIG_SMP) && defined(CONFIG_TREE_RCU) # ifdef CONFIG_PREEMPT_COUNT - VM_BUG_ON(!in_atomic()); + VM_BUG_ON(!in_atomic() && !irqs_disabled()); # endif VM_BUG_ON_PAGE(page_count(page) == 0, page); page_ref_add(page, count); -- Kirill A. Shutemov