From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751547AbdFHK1N (ORCPT ); Thu, 8 Jun 2017 06:27:13 -0400 Received: from mga09.intel.com ([134.134.136.24]:25129 "EHLO mga09.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751252AbdFHK1M (ORCPT ); Thu, 8 Jun 2017 06:27:12 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.39,314,1493708400"; d="scan'208";a="271728195" Date: Thu, 8 Jun 2017 13:27:02 +0300 From: "Kirill A. Shutemov" To: Will Deacon Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, mark.rutland@arm.com, akpm@linux-foundation.org, Punit.Agrawal@arm.com, mgorman@suse.de, steve.capper@arm.com Subject: Re: [PATCH 1/3] mm: numa: avoid waiting on freed migrated pages Message-ID: <20170608102702.lqo42is4xrz3edmi@black.fi.intel.com> References: <1496771916-28203-1-git-send-email-will.deacon@arm.com> <1496771916-28203-2-git-send-email-will.deacon@arm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1496771916-28203-2-git-send-email-will.deacon@arm.com> User-Agent: NeoMutt/20161126 (1.7.0) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Jun 06, 2017 at 06:58:34PM +0100, Will Deacon wrote: > From: Mark Rutland > > In do_huge_pmd_numa_page(), we attempt to handle a migrating thp pmd by > waiting until the pmd is unlocked before we return and retry. However, > we can race with migrate_misplaced_transhuge_page(): > > // do_huge_pmd_numa_page // migrate_misplaced_transhuge_page() > // Holds 0 refs on page // Holds 2 refs on page > > vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd); > /* ... */ > if (pmd_trans_migrating(*vmf->pmd)) { > page = pmd_page(*vmf->pmd); > spin_unlock(vmf->ptl); > ptl = pmd_lock(mm, pmd); > if (page_count(page) != 2)) { > /* roll back */ > } > /* ... */ > mlock_migrate_page(new_page, page); > /* ... */ > spin_unlock(ptl); > put_page(page); > put_page(page); // page freed here > wait_on_page_locked(page); > goto out; > } > > This can result in the freed page having its waiters flag set > unexpectedly, which trips the PAGE_FLAGS_CHECK_AT_PREP checks in the > page alloc/free functions. This has been observed on arm64 KVM guests. > > We can avoid this by having do_huge_pmd_numa_page() take a reference on > the page before dropping the pmd lock, mirroring what we do in > __migration_entry_wait(). > > When we hit the race, migrate_misplaced_transhuge_page() will see the > reference and abort the migration, as it may do today in other cases. > > Acked-by: Steve Capper > Signed-off-by: Mark Rutland > Signed-off-by: Will Deacon Acked-by: Kirill A. Shutemov -- Kirill A. Shutemov