From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B3B98BA33 for ; Fri, 10 Jan 2025 02:32:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.255 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736476344; cv=none; b=HfVnUXt5wH2OeTi5JZ1NB0guWrNg9A2PcHc46bj12UPjoQvn5Dp+Jqu1pOJ7W4wNFggF8LUwlvOnoA2Oja4w4FWDQ0rUrL7pc7XL6JYyftYrMXSMaH/ZeAROJqcNpRKvmS1ThHQu+oZ6V1M8vKP9hmOdtD07ZJqmlVjV+p8i7uY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736476344; c=relaxed/simple; bh=AYlFLBaE6YaKwESnOnHQ6hF7F79a9YW+w1LuGYsWTBU=; h=Subject:To:References:CC:From:Message-ID:Date:MIME-Version: In-Reply-To:Content-Type; b=ntzOyXYU2JSWy+g4LP/GjpXRyC9BcElpb5ZoHluDqAYKB/M+biPdOziF3JzrdSrR2oBMUmEAEVGkRYNlbYvuiu+qoVJndHYfr57Dj/ShV13nZVoml0AOPLtDIxS206slyWigsdax6lFRLSfeqN5vmGYnZPD88k/sWap/9fWTRCg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.255 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.162.254]) by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4YTlvQ0L1Dz1W3t2; Fri, 10 Jan 2025 10:28:34 +0800 (CST) Received: from kwepemg200013.china.huawei.com (unknown [7.202.181.64]) by mail.maildlp.com (Postfix) with ESMTPS id F1CE0180105; Fri, 10 Jan 2025 10:32:17 +0800 (CST) Received: from [10.174.179.24] (10.174.179.24) by kwepemg200013.china.huawei.com (7.202.181.64) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Fri, 10 Jan 2025 10:32:16 +0800 Subject: Re: [PATCH] mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma To: Yang Shi , Andrew Morton , Chengming Zhou , Matthew Wilcox , Kefeng Wang , Nanyong Sun , Muchun Song , Qi Zheng , Johannes Weiner References: <20250109070059.369257-1-liushixin2@huawei.com> <037d4442-4d2d-4aeb-8091-5efffc374d36@os.amperecomputing.com> CC: , From: Liu Shixin Message-ID: <3777bc2f-81d3-1372-e890-0ac352cc2ade@huawei.com> Date: Fri, 10 Jan 2025 10:32:16 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 In-Reply-To: <037d4442-4d2d-4aeb-8091-5efffc374d36@os.amperecomputing.com> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To kwepemg200013.china.huawei.com (7.202.181.64) On 2025/1/10 1:00, Yang Shi wrote: > > > > On 1/8/25 11:00 PM, Liu Shixin wrote: >> syzkaller reported such a BUG_ON(): >> >> ------------[ cut here ]------------ >> kernel BUG at mm/khugepaged.c:1835! >> Internal error: Oops - BUG: 00000000f2000800 [#1] SMP >> ... >> CPU: 6 UID: 0 PID: 8009 Comm: syz.15.106 Kdump: loaded Tainted: G W 6.13.0-rc6 #22 >> Tainted: [W]=WARN >> Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 >> pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) >> pc : collapse_file+0xa44/0x1400 >> lr : collapse_file+0x88/0x1400 >> sp : ffff80008afe3a60 >> ... >> Call trace: >> collapse_file+0xa44/0x1400 (P) >> hpage_collapse_scan_file+0x278/0x400 >> madvise_collapse+0x1bc/0x678 >> madvise_vma_behavior+0x32c/0x448 >> madvise_walk_vmas.constprop.0+0xbc/0x140 >> do_madvise.part.0+0xdc/0x2c8 >> __arm64_sys_madvise+0x68/0x88 >> invoke_syscall+0x50/0x120 >> el0_svc_common.constprop.0+0xc8/0xf0 >> do_el0_svc+0x24/0x38 >> el0_svc+0x34/0x128 >> el0t_64_sync_handler+0xc8/0xd0 >> el0t_64_sync+0x190/0x198 >> >> This indicates that the pgoff is unaligned. After analysis, I confirm >> the vma is mapped to /dev/zero. Such a vma certainly has vm_file, but >> it is set to anonymous by mmap_zero(). So even if it's mmapped by >> 2m-unaligned, it can pass the check in thp_vma_allowable_order() as it >> is an anonymous-mmap, but then be collapsed as a file-mmap. >> >> It seems the problem has existed for a long time, but actually, since >> we have khugepaged_max_ptes_none check before, we will skip collapse it >> as it is /dev/zero and so has no present page. But commit d8ea7cc8547c >> limit the check for only khugepaged, so the BUG_ON() can be triggered >> by madvise_collapse(). >> >> Add vma_is_anonymous() check to make such vma be processed by >> hpage_collapse_scan_pmd(). >> >> Fixes: d8ea7cc8547c ("mm/khugepaged: add flag to predicate khugepaged-only behavior") >> Signed-off-by: Liu Shixin >> --- >> mm/khugepaged.c | 6 ++++-- >> 1 file changed, 4 insertions(+), 2 deletions(-) >> >> diff --git a/mm/khugepaged.c b/mm/khugepaged.c >> index 653dbb1ff05c..eb9d240e42e8 100644 >> --- a/mm/khugepaged.c >> +++ b/mm/khugepaged.c >> @@ -2422,7 +2422,8 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages, int *result, >> VM_BUG_ON(khugepaged_scan.address < hstart || >> khugepaged_scan.address + HPAGE_PMD_SIZE > >> hend); >> - if (IS_ENABLED(CONFIG_SHMEM) && vma->vm_file) { >> + if (IS_ENABLED(CONFIG_SHMEM) && vma->vm_file && >> + !vma_is_anonymous(vma)) { > > Thanks for catching this. It sounds a little bit weird to have vm_file for an anonymous VMA. I'm not sure why we should keep such special case. It seems shared mapping is treated as shmem file mapping. So can we set vm_file to NULL when mmap'ing /dev/zero for private mapping? Something like: > > diff --git a/drivers/char/mem.c b/drivers/char/mem.c > index 169eed162a7f..fc332efc5c11 100644 > --- a/drivers/char/mem.c > +++ b/drivers/char/mem.c > @@ -527,6 +527,7 @@ static int mmap_zero(struct file *file, struct vm_area_struct *vma) > if (vma->vm_flags & VM_SHARED) > return shmem_zero_setup(vma); > vma_set_anonymous(vma); > + vma->vm_file = NULL; > return 0; > } > Thanks for your advise, I'll look at it again.