From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C0DB71DB134 for ; Fri, 24 Jan 2025 21:38:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737754694; cv=none; b=arJFDNsqYjTEZP1r2glU8T/2U2gsegacp0Svm/33BRa0ZnHcSrvDLiGzG+/DJEhfiVhOW6AfB3KccUZguNgiNbsSdnShabvAJoz3p7T6PXhRvWYKz5xNy0xjyucuNm/y21IQ3zwQ0XGE/ge3uhZS//+lYRz9hMaTdmwsfl2FJus= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737754694; c=relaxed/simple; bh=DG54KmF/50E49ucu9yNh69nP5VnrEKfLYP9zfsytkAg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=YvJUfVXtgLms5vyEvtshiFJkJDtqJqdxQAQAlDy2MBFvUN3KILGoXXDupHs5GyFRz3MarX/vfZ85McgwW/s0zQTmBV7ZlTSmPYgvlu300Mvx6r8XUsF1EjTYSZI0B8TqE699fCRu54ILjD7CZedeOKorcr/lrI6YwnAQpH5AdWI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=fyF2ntHZ; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="fyF2ntHZ" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1737754691; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=S1Rj0QeYO3hca/MmP35mGJM4crnyiUncOhL6KeywySY=; b=fyF2ntHZJjQdteGTl2nWL/I0pjrC59qNSPW4DtOkSX6QbSNBqyFM6OpOMu9pV5ZF4iWO/H u6W4mjZdPtgdKPUGSQJ3bNp0umrPFHXVRDSAFLeDYwIkoujoLoA91ruEoPavAZHMB8HoTm ldonpDU5MXVi9rDcM4uu0zWoX8azHDY= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-594-kYvpklsIOkGruIprZdg86A-1; Fri, 24 Jan 2025 16:38:08 -0500 X-MC-Unique: kYvpklsIOkGruIprZdg86A-1 X-Mimecast-MFC-AGG-ID: kYvpklsIOkGruIprZdg86A Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 599A319560AF; Fri, 24 Jan 2025 21:38:06 +0000 (UTC) Received: from fedora.redhat.com (unknown [10.22.81.148]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id C0D2F1800348; Fri, 24 Jan 2025 21:38:03 +0000 (UTC) From: Luiz Capitulino To: linux-kernel@vger.kernel.org, linux-mm@kvack.org, david@redhat.com, yuzhao@google.com Cc: akpm@linux-foundation.org, hannes@cmpxchg.org, muchun.song@linux.dev, lcapitulino@gmail.com, luizcap@redhat.com Subject: [RFC 0/4] mm: page_ext: Fix crash when reserving 1G pages Date: Fri, 24 Jan 2025 16:37:50 -0500 Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Hi, [ Thanks to David Hildenbrand for identifying the root cause of this issue and proving guidance on how to fix it. The new API idea, bugs and misconceptions are all mine though ] Currently, trying to reserve 1G pages with page_owner=on and sparsemem causes a crash. The reproducer is very simple: 1. Build the kernel with CONFIG_SPARSEMEM=y and the table extensions 2. Pass 'default_hugepagesz=1 page_owner=on' in the kernel command-line 3. Reserve one 1G page at run-time, this should crash (see patch 1 for backtrace) [ A crash with page_table_check is also possible, but harder to trigger ] Apparently, starting with commit e98337d11bbd ("mm/contig_alloc: support __GFP_COMP") we now pass the full allocation order to page extension clients and the page extension implementation assumes that all PFNs of an allocation range will be stored in the same memory section (which is not true for 1G pages). To fix this, this series introduces a new iteration API for page extension objects. The API ensures that we always lookup the memory sections for the next page extension in the iteration. While this series seems to fix the issue, it's RFC because: 1. page_ext_iter_next() uses brute-force. David suggested to maintain the current API but only do a memory section lookup if the next PFN aligns with PAGE_PER_SECTION (ie. it's the first PFN of a section). But I couldn't make it work: I was getting random crashes and RCU warnings 2. It's very lightly tested Luiz Capitulino (4): mm: page_ext: add an iteration API for page extensions mm: page_owner: use new iteration API mm: page_table_check: use new iteration API mm: page_ext: drop page_ext_next() include/linux/page_ext.h | 15 +++++---- mm/page_ext.c | 55 ++++++++++++++++++++++++++++++++ mm/page_owner.c | 68 ++++++++++++++++++++++++++-------------- mm/page_table_check.c | 21 +++++++------ 4 files changed, 120 insertions(+), 39 deletions(-) -- 2.47.1