From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E3D501C4617 for ; Tue, 14 Jan 2025 16:56:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736873767; cv=none; b=girs8vuJHXzFexuzcOpXRk2QClFFf+ShPq1ZjG/emjDTro63ih6zop1NWCKH8mhnogu8uKYIQOuUA8d7idzBdaVYfMb3kKB1g7mH/cZoMleCcZ1pFGqFSHPhaChnegdaDpjZjKIkBF+cTlzaLxK9fv1jtrROpXYxPK0a9VMzfBQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736873767; c=relaxed/simple; bh=gAHYTL+B/GjzXUMRb5UILjYeFBtSaaMzvGMUSK6n3dY=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=Z1hPO/89ZWQdQ3NHoc5CX/RJx24OFKYCbwTA91rGQ+z/6/+aIgVIqLejyoCE2sXkFAM1HS0JPJ5W7WU1wgPnIVj7fHkcjqPjResK/hDRyGjedzgum7nH+FGKzBc3tcOKk8k7sRmFRPux2uHLRfKX5q7t7LLPBbhNup6qJabZMWI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=K9NfZXo/; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="K9NfZXo/" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1736873764; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=h6Gor6sTKcjI2QqcyTJxmHY6uAfFO4pJfYYOecKeWC8=; b=K9NfZXo/6jZPQLgGeeo+GsEnfLRZRd4mDYQbondvQH61WaPe9wzTjWc8oqz8E5Gwxct6pS CGXlyJIRvV2yKC4zfCT3WA29yxY94RYB0t1TRQsYhPuw5YlzAluGaM0xtV5lX8sFpLWGPz AqUGR1q4igR9yFRiwyPHIIVB7564j/8= Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-621-5VmU1A1UNCmf3ubX85svaQ-1; Tue, 14 Jan 2025 11:56:03 -0500 X-MC-Unique: 5VmU1A1UNCmf3ubX85svaQ-1 X-Mimecast-MFC-AGG-ID: 5VmU1A1UNCmf3ubX85svaQ Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-386321c8f4bso3486031f8f.0 for ; Tue, 14 Jan 2025 08:56:03 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1736873762; x=1737478562; h=content-transfer-encoding:in-reply-to:organization:autocrypt :content-language:from:references:cc:to:subject:user-agent :mime-version:date:message-id:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=h6Gor6sTKcjI2QqcyTJxmHY6uAfFO4pJfYYOecKeWC8=; b=kqaxae9M8X9G4l0SrcO5z+WN5GmDubSiUyptLk2R0s0Q38SV51thhxQ50MbTIjOi7p AvyDdL891O+rcL+rNqWD9K5qxa6YSl+7WbhS3on0QzmSrAy7/oXtxZE/OrEiEbPIW2c+ hXeJPYvi5Fz+AN/K1LqHKDnZqrKQtDfbRF9I/lTLC7gn0r7OvPwFgC9XBN4IqtFl+rU9 4tEuQxrQNI/NwUji+dtnap54NGhm3cPN6z0r8Sor+I5oEPUoyXnzIF+fDdwV9MDdf2df RiuANg4vS+9MzJ1f7XYPJS9PHV5/rfT9D7b/ckbYHxMOylGopjpAil9ZFk2BwMhma6ph KQww== X-Forwarded-Encrypted: i=1; AJvYcCVQJ1MZuvm2ZLBBRXrS8F2UKEUwEKduBf4ccl4AqT7so7jwO6FF7rrJbR5WgtMwUcwD5DHJ+7FZCFsPOyY=@vger.kernel.org X-Gm-Message-State: AOJu0YyOS4MdOxv2P5dk/vz8AwKI0dRDb7UfxsF2P3FPTnXkN+rnAqp3 3yo/90RVH0lsb72wp/yG81DHuagD15F5yf/URjvZe8Xcy7CnyBW10ZZMTJu8haMiw6yBu/znv62 fOvRNwHqoFpljDgz2sXbuAgV7vjb+UKCraDZEHLqSYTijBr4k9MLlOBB68gro1g== X-Gm-Gg: ASbGncs5aJU8uCIRusAR8OqP1nhOtVTTe5h0fu2F5nrLOoflUGt/5T2Z5nEXRSoGDPJ +D4EQyfZoJW4HBTPxRuPAfTulHgYLHtMptPwtG3GuhUc8myNkWb/eYal/FKME2ManUDAogQiM3G oOVBkjYPhhr+ZAqVwzWZMk1lpt2eA60rhzeysy6rx2azPUkmjcEDGyrHXx6xYVdXV0bvE8F5RTi XszoO0nCljl+PwJ8CIBdofWWDGxct5kWLe77d3Yg5xNyCV47DUDHzx0kv9TmkhnHipIs+wFRj2C FmGT0+PifcruKz+JtP79unOi7iTE70pDTY4p7H9rCnfZPfULmJ46V7jgyDUICOy53woUHFYQbiY NTtbx6IlT X-Received: by 2002:a05:6000:712:b0:38a:615c:8225 with SMTP id ffacd0b85a97d-38a87305486mr23850578f8f.15.1736873762345; Tue, 14 Jan 2025 08:56:02 -0800 (PST) X-Google-Smtp-Source: AGHT+IHy/t+cZ06mVPbQfH5iY73jEdURrbiuSyLV5maqJwRDoZHlNNFDRgcMHm6T0f88QYOPOCoiFA== X-Received: by 2002:a05:6000:712:b0:38a:615c:8225 with SMTP id ffacd0b85a97d-38a87305486mr23850558f8f.15.1736873762003; Tue, 14 Jan 2025 08:56:02 -0800 (PST) Received: from ?IPV6:2003:cb:c738:3100:8133:26cf:7877:94aa? (p200300cbc7383100813326cf787794aa.dip0.t-ipconnect.de. [2003:cb:c738:3100:8133:26cf:7877:94aa]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-38a8e37d0fasm15648659f8f.19.2025.01.14.08.56.00 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 14 Jan 2025 08:56:01 -0800 (PST) Message-ID: Date: Tue, 14 Jan 2025 17:56:00 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2] mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma To: Liu Shixin , Andrew Morton , Chengming Zhou , Matthew Wilcox , Kefeng Wang , Nanyong Sun , Muchun Song , Qi Zheng , Johannes Weiner , Yang Shi Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org References: <20250111034511.2223353-1-liushixin2@huawei.com> From: David Hildenbrand Content-Language: en-US Autocrypt: addr=david@redhat.com; keydata= xsFNBFXLn5EBEAC+zYvAFJxCBY9Tr1xZgcESmxVNI/0ffzE/ZQOiHJl6mGkmA1R7/uUpiCjJ dBrn+lhhOYjjNefFQou6478faXE6o2AhmebqT4KiQoUQFV4R7y1KMEKoSyy8hQaK1umALTdL QZLQMzNE74ap+GDK0wnacPQFpcG1AE9RMq3aeErY5tujekBS32jfC/7AnH7I0v1v1TbbK3Gp XNeiN4QroO+5qaSr0ID2sz5jtBLRb15RMre27E1ImpaIv2Jw8NJgW0k/D1RyKCwaTsgRdwuK Kx/Y91XuSBdz0uOyU/S8kM1+ag0wvsGlpBVxRR/xw/E8M7TEwuCZQArqqTCmkG6HGcXFT0V9 PXFNNgV5jXMQRwU0O/ztJIQqsE5LsUomE//bLwzj9IVsaQpKDqW6TAPjcdBDPLHvriq7kGjt WhVhdl0qEYB8lkBEU7V2Yb+SYhmhpDrti9Fq1EsmhiHSkxJcGREoMK/63r9WLZYI3+4W2rAc UucZa4OT27U5ZISjNg3Ev0rxU5UH2/pT4wJCfxwocmqaRr6UYmrtZmND89X0KigoFD/XSeVv jwBRNjPAubK9/k5NoRrYqztM9W6sJqrH8+UWZ1Idd/DdmogJh0gNC0+N42Za9yBRURfIdKSb B3JfpUqcWwE7vUaYrHG1nw54pLUoPG6sAA7Mehl3nd4pZUALHwARAQABzSREYXZpZCBIaWxk ZW5icmFuZCA8ZGF2aWRAcmVkaGF0LmNvbT7CwZgEEwEIAEICGwMGCwkIBwMCBhUIAgkKCwQW AgMBAh4BAheAAhkBFiEEG9nKrXNcTDpGDfzKTd4Q9wD/g1oFAl8Ox4kFCRKpKXgACgkQTd4Q 9wD/g1oHcA//a6Tj7SBNjFNM1iNhWUo1lxAja0lpSodSnB2g4FCZ4R61SBR4l/psBL73xktp rDHrx4aSpwkRP6Epu6mLvhlfjmkRG4OynJ5HG1gfv7RJJfnUdUM1z5kdS8JBrOhMJS2c/gPf wv1TGRq2XdMPnfY2o0CxRqpcLkx4vBODvJGl2mQyJF/gPepdDfcT8/PY9BJ7FL6Hrq1gnAo4 3Iv9qV0JiT2wmZciNyYQhmA1V6dyTRiQ4YAc31zOo2IM+xisPzeSHgw3ONY/XhYvfZ9r7W1l pNQdc2G+o4Di9NPFHQQhDw3YTRR1opJaTlRDzxYxzU6ZnUUBghxt9cwUWTpfCktkMZiPSDGd KgQBjnweV2jw9UOTxjb4LXqDjmSNkjDdQUOU69jGMUXgihvo4zhYcMX8F5gWdRtMR7DzW/YE BgVcyxNkMIXoY1aYj6npHYiNQesQlqjU6azjbH70/SXKM5tNRplgW8TNprMDuntdvV9wNkFs 9TyM02V5aWxFfI42+aivc4KEw69SE9KXwC7FSf5wXzuTot97N9Phj/Z3+jx443jo2NR34XgF 89cct7wJMjOF7bBefo0fPPZQuIma0Zym71cP61OP/i11ahNye6HGKfxGCOcs5wW9kRQEk8P9 M/k2wt3mt/fCQnuP/mWutNPt95w9wSsUyATLmtNrwccz63XOwU0EVcufkQEQAOfX3n0g0fZz Bgm/S2zF/kxQKCEKP8ID+Vz8sy2GpDvveBq4H2Y34XWsT1zLJdvqPI4af4ZSMxuerWjXbVWb T6d4odQIG0fKx4F8NccDqbgHeZRNajXeeJ3R7gAzvWvQNLz4piHrO/B4tf8svmRBL0ZB5P5A 2uhdwLU3NZuK22zpNn4is87BPWF8HhY0L5fafgDMOqnf4guJVJPYNPhUFzXUbPqOKOkL8ojk CXxkOFHAbjstSK5Ca3fKquY3rdX3DNo+EL7FvAiw1mUtS+5GeYE+RMnDCsVFm/C7kY8c2d0G NWkB9pJM5+mnIoFNxy7YBcldYATVeOHoY4LyaUWNnAvFYWp08dHWfZo9WCiJMuTfgtH9tc75 7QanMVdPt6fDK8UUXIBLQ2TWr/sQKE9xtFuEmoQGlE1l6bGaDnnMLcYu+Asp3kDT0w4zYGsx 5r6XQVRH4+5N6eHZiaeYtFOujp5n+pjBaQK7wUUjDilPQ5QMzIuCL4YjVoylWiBNknvQWBXS lQCWmavOT9sttGQXdPCC5ynI+1ymZC1ORZKANLnRAb0NH/UCzcsstw2TAkFnMEbo9Zu9w7Kv AxBQXWeXhJI9XQssfrf4Gusdqx8nPEpfOqCtbbwJMATbHyqLt7/oz/5deGuwxgb65pWIzufa N7eop7uh+6bezi+rugUI+w6DABEBAAHCwXwEGAEIACYCGwwWIQQb2cqtc1xMOkYN/MpN3hD3 AP+DWgUCXw7HsgUJEqkpoQAKCRBN3hD3AP+DWrrpD/4qS3dyVRxDcDHIlmguXjC1Q5tZTwNB boaBTPHSy/Nksu0eY7x6HfQJ3xajVH32Ms6t1trDQmPx2iP5+7iDsb7OKAb5eOS8h+BEBDeq 3ecsQDv0fFJOA9ag5O3LLNk+3x3q7e0uo06XMaY7UHS341ozXUUI7wC7iKfoUTv03iO9El5f XpNMx/YrIMduZ2+nd9Di7o5+KIwlb2mAB9sTNHdMrXesX8eBL6T9b+MZJk+mZuPxKNVfEQMQ a5SxUEADIPQTPNvBewdeI80yeOCrN+Zzwy/Mrx9EPeu59Y5vSJOx/z6OUImD/GhX7Xvkt3kq Er5KTrJz3++B6SH9pum9PuoE/k+nntJkNMmQpR4MCBaV/J9gIOPGodDKnjdng+mXliF3Ptu6 3oxc2RCyGzTlxyMwuc2U5Q7KtUNTdDe8T0uE+9b8BLMVQDDfJjqY0VVqSUwImzTDLX9S4g/8 kC4HRcclk8hpyhY2jKGluZO0awwTIMgVEzmTyBphDg/Gx7dZU1Xf8HFuE+UZ5UDHDTnwgv7E th6RC9+WrhDNspZ9fJjKWRbveQgUFCpe1sa77LAw+XFrKmBHXp9ZVIe90RMe2tRL06BGiRZr jPrnvUsUUsjRoRNJjKKA/REq+sAnhkNPPZ/NNMjaZ5b8Tovi8C0tmxiCHaQYqj7G2rgnT0kt WNyWQQ== Organization: Red Hat In-Reply-To: <20250111034511.2223353-1-liushixin2@huawei.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 11.01.25 04:45, Liu Shixin wrote: > syzkaller reported such a BUG_ON(): > > ------------[ cut here ]------------ > kernel BUG at mm/khugepaged.c:1835! > Internal error: Oops - BUG: 00000000f2000800 [#1] SMP > ... > CPU: 6 UID: 0 PID: 8009 Comm: syz.15.106 Kdump: loaded Tainted: G W 6.13.0-rc6 #22 > Tainted: [W]=WARN > Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 > pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) > pc : collapse_file+0xa44/0x1400 > lr : collapse_file+0x88/0x1400 > sp : ffff80008afe3a60 > ... > Call trace: > collapse_file+0xa44/0x1400 (P) > hpage_collapse_scan_file+0x278/0x400 > madvise_collapse+0x1bc/0x678 > madvise_vma_behavior+0x32c/0x448 > madvise_walk_vmas.constprop.0+0xbc/0x140 > do_madvise.part.0+0xdc/0x2c8 > __arm64_sys_madvise+0x68/0x88 > invoke_syscall+0x50/0x120 > el0_svc_common.constprop.0+0xc8/0xf0 > do_el0_svc+0x24/0x38 > el0_svc+0x34/0x128 > el0t_64_sync_handler+0xc8/0xd0 > el0t_64_sync+0x190/0x198 > > This indicates that the pgoff is unaligned. After analysis, I confirm > the vma is mapped to /dev/zero. Such a vma certainly has vm_file, but > it is set to anonymous by mmap_zero(). So even if it's mmapped by > 2m-unaligned, it can pass the check in thp_vma_allowable_order() as it > is an anonymous-mmap, but then be collapsed as a file-mmap. > > It seems the problem has existed for a long time, but actually, since > we have khugepaged_max_ptes_none check before, we will skip collapse it > as it is /dev/zero and so has no present page. But commit d8ea7cc8547c > limit the check for only khugepaged, so the BUG_ON() can be triggered > by madvise_collapse(). > > Add vma_is_anonymous() check to make such vma be processed by > hpage_collapse_scan_pmd(). > > Fixes: d8ea7cc8547c ("mm/khugepaged: add flag to predicate khugepaged-only behavior") > Signed-off-by: Liu Shixin > --- > v1->v2: Remove the redundant vm_file check, suggested by Matthew Wilcox. > > mm/khugepaged.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/mm/khugepaged.c b/mm/khugepaged.c > index 653dbb1ff05c..bad1e130eda8 100644 > --- a/mm/khugepaged.c > +++ b/mm/khugepaged.c > @@ -2422,7 +2422,7 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages, int *result, > VM_BUG_ON(khugepaged_scan.address < hstart || > khugepaged_scan.address + HPAGE_PMD_SIZE > > hend); > - if (IS_ENABLED(CONFIG_SHMEM) && vma->vm_file) { > + if (IS_ENABLED(CONFIG_SHMEM) && !vma_is_anonymous(vma)) { > struct file *file = get_file(vma->vm_file); > pgoff_t pgoff = linear_page_index(vma, > khugepaged_scan.address); > @@ -2768,7 +2768,7 @@ int madvise_collapse(struct vm_area_struct *vma, struct vm_area_struct **prev, > mmap_assert_locked(mm); > memset(cc->node_load, 0, sizeof(cc->node_load)); > nodes_clear(cc->alloc_nmask); > - if (IS_ENABLED(CONFIG_SHMEM) && vma->vm_file) { > + if (IS_ENABLED(CONFIG_SHMEM) && !vma_is_anonymous(vma)) { > struct file *file = get_file(vma->vm_file); > pgoff_t pgoff = linear_page_index(vma, addr); > Acked-by: David Hildenbrand The whole CONFIG_SHMEM is all weird and needs to be cleaned up ... at some point. BTW, do we correctly handle MAP_PRIVATE of these files, where we would have vma->vm_file and !vma_is_anonymous(vma), but could end up having anonymous pages in there? -- Cheers, David / dhildenb