From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754434AbdC1Gdn (ORCPT ); Tue, 28 Mar 2017 02:33:43 -0400 Received: from terminus.zytor.com ([65.50.211.136]:39733 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753925AbdC1Gdm (ORCPT ); Tue, 28 Mar 2017 02:33:42 -0400 Date: Mon, 27 Mar 2017 23:28:05 -0700 From: "tip-bot for Kirill A. Shutemov" Message-ID: Cc: lkp@01.org, kirill.shutemov@linux.intel.com, mingo@kernel.org, linux-kernel@vger.kernel.org, fengguang.wu@intel.com, tglx@linutronix.de, torvalds@linux-foundation.org, hpa@zytor.com, peterz@infradead.org, aneesh.kumar@linux.vnet.ibm.com, akpm@linux-foundation.org, kirill@shutemov.name Reply-To: tglx@linutronix.de, linux-kernel@vger.kernel.org, fengguang.wu@intel.com, kirill.shutemov@linux.intel.com, mingo@kernel.org, lkp@01.org, kirill@shutemov.name, akpm@linux-foundation.org, peterz@infradead.org, aneesh.kumar@linux.vnet.ibm.com, hpa@zytor.com, torvalds@linux-foundation.org In-Reply-To: <20170324114709.pcytvyb3d6ajux33@black.fi.intel.com> References: <20170324114709.pcytvyb3d6ajux33@black.fi.intel.com> To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/mm] mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative() Git-Commit-ID: 591a3d7c09fa08baff48ad86c2347dbd28a52753 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 591a3d7c09fa08baff48ad86c2347dbd28a52753 Gitweb: http://git.kernel.org/tip/591a3d7c09fa08baff48ad86c2347dbd28a52753 Author: Kirill A. Shutemov AuthorDate: Fri, 24 Mar 2017 14:13:05 +0300 Committer: Ingo Molnar CommitDate: Tue, 28 Mar 2017 08:23:27 +0200 mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative() 0day testing by Fengguang Wu triggered this crash while running Trinity: kernel BUG at include/linux/pagemap.h:151! ... CPU: 0 PID: 458 Comm: trinity-c0 Not tainted 4.11.0-rc2-00251-g2947ba0 #1 ... Call Trace: __get_user_pages_fast() get_user_pages_fast() get_futex_key() futex_requeue() do_futex() SyS_futex() do_syscall_64() entry_SYSCALL64_slow_path() It' VM_BUG_ON() due to false-negative in_atomic(). We call page_cache_get_speculative() with disabled local interrupts. It should be atomic enough. So let's check for disabled interrupts in the VM_BUG_ON() condition too, to resolve this. ( This got triggered by the conversion of the x86 GUP code to the generic GUP code. ) Reported-by: Fengguang Wu Signed-off-by: Kirill A. Shutemov Cc: Andrew Morton Cc: Aneesh Kumar K.V Cc: Kirill A. Shutemov Cc: LKP Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-mm@kvack.org Link: http://lkml.kernel.org/r/20170324114709.pcytvyb3d6ajux33@black.fi.intel.com Signed-off-by: Ingo Molnar --- include/linux/pagemap.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h index 84943e8..316a19f 100644 --- a/include/linux/pagemap.h +++ b/include/linux/pagemap.h @@ -148,7 +148,7 @@ static inline int page_cache_get_speculative(struct page *page) #ifdef CONFIG_TINY_RCU # ifdef CONFIG_PREEMPT_COUNT - VM_BUG_ON(!in_atomic()); + VM_BUG_ON(!in_atomic() && !irqs_disabled()); # endif /* * Preempt must be disabled here - we rely on rcu_read_lock doing @@ -186,7 +186,7 @@ static inline int page_cache_add_speculative(struct page *page, int count) #if !defined(CONFIG_SMP) && defined(CONFIG_TREE_RCU) # ifdef CONFIG_PREEMPT_COUNT - VM_BUG_ON(!in_atomic()); + VM_BUG_ON(!in_atomic() && !irqs_disabled()); # endif VM_BUG_ON_PAGE(page_count(page) == 0, page); page_ref_add(page, count);