• Mel Gorman's avatar
    mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault · 2f84a899
    Mel Gorman authored
    SunDong reported the following on
    
      https://bugzilla.kernel.org/show_bug.cgi?id=103841
    
    	I think I find a linux bug, I have the test cases is constructed. I
    	can stable recurring problems in fedora22(4.0.4) kernel version,
    	arch for x86_64.  I construct transparent huge page, when the parent
    	and child process with MAP_SHARE, MAP_PRIVATE way to access the same
    	huge page area, it has the opportunity to lead to huge page copy on
    	write failure, and then it will munmap the child corresponding mmap
    	area, but then the child mmap area with VM_MAYSHARE attributes, child
    	process munmap this area can trigger VM_BUG_ON in set_vma_resv_flags
    	functions (vma - > vm_flags & VM_MAYSHARE).
    
    There were a number of problems with the report (e.g.  it's hugetlbfs that
    triggers this, not transparent huge pages) but it was fundamentally
    correct in that a VM_BUG_ON in set_vma_resv_flags() can be triggered that
    looks like this
    
    	 vma ffff8804651fd0d0 start 00007fc474e00000 end 00007fc475e00000
    	 next ffff8804651fd018 prev ffff8804651fd188 mm ffff88046b1b1800
    	 prot 8000000000000027 anon_vma           (null) vm_ops ffffffff8182a7a0
    	 pgoff 0 file ffff88106bdb9800 private_data           (null)
    	 flags: 0x84400fb(read|write|shared|mayread|maywrite|mayexec|mayshare|dontexpand|hugetlb)
    	 ------------
    	 kernel BUG at mm/hugetlb.c:462!
    	 SMP
    	 Modules linked in: xt_pkttype xt_LOG xt_limit [..]
    	 CPU: 38 PID: 26839 Comm: map Not tainted 4.0.4-default #1
    	 Hardware name: Dell Inc. PowerEdge R810/0TT6JF, BIOS 2.7.4 04/26/2012
    	 set_vma_resv_flags+0x2d/0x30
    
    The VM_BUG_ON is correct because private and shared mappings have
    different reservation accounting but the warning clearly shows that the
    VMA is shared.
    
    When a private COW fails to allocate a new page then only the process
    that created the VMA gets the page -- all the children unmap the page.
    If the children access that data in the future then they get killed.
    
    The problem is that the same file is mapped shared and private.  During
    the COW, the allocation fails, the VMAs are traversed to unmap the other
    private pages but a shared VMA is found and the bug is triggered.  This
    patch identifies such VMAs and skips them.
    Signed-off-by: default avatarMel Gorman <mgorman@techsingularity.net>
    Reported-by: default avatarSunDong <sund_sky@126.com>
    Reviewed-by: default avatarMichal Hocko <mhocko@suse.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Cc: David Rientjes <rientjes@google.com>
    Reviewed-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    2f84a899
hugetlb.c 115 KB