From patchwork Mon Aug 24 08:31:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265087 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.7 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC8E6C433E1 for ; Mon, 24 Aug 2020 09:23:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9C3F62074D for ; Mon, 24 Aug 2020 09:23:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1598260992; bh=YTt8XDFjDpOBDwDUu9Z3lNGDKX7bk5qEbYYxEzD71g0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=KnmcebFLNJ1IDfC16IgpmHuGjDZk/pYohn9Q1rqoIt5xZv5/zq97nZ1Lra49/qEJs iQnwGZ+3Cu9oYenni4ve9RgkrWynmfTOO0d4h+bnGPsVA0jmkLfH1a5HxWzJiEjQsT S0eOGI6ppXRdTUtaEHE5/GmdrsfxrKDu8CcZNqvc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729006AbgHXJXM (ORCPT ); Mon, 24 Aug 2020 05:23:12 -0400 Received: from mail.kernel.org ([198.145.29.99]:35080 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730291AbgHXIy3 (ORCPT ); Mon, 24 Aug 2020 04:54:29 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 73ED62072D; Mon, 24 Aug 2020 08:54:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1598259268; bh=YTt8XDFjDpOBDwDUu9Z3lNGDKX7bk5qEbYYxEzD71g0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZSA300aRiGMct7UBo3oJI6tIf8mIpbHXq7unD16D49CLkcYCXIzlijhVgJKu7KZpb hoMZb/K1oOp9/tho9pk0vAx6tEhuiFHksSj0RqmHZhoRqy1hEuf95XqIPYQhZgjAxX 6h1UCjsW9L/UyNs6w6Ij2qbtxsIKwa9m/6ripT6M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Charan Teja Reddy , Andrew Morton , David Hildenbrand , David Rientjes , Michal Hocko , Vlastimil Babka , Vinayak Menon , Linus Torvalds Subject: [PATCH 4.14 15/50] mm, page_alloc: fix core hung in free_pcppages_bulk() Date: Mon, 24 Aug 2020 10:31:16 +0200 Message-Id: <20200824082352.747048151@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200824082351.823243923@linuxfoundation.org> References: <20200824082351.823243923@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Charan Teja Reddy commit 88e8ac11d2ea3acc003cf01bb5a38c8aa76c3cfd upstream. The following race is observed with the repeated online, offline and a delay between two successive online of memory blocks of movable zone. P1 P2 Online the first memory block in the movable zone. The pcp struct values are initialized to default values,i.e., pcp->high = 0 & pcp->batch = 1. Allocate the pages from the movable zone. Try to Online the second memory block in the movable zone thus it entered the online_pages() but yet to call zone_pcp_update(). This process is entered into the exit path thus it tries to release the order-0 pages to pcp lists through free_unref_page_commit(). As pcp->high = 0, pcp->count = 1 proceed to call the function free_pcppages_bulk(). Update the pcp values thus the new pcp values are like, say, pcp->high = 378, pcp->batch = 63. Read the pcp's batch value using READ_ONCE() and pass the same to free_pcppages_bulk(), pcp values passed here are, batch = 63, count = 1. Since num of pages in the pcp lists are less than ->batch, then it will stuck in while(list_empty(list)) loop with interrupts disabled thus a core hung. Avoid this by ensuring free_pcppages_bulk() is called with proper count of pcp list pages. The mentioned race is some what easily reproducible without [1] because pcp's are not updated for the first memory block online and thus there is a enough race window for P2 between alloc+free and pcp struct values update through onlining of second memory block. With [1], the race still exists but it is very narrow as we update the pcp struct values for the first memory block online itself. This is not limited to the movable zone, it could also happen in cases with the normal zone (e.g., hotplug to a node that only has DMA memory, or no other memory yet). [1]: https://patchwork.kernel.org/patch/11696389/ Fixes: 5f8dcc21211a ("page-allocator: split per-cpu list into one-list-per-migrate-type") Signed-off-by: Charan Teja Reddy Signed-off-by: Andrew Morton Acked-by: David Hildenbrand Acked-by: David Rientjes Acked-by: Michal Hocko Cc: Michal Hocko Cc: Vlastimil Babka Cc: Vinayak Menon Cc: [2.6+] Link: http://lkml.kernel.org/r/1597150703-19003-1-git-send-email-charante@codeaurora.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/page_alloc.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -1114,6 +1114,11 @@ static void free_pcppages_bulk(struct zo spin_lock(&zone->lock); isolated_pageblocks = has_isolate_pageblock(zone); + /* + * Ensure proper count is passed which otherwise would stuck in the + * below while (list_empty(list)) loop. + */ + count = min(pcp->count, count); while (count) { struct page *page; struct list_head *list;