linux-kernel - Re: [PATCH v4 1/3] mm/hugetlb: fix memory offline with hugepage size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 29 Sep 2016 14:11:04 +0200
From:   Michal Hocko <mhocko@...nel.org>
To:     Gerald Schaefer <gerald.schaefer@...ibm.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Naoya Horiguchi <n-horiguchi@...jp.nec.com>,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        "Kirill A . Shutemov" <kirill.shutemov@...ux.intel.com>,
        Vlastimil Babka <vbabka@...e.cz>,
        Mike Kravetz <mike.kravetz@...cle.com>,
        "Aneesh Kumar K . V" <aneesh.kumar@...ux.vnet.ibm.com>,
        Martin Schwidefsky <schwidefsky@...ibm.com>,
        Heiko Carstens <heiko.carstens@...ibm.com>,
        Rui Teng <rui.teng@...ux.vnet.ibm.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>
Subject: Re: [PATCH v4 1/3] mm/hugetlb: fix memory offline with hugepage size
 > memory block size

On Mon 26-09-16 19:28:09, Gerald Schaefer wrote:
> dissolve_free_huge_pages() will either run into the VM_BUG_ON() or a
> list corruption and addressing exception when trying to set a memory
> block offline that is part (but not the first part) of a "gigantic"
> hugetlb page with a size > memory block size.
> 
> When no other smaller hugetlb page sizes are present, the VM_BUG_ON()
> will trigger directly. In the other case we will run into an addressing
> exception later, because dissolve_free_huge_page() will not work on the
> head page of the compound hugetlb page which will result in a NULL
> hstate from page_hstate().
> 
> To fix this, first remove the VM_BUG_ON() because it is wrong, and then
> use the compound head page in dissolve_free_huge_page(). This means that
> an unused pre-allocated gigantic page that has any part of itself inside
> the memory block that is going offline will be dissolved completely.
> Losing an unused gigantic hugepage is preferable to failing the memory
> offline, for example in the situation where a (possibly faulty) memory
> DIMM needs to go offline.
> 
> Fixes: c8721bbb ("mm: memory-hotplug: enable memory hotplug to handle hugepage")
> Cc: <stable@...r.kernel.org>
> Signed-off-by: Gerald Schaefer <gerald.schaefer@...ibm.com>

Acked-by: Michal Hocko <mhocko@...e.com>

> ---
>  mm/hugetlb.c | 13 +++++++------
>  1 file changed, 7 insertions(+), 6 deletions(-)
> 
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index 87e11d8..603bdd0 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -1443,13 +1443,14 @@ static void dissolve_free_huge_page(struct page *page)
>  {
>  	spin_lock(&hugetlb_lock);
>  	if (PageHuge(page) && !page_count(page)) {
> -		struct hstate *h = page_hstate(page);
> -		int nid = page_to_nid(page);
> -		list_del(&page->lru);
> +		struct page *head = compound_head(page);
> +		struct hstate *h = page_hstate(head);
> +		int nid = page_to_nid(head);
> +		list_del(&head->lru);
>  		h->free_huge_pages--;
>  		h->free_huge_pages_node[nid]--;
>  		h->max_huge_pages--;
> -		update_and_free_page(h, page);
> +		update_and_free_page(h, head);
>  	}
>  	spin_unlock(&hugetlb_lock);
>  }
> @@ -1457,7 +1458,8 @@ static void dissolve_free_huge_page(struct page *page)
>  /*
>   * Dissolve free hugepages in a given pfn range. Used by memory hotplug to
>   * make specified memory blocks removable from the system.
> - * Note that start_pfn should aligned with (minimum) hugepage size.
> + * Note that this will dissolve a free gigantic hugepage completely, if any
> + * part of it lies within the given range.
>   */
>  void dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
>  {
> @@ -1466,7 +1468,6 @@ void dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
>  	if (!hugepages_supported())
>  		return;
>  
> -	VM_BUG_ON(!IS_ALIGNED(start_pfn, 1 << minimum_order));
>  	for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order)
>  		dissolve_free_huge_page(pfn_to_page(pfn));
>  }
> -- 
> 2.8.4

-- 
Michal Hocko
SUSE Labs