linux-kernel - Re: Suspicious error for CMA stress test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 8 Mar 2016 17:09:32 +0900
From:	Joonsoo Kim <iamjoonsoo.kim@....com>
To:	Xishi Qiu <qiuxishi@...wei.com>
Cc:	Hanjun Guo <guohanjun@...wei.com>,
	Laura Abbott <labbott@...hat.com>,
	"linux-arm-kernel@...ts.infradead.org" 
	<linux-arm-kernel@...ts.infradead.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Sasha Levin <sasha.levin@...cle.com>,
	Laura Abbott <lauraa@...eaurora.org>,
	Catalin Marinas <Catalin.Marinas@....com>,
	Will Deacon <will.deacon@....com>,
	Arnd Bergmann <arnd@...db.de>,
	"thunder.leizhen@...wei.com" <thunder.leizhen@...wei.com>,
	dingtinahong <dingtianhong@...wei.com>, chenjie6@...wei.com,
	"linux-mm@...ck.org" <linux-mm@...ck.org>
Subject: Re: Suspicious error for CMA stress test

On Tue, Mar 08, 2016 at 09:42:00AM +0800, Xishi Qiu wrote:
> On 2016/3/4 13:33, Hanjun Guo wrote:
> 
> > Hi Joonsoo,
> > 
> > On 2016/3/4 10:02, Joonsoo Kim wrote:
> >> On Thu, Mar 03, 2016 at 08:49:01PM +0800, Hanjun Guo wrote:
> >>> On 2016/3/3 15:42, Joonsoo Kim wrote:
> >>>> 2016-03-03 10:25 GMT+09:00 Laura Abbott <labbott@...hat.com>:
> >>>>> (cc -mm and Joonsoo Kim)
> >>>>>
> >>>>>
> >>>>> On 03/02/2016 05:52 AM, Hanjun Guo wrote:
> >>>>>> Hi,
> >>>>>>
> >>>>>> I came across a suspicious error for CMA stress test:
> >>>>>>
> >>>>>> Before the test, I got:
> >>>>>> -bash-4.3# cat /proc/meminfo | grep Cma
> >>>>>> CmaTotal:         204800 kB
> >>>>>> CmaFree:          195044 kB
> >>>>>>
> >>>>>>
> >>>>>> After running the test:
> >>>>>> -bash-4.3# cat /proc/meminfo | grep Cma
> >>>>>> CmaTotal:         204800 kB
> >>>>>> CmaFree:         6602584 kB
> >>>>>>
> >>>>>> So the freed CMA memory is more than total..
> >>>>>>
> >>>>>> Also the the MemFree is more than mem total:
> >>>>>>
> >>>>>> -bash-4.3# cat /proc/meminfo
> >>>>>> MemTotal:       16342016 kB
> >>>>>> MemFree:        22367268 kB
> >>>>>> MemAvailable:   22370528 kB
> >>> [...]
> >>>>> I played with this a bit and can see the same problem. The sanity
> >>>>> check of CmaFree < CmaTotal generally triggers in
> >>>>> __move_zone_freepage_state in unset_migratetype_isolate.
> >>>>> This also seems to be present as far back as v4.0 which was the
> >>>>> first version to have the updated accounting from Joonsoo.
> >>>>> Were there known limitations with the new freepage accounting,
> >>>>> Joonsoo?
> >>>> I don't know. I also played with this and looks like there is
> >>>> accounting problem, however, for my case, number of free page is slightly less
> >>>> than total. I will take a look.
> >>>>
> >>>> Hanjun, could you tell me your malloc_size? I tested with 1 and it doesn't
> >>>> look like your case.
> >>> I tested with malloc_size with 2M, and it grows much bigger than 1M, also I
> >>> did some other test:
> >> Thanks! Now, I can re-generate erronous situation you mentioned.
> >>
> >>>  - run with single thread with 100000 times, everything is fine.
> >>>
> >>>  - I hack the cam_alloc() and free as below [1] to see if it's lock issue, with
> >>>    the same test with 100 multi-thread, then I got:
> >> [1] would not be sufficient to close this race.
> >>
> >> Try following things [A]. And, for more accurate test, I changed code a bit more
> >> to prevent kernel page allocation from cma area [B]. This will prevent kernel
> >> page allocation from cma area completely so we can focus cma_alloc/release race.
> >>
> >> Although, this is not correct fix, it could help that we can guess
> >> where the problem is.
> >>
> >> Thanks.
> >>
> >> [A]
> > 
> > I tested this solution [A], it can fix the problem, as you are posting a new patch, I will
> > test that one and leave [B] alone :)
> > 
> 
> Hi Joonsoo,
> 
> How does this problem happen? Why the count is larger than total?
> 
> Patch A prevent the cma page free to pcp, right?
> 
> ...
> -               if (unlikely(is_migrate_isolate(migratetype))) {
> +               if (is_migrate_cma(migratetype) ||
> +                       unlikely(is_migrate_isolate(migratetype))) {
> ...
> > .
> > 

Even without free to pcp, bad merging could happen. Please see another
thread I mentioned some example.

Thanks.