| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <Y8Oo3+9UmZ4ac8sW@google.com>
Date: Sun, 15 Jan 2023 16:18:55 +0900
From: Sergey Senozhatsky <senozhatsky@...omium.org>
To: Matthew Wilcox <willy@...radead.org>,
Andrew Morton <akpm@...ux-foundation.org>
Cc: Mike Kravetz <mike.kravetz@...cle.com>,
Minchan Kim <minchan@...nel.org>, linux-kernel@...r.kernel.org,
linux-mm@...ck.org, Sergey Senozhatsky <senozhatsky@...omium.org>
Subject: Re: [PATCHv2 0/4] zsmalloc: make zspage chain size configurable
Cc-ing Matthew,
On (23/01/14 16:08), Sergey Senozhatsky wrote:
> [ 87.208255] ------------[ cut here ]------------
> [ 87.209431] WARNING: CPU: 18 PID: 300 at mm/migrate.c:995 move_to_new_folio+0x1ef/0x260
> [ 87.211993] Modules linked in: deflate zlib_deflate zstd zstd_compress zram
> [ 87.214287] CPU: 18 PID: 300 Comm: kcompactd0 Tainted: G N 6.2.0-rc3-next-20230113+ #385
> [ 87.217529] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014
> [ 87.220131] RIP: 0010:move_to_new_folio+0x1ef/0x260
> [ 87.221892] Code: 84 c0 74 78 48 8b 43 18 44 89 ea 48 89 de 4c 89 e7 ff 50 06 85 c0 0f 85 a9 fe ff ff 48 8b 03 a9 00 00 04 00 0f 85 7a fe ff ff <0f> 0b e9 73 fe ff ff 48 8b 03 f6 c4 20 74 2a be c0 0c 00 00 48 89
> [ 87.226514] RSP: 0018:ffffc90000b9fb08 EFLAGS: 00010246
> [ 87.227879] RAX: 4000000000000021 RBX: ffffea0000890500 RCX: 0000000000000000
> [ 87.230948] RDX: 0000000000000000 RSI: ffffffff81e6f950 RDI: ffffea0000890500
> [ 87.233026] RBP: ffffea0000890500 R08: 0000001e82ec3c3e R09: 0000000000000001
> [ 87.235517] R10: 00000000ffffffff R11: 00000000ffffffff R12: ffffea00015a26c0
> [ 87.237807] R13: 0000000000000001 R14: ffffea00015a2680 R15: ffffea00008904c0
> [ 87.239438] FS: 0000000000000000(0000) GS:ffff888624200000(0000) knlGS:0000000000000000
> [ 87.241303] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 87.242627] CR2: 00007fe537ebbdb8 CR3: 0000000110a0a004 CR4: 0000000000770ee0
> [ 87.244283] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 87.245913] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [ 87.247559] PKRU: 55555554
> [ 87.248269] Call Trace:
> [ 87.248862] <TASK>
> [ 87.249370] ? lock_is_held_type+0xd9/0x130
> [ 87.250377] migrate_pages_batch+0x553/0xc80
> [ 87.251513] ? move_freelist_tail+0xc0/0xc0
> [ 87.252545] ? isolate_freepages+0x290/0x290
> [ 87.253654] ? trace_mm_migrate_pages+0xf0/0xf0
> [ 87.254901] migrate_pages+0x1ae/0x330
> [ 87.255877] ? isolate_freepages+0x290/0x290
> [ 87.257015] ? move_freelist_tail+0xc0/0xc0
> [ 87.258213] compact_zone+0x528/0x6a0
> [ 87.260911] proactive_compact_node+0x87/0xd0
> [ 87.262090] kcompactd+0x1ca/0x360
> [ 87.263018] ? swake_up_all+0xe0/0xe0
> [ 87.264101] ? kcompactd_do_work+0x240/0x240
> [ 87.265243] kthread+0xec/0x110
> [ 87.266031] ? kthread_complete_and_exit+0x20/0x20
> [ 87.267268] ret_from_fork+0x1f/0x30
> [ 87.268243] </TASK>
> [ 87.268984] irq event stamp: 311113
> [ 87.269930] hardirqs last enabled at (311125): [<ffffffff810da6c2>] __up_console_sem+0x52/0x60
> [ 87.272235] hardirqs last disabled at (311134): [<ffffffff810da6a7>] __up_console_sem+0x37/0x60
> [ 87.275707] softirqs last enabled at (311088): [<ffffffff819d2b2c>] __do_softirq+0x21c/0x31f
> [ 87.278450] softirqs last disabled at (311083): [<ffffffff81070b8d>] __irq_exit_rcu+0xad/0x120
> [ 87.280555] ---[ end trace 0000000000000000 ]---
So this warning is move_to_new_folio() being called on un-isolated
src folio. I had DEBUG_VM disabled so VM_BUG_ON_FOLIO(!folio_test_isolated(src))
did nothing, however after mops->migrate_page() it would trigger WARN_ON()
because it evaluates folio_test_isolated(src) one more time:
[ 59.500580] page:0000000097d97a42 refcount:2 mapcount:1665 mapping:0000000000000000 index:0xffffea00185ce940 pfn:0x113dc4
[ 59.503239] flags: 0x8000000000000001(locked|zone=2)
[ 59.505060] raw: 8000000000000001 ffffea00044f70c8 ffffc90000ba7c20 ffffffff81c22582
[ 59.507288] raw: ffffea00185ce940 ffff88809183fdb0 0000000200000680 0000000000000000
[ 59.509622] page dumped because: VM_BUG_ON_FOLIO(!folio_test_isolated(src))
[ 59.511845] ------------[ cut here ]------------
[ 59.513181] kernel BUG at mm/migrate.c:988!
[ 59.514821] invalid opcode: 0000 [#1] PREEMPT SMP PTI
[ 59.523018] RIP: 0010:move_to_new_folio+0x362/0x3b0
[ 59.524160] Code: ff ff e9 55 fd ff ff 48 89 df e8 69 d8 ff ff f0 80 60 02 fb 31 c0 e9 65 fd ff ff 48 c7 c6 00 f5 e9 81 48 89 df e8 be c0 f9 ff <0f> 0b 48 c7 c6 00 f5 e9 81 48 89 df e8 ad c0 f9 ff 0f 0b b8 f5 ff
[ 59.528349] RSP: 0018:ffffc90000ba7af8 EFLAGS: 00010246
[ 59.529551] RAX: 000000000000003f RBX: ffffea00044f7100 RCX: 0000000000000000
[ 59.531186] RDX: 0000000000000000 RSI: ffffffff81e8dcf1 RDI: 00000000ffffffff
[ 59.532790] RBP: ffffea00184f1140 R08: 00000000ffffbfff R09: 00000000ffffbfff
[ 59.534392] R10: ffff888621ca0000 R11: ffff888621ca0000 R12: 8000000000000001
[ 59.536026] R13: 0000000000000001 R14: 0000000000000000 R15: ffffea00184f1140
[ 59.537646] FS: 0000000000000000(0000) GS:ffff888626a00000(0000) knlGS:0000000000000000
[ 59.539484] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 59.540785] CR2: 00007ff7fbed8000 CR3: 0000000101a26001 CR4: 0000000000770ee0
[ 59.542412] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 59.544030] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 59.545637] PKRU: 55555554
[ 59.546261] Call Trace:
[ 59.546833] <TASK>
[ 59.547371] ? lock_is_held_type+0xd9/0x130
[ 59.548331] migrate_pages_batch+0x650/0xdc0
[ 59.549326] ? move_freelist_tail+0xc0/0xc0
[ 59.550281] ? isolate_freepages+0x290/0x290
[ 59.551289] ? folio_flags.constprop.0+0x50/0x50
[ 59.552348] migrate_pages+0x3fa/0x4d0
[ 59.553224] ? isolate_freepages+0x290/0x290
[ 59.554214] ? move_freelist_tail+0xc0/0xc0
[ 59.555173] compact_zone+0x51b/0x6a0
[ 59.556031] proactive_compact_node+0x8e/0xe0
[ 59.557033] kcompactd+0x1c3/0x350
[ 59.557842] ? swake_up_all+0xe0/0xe0
[ 59.558699] ? kcompactd_do_work+0x260/0x260
[ 59.559703] kthread+0xec/0x110
[ 59.560450] ? kthread_complete_and_exit+0x20/0x20
[ 59.561582] ret_from_fork+0x1f/0x30
[ 59.562427] </TASK>
[ 59.562966] Modules linked in: deflate zlib_deflate zstd zstd_compress zram
[ 59.564591] ---[ end trace 0000000000000000 ]---
[ 59.565661] RIP: 0010:move_to_new_folio+0x362/0x3b0
[ 59.566802] Code: ff ff e9 55 fd ff ff 48 89 df e8 69 d8 ff ff f0 80 60 02 fb 31 c0 e9 65 fd ff ff 48 c7 c6 00 f5 e9 81 48 89 df e8 be c0 f9 ff <0f> 0b 48 c7 c6 00 f5 e9 81 48 89 df e8 ad c0 f9 ff 0f 0b b8 f5 ff
[ 59.571048] RSP: 0018:ffffc90000ba7af8 EFLAGS: 00010246
[ 59.572257] RAX: 000000000000003f RBX: ffffea00044f7100 RCX: 0000000000000000
[ 59.573906] RDX: 0000000000000000 RSI: ffffffff81e8dcf1 RDI: 00000000ffffffff
[ 59.575544] RBP: ffffea00184f1140 R08: 00000000ffffbfff R09: 00000000ffffbfff
[ 59.577236] R10: ffff888621ca0000 R11: ffff888621ca0000 R12: 8000000000000001
[ 59.578893] R13: 0000000000000001 R14: 0000000000000000 R15: ffffea00184f1140
[ 59.580593] FS: 0000000000000000(0000) GS:ffff888626a00000(0000) knlGS:0000000000000000
[ 59.582432] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 59.583767] CR2: 00007ff7fbed8000 CR3: 0000000101a26001 CR4: 0000000000770ee0
[ 59.585437] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 59.587082] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 59.588738] PKRU: 55555554
Powered by blists - more mailing lists