[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <a12e9a51-0ee4-4a10-9ec4-d4c0d34ccff9@bytedance.com>
Date: Tue, 5 Aug 2025 18:26:41 +0800
From: Qi Zheng <zhengqi.arch@...edance.com>
To: Baolin Wang <baolin.wang@...ux.alibaba.com>,
David Hildenbrand <david@...hat.com>, Barry Song <21cnbao@...il.com>,
akpm@...ux-foundation.org, linux-mm@...ck.org
Cc: linux-kernel@...r.kernel.org, Barry Song <v-songbaohua@...o.com>,
"Lai, Yi" <yi1.lai@...ux.intel.com>,
Lorenzo Stoakes <lorenzo.stoakes@...cle.com>,
Vlastimil Babka <vbabka@...e.cz>, Jann Horn <jannh@...gle.com>,
Suren Baghdasaryan <surenb@...gle.com>, Lokesh Gidra
<lokeshgidra@...gle.com>, Tangquan Zheng <zhengtangquan@...o.com>,
Lance Yang <ioworker0@...il.com>, Zi Yan <ziy@...dia.com>,
"Liam R . Howlett" <Liam.Howlett@...cle.com>, Nico Pache
<npache@...hat.com>, Ryan Roberts <ryan.roberts@....com>,
Dev Jain <dev.jain@....com>
Subject: Re: [PATCH] mm: Fix the race between collapse and PT_RECLAIM under
per-vma lock
On 8/5/25 6:07 PM, Baolin Wang wrote:
>
>
[...]
>
>>>
>>> What types of this 'valid page' could be? If __pte_offset_map() returns
>>> non-NULL, then it is a PTE page. Even if it is not the original one, it
>>> should not cause panic. Did I miss some key information? :(
>
> Sorry for not being clear. Let me try again.
>
> In the race condition described above, the '_pmd' value is NONE, meaning
> that when restoring the pmd entry with ‘pmd_populate(mm, pmd,
> pmd_pgtable(_pmd))’, the 'pmd_pgtable(_pmd)' can return a struct page
> corresponding to pfn == 0 (cause the '_pmd' is NONE) to populate the pmd
> entry. Clearly, this pfn == 0 page is not a pagetable page, meaning the
> corresponding ptl lock of this page is not initialized.
>
> Additionally, from the boot dmesg, I can see that the BIOS reports an
> address range with pfn == 0, indicating that there is a struct page
> initialized for pfn == 0 (possibly a reserved page):
>
> [ 0.000000] BIOS-provided physical RAM map:
> [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff]
> usable
> [ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff]
> reserved
> [ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff]
> reserved
> [ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x000000007ffdffff]
> usable
> [ 0.000000] BIOS-e820: [mem 0x000000007ffe0000-0x000000007fffffff]
> reserved
> [ 0.000000] BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff]
> reserved
> [ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff]
> reserved
>
Now I understand, thank you very much for your patient explanation!
And for this patch:
Acked-by: Qi Zheng <zhengqi.arch@...edance.com>
Thanks!
> Of course, this is my theoretical analysis from the code perspective. If
> there are other race conditions, I would be very surprised:)
>
>> Wasn't the original issue all about a NULL-pointer de-reference while
>> *locking*?
>
> Yes.
>
>> Note that in that kernel config [1] we have CONFIG_DEBUG_SPINLOCK=y,
>> so likely we will have ALLOC_SPLIT_PTLOCKS set.
>>
>> [1] https://github.com/laifryiee/syzkaller_logs/blob/
>> main/250803_193026___pte_offset_map_lock/.config
>>
Powered by blists - more mailing lists