Re: 2.6.38-rc1 problems with khugepaged

[Johannes Weiner]

Hi,

On Wed, Jan 19, 2011 at 04:59:54PM +0100, Borislav Petkov wrote:
> Adding some more parties to CC.
> 
> On Wed, Jan 19, 2011 at 09:45:25AM -0400, werner wrote:
> > **  Help   Help Help ***
> > 
> > My computer crashs on booting  ...   :( :(

That sucks!

I cross-compiled for 32-bit and was able to match up the disassembly
against the code line from your oops report.  Apparently the pte was
an invalid pointer, and it makes perfect sense: we unmap the highpte
_before_ we access the pointer again for __collapse_huge_page_copy().

Can you test with this fix applied?  It is only compile-tested, I too
have no 32-bit installations anymore.

	Hannes

---
From: Johannes Weiner <hannes@xxxxxxxxxxx>
Subject: [patch] thp: keep highpte mapped until it is no longer needed

Two users reported THP-related crashes on 32-bit x86 machines.  Their
oops reports indicated an invalid pte, and subsequent code inspection
showed that the highpte is actually used after unmap.

The fix is to unmap the pte only after all operations against it are
finished.

Reported-by: Ilya Dryomov <idryomov@xxxxxxxxx>
Reported-by: werner <w.landgraf@xxxxx>
Signed-off-by: Johannes Weiner <hannes@xxxxxxxxxxx>
---
 mm/huge_memory.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 1be1034..e187454 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1839,9 +1839,9 @@ static void collapse_huge_page(struct mm_struct *mm,
 	spin_lock(ptl);
 	isolated = __collapse_huge_page_isolate(vma, address, pte);
 	spin_unlock(ptl);
-	pte_unmap(pte);
 
 	if (unlikely(!isolated)) {
+		pte_unmap(pte);
 		spin_lock(&mm->page_table_lock);
 		BUG_ON(!pmd_none(*pmd));
 		set_pmd_at(mm, address, pmd, _pmd);
@@ -1858,6 +1858,7 @@ static void collapse_huge_page(struct mm_struct *mm,
 	anon_vma_unlock(vma->anon_vma);
 
 	__collapse_huge_page_copy(pte, new_page, vma, address, ptl);
+	pte_unmap(pte);
 	__SetPageUptodate(new_page);
 	pgtable = pmd_pgtable(_pmd);
 	VM_BUG_ON(page_count(pgtable) != 1);
-- 
1.7.3.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/