The page_huge_active() can be called from scan_movable_pages() which
do not hold a reference count to the HugeTLB page. So when we call
page_huge_active() from scan_movable_pages(), the HugeTLB page can
be freed parallel. Then we will trigger a BUG_ON which is in the
page_huge_active() when CONFIG_DEBUG_VM is enabled. Just remove the
VM_BUG_ON_PAGE.
Fixes: 7e1f049efb86 ("mm: hugetlb: cleanup using paeg_huge_active()")
Signed-off-by: Muchun Song <songmuchun(a)bytedance.com>
Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: stable(a)vger.kernel.org
---
mm/hugetlb.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index a7ed22811672..8c6005a538a2 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1360,8 +1360,7 @@ struct hstate *size_to_hstate(unsigned long size)
*/
bool page_huge_active(struct page *page)
{
- VM_BUG_ON_PAGE(!PageHuge(page), page);
- return PageHead(page) && PagePrivate(&page[1]);
+ return PageHeadHuge(page) && PagePrivate(&page[1]);
}
/* never called for tail page */
--
2.11.0
There is a race between isolate_huge_page() and __free_huge_page().
CPU0: CPU1:
if (PageHuge(page))
put_page(page)
__free_huge_page(page)
spin_lock(&hugetlb_lock)
update_and_free_page(page)
set_compound_page_dtor(page,
NULL_COMPOUND_DTOR)
spin_unlock(&hugetlb_lock)
isolate_huge_page(page)
// trigger BUG_ON
VM_BUG_ON_PAGE(!PageHead(page), page)
spin_lock(&hugetlb_lock)
page_huge_active(page)
// trigger BUG_ON
VM_BUG_ON_PAGE(!PageHuge(page), page)
spin_unlock(&hugetlb_lock)
When we isolate a HugeTLB page on CPU0. Meanwhile, we free it to the
buddy allocator on CPU1. Then, we can trigger a BUG_ON on CPU0. Because
it is already freed to the buddy allocator.
Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage")
Signed-off-by: Muchun Song <songmuchun(a)bytedance.com>
Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: stable(a)vger.kernel.org
---
mm/hugetlb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 898e4ea43e13..a7ed22811672 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -5575,9 +5575,9 @@ bool isolate_huge_page(struct page *page, struct list_head *list)
{
bool ret = true;
- VM_BUG_ON_PAGE(!PageHead(page), page);
spin_lock(&hugetlb_lock);
- if (!page_huge_active(page) || !get_page_unless_zero(page)) {
+ if (!PageHeadHuge(page) || !page_huge_active(page) ||
+ !get_page_unless_zero(page)) {
ret = false;
goto unlock;
}
--
2.11.0
(This was [PATCH 0/4] sched/idle: Fix missing need_resched() checks after rcu_idle_enter() v2)
I initially followed Peterz review but eventually I tried a different
approach. Instead of handling the late wake up from rcu_idle_enter(),
I've split the delayed rcuog wake up and moved it right before
the last generic need_resched() check, it makes more sense and we don't
need to fiddle with cpuidle core and drivers anymore. It's also less
error prone.
I also fixed the nohz_full case and (hopefully) the guest case.
And this comes with debugging to prevent from that pattern to happen
again.
Only lightly tested so far.
git://git.kernel.org/pub/scm/linux/kernel/git/frederic/linux-dynticks.git
sched/idle-v3
HEAD: d95fc510e804a5c4658a823ff12d9caba1d906c7
Thanks,
Frederic
---
Frederic Weisbecker (8):
rcu: Remove superfluous rdp fetch
rcu: Pull deferred rcuog wake up to rcu_eqs_enter() callers
rcu/nocb: Perform deferred wake up before last idle's need_resched() check
rcu/nocb: Trigger self-IPI on late deferred wake up before user resume
entry: Explicitly flush pending rcuog wakeup before last rescheduling points
sched: Report local wake up on resched blind zone within idle loop
entry: Report local wake up on resched blind zone while resuming to user
timer: Report ignored local enqueue in nohz mode
include/linux/rcupdate.h | 2 ++
include/linux/sched.h | 11 ++++++++
kernel/entry/common.c | 10 ++++++++
kernel/rcu/tree.c | 27 ++++++++++++++++++--
kernel/rcu/tree.h | 2 +-
kernel/rcu/tree_plugin.h | 30 +++++++++++++++-------
kernel/sched/core.c | 66 +++++++++++++++++++++++++++++++++++++++++++++++-
kernel/sched/idle.c | 6 +++++
kernel/sched/sched.h | 3 +++
9 files changed, 144 insertions(+), 13 deletions(-)