Miaohe Lin 9c9b32d46a mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() ... commit 52ccdde16b upstream. When I did memory failure tests recently, below warning occurs: DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 8 PID: 1011 at kernel/locking/lockdep.c:232 __lock_acquire+0xccb/0x1ca0 Modules linked in: mce_inject hwpoison_inject CPU: 8 PID: 1011 Comm: bash Kdump: loaded Not tainted 6.9.0-rc3-next-20240410-00012-gdb69f219f4be #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:__lock_acquire+0xccb/0x1ca0 RSP: 0018:ffffa7a1c7fe3bd0 EFLAGS: 00000082 RAX: 0000000000000000 RBX: eb851eb853975fcf RCX: ffffa1ce5fc1c9c8 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffffa1ce5fc1c9c0 RBP: ffffa1c6865d3280 R08: ffffffffb0f570a8 R09: 0000000000009ffb R10: 0000000000000286 R11: ffffffffb0f2ad50 R12: ffffa1c6865d3d10 R13: ffffa1c6865d3c70 R14: 0000000000000000 R15: 0000000000000004 FS: 00007ff9f32aa740(0000) GS:ffffa1ce5fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff9f3134ba0 CR3: 00000008484e4000 CR4: 00000000000006f0 Call Trace: <TASK> lock_acquire+0xbe/0x2d0 _raw_spin_lock_irqsave+0x3a/0x60 hugepage_subpool_put_pages.part.0+0xe/0xc0 free_huge_folio+0x253/0x3f0 dissolve_free_huge_page+0x147/0x210 __page_handle_poison+0x9/0x70 memory_failure+0x4e6/0x8c0 hard_offline_page_store+0x55/0xa0 kernfs_fop_write_iter+0x12c/0x1d0 vfs_write+0x380/0x540 ksys_write+0x64/0xe0 do_syscall_64+0xbc/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff9f3114887 RSP: 002b:00007ffecbacb458 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007ff9f3114887 RDX: 000000000000000c RSI: 0000564494164e10 RDI: 0000000000000001 RBP: 0000564494164e10 R08: 00007ff9f31d1460 R09: 000000007fffffff R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000c R13: 00007ff9f321b780 R14: 00007ff9f3217600 R15: 00007ff9f3216a00 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ... CPU: 8 PID: 1011 Comm: bash Kdump: loaded Not tainted 6.9.0-rc3-next-20240410-00012-gdb69f219f4be #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> panic+0x326/0x350 check_panic_on_warn+0x4f/0x50 __warn+0x98/0x190 report_bug+0x18e/0x1a0 handle_bug+0x3d/0x70 exc_invalid_op+0x18/0x70 asm_exc_invalid_op+0x1a/0x20 RIP: 0010:__lock_acquire+0xccb/0x1ca0 RSP: 0018:ffffa7a1c7fe3bd0 EFLAGS: 00000082 RAX: 0000000000000000 RBX: eb851eb853975fcf RCX: ffffa1ce5fc1c9c8 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffffa1ce5fc1c9c0 RBP: ffffa1c6865d3280 R08: ffffffffb0f570a8 R09: 0000000000009ffb R10: 0000000000000286 R11: ffffffffb0f2ad50 R12: ffffa1c6865d3d10 R13: ffffa1c6865d3c70 R14: 0000000000000000 R15: 0000000000000004 lock_acquire+0xbe/0x2d0 _raw_spin_lock_irqsave+0x3a/0x60 hugepage_subpool_put_pages.part.0+0xe/0xc0 free_huge_folio+0x253/0x3f0 dissolve_free_huge_page+0x147/0x210 __page_handle_poison+0x9/0x70 memory_failure+0x4e6/0x8c0 hard_offline_page_store+0x55/0xa0 kernfs_fop_write_iter+0x12c/0x1d0 vfs_write+0x380/0x540 ksys_write+0x64/0xe0 do_syscall_64+0xbc/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff9f3114887 RSP: 002b:00007ffecbacb458 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007ff9f3114887 RDX: 000000000000000c RSI: 0000564494164e10 RDI: 0000000000000001 RBP: 0000564494164e10 R08: 00007ff9f31d1460 R09: 000000007fffffff R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000c R13: 00007ff9f321b780 R14: 00007ff9f3217600 R15: 00007ff9f3216a00 </TASK> After git bisecting and digging into the code, I believe the root cause is that _deferred_list field of folio is unioned with _hugetlb_subpool field. In __update_and_free_hugetlb_folio(), folio->_deferred_list is initialized leading to corrupted folio->_hugetlb_subpool when folio is hugetlb. Later free_huge_folio() will use _hugetlb_subpool and above warning happens. But it is assumed hugetlb flag must have been cleared when calling folio_put() in update_and_free_hugetlb_folio(). This assumption is broken due to below race: CPU1 CPU2 dissolve_free_huge_page update_and_free_pages_bulk update_and_free_hugetlb_folio hugetlb_vmemmap_restore_folios folio_clear_hugetlb_vmemmap_optimized clear_flag = folio_test_hugetlb_vmemmap_optimized if (clear_flag) <-- False, it's already cleared. __folio_clear_hugetlb(folio) <-- Hugetlb is not cleared. folio_put free_huge_folio <-- free_the_page is expected. list_for_each_entry() __folio_clear_hugetlb <-- Too late. Fix this issue by checking whether folio is hugetlb directly instead of checking clear_flag to close the race window. Link: https://lkml.kernel.org/r/20240419085819.1901645-1-linmiaohe@huawei.com Fixes: 32c877191e ("hugetlb: do not clear hugetlb dtor until allocating vmemmap") Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> Reviewed-by: Oscar Salvador <osalvador@suse.de> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-05-02 16:35:26 +02:00
..
damon	mm/damon/lru_sort: fix quota status loss due to online tunings	2024-02-20 14:20:50 -08:00
kasan	kasan/test: avoid gcc warning for intentional overflow	2024-04-03 15:32:06 +02:00
kfence	KFENCE: cleanup kfence_guarded_alloc() after CONFIG_SLAB removal	2023-12-05 11:17:58 +01:00
kmsan	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
backing-dev.c	blk-wbt: Fix detection of dirty-throttled tasks	2024-02-06 09:44:03 -07:00
balloon_compaction.c
bootmem_info.c
cma.c	mm: cma: remove unnecessary initialization of ret	2023-12-12 10:57:08 -08:00
cma.h
cma_debug.c
cma_sysfs.c
compaction.c	mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations	2024-03-04 16:40:32 -08:00
debug.c
debug_page_alloc.c	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
debug_page_ref.c
debug_vm_pgtable.c	mm/debug_vm_pgtable: fix BUG_ON with pud advanced test	2024-02-23 17:27:13 -08:00
dmapool.c	mm/mempool/dmapool: remove CONFIG_DEBUG_SLAB ifdefs	2023-12-05 11:17:58 +01:00
dmapool_test.c
early_ioremap.c
fadvise.c
fail_page_alloc.c
failslab.c
filemap.c	mm: cachestat: fix two shmem bugs	2024-04-03 15:32:39 +02:00
folio-compat.c	mm: remove page_add_new_anon_rmap and lru_cache_add_inactive_or_unevictable	2023-12-29 11:58:27 -08:00
gup.c	mm/madvise: make MADV_POPULATE_(READ|WRITE) handle VM_FAULT_RETRY properly	2024-04-27 17:13:02 +02:00
gup_test.c
gup_test.h
highmem.c	x86/kexec: use pr_err() instead of kexec_dprintk() when an error occurs	2023-12-29 12:22:28 -08:00
hmm.c
huge_memory.c	userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE	2024-04-27 17:12:54 +02:00
hugetlb.c	mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio()	2024-05-02 16:35:26 +02:00
hugetlb_cgroup.c
hugetlb_vmemmap.c	mm: hugetlb_vmemmap: move mmap lock to vmemmap_remap_range()	2023-12-12 10:57:08 -08:00
hugetlb_vmemmap.h
hwpoison-inject.c
init-mm.c	mm: Deprecate pasid field	2023-12-12 10:11:32 +01:00
internal.h	mm/madvise: make MADV_POPULATE_(READ|WRITE) handle VM_FAULT_RETRY properly	2024-04-27 17:13:02 +02:00
interval_tree.c
io-mapping.c
ioremap.c
Kconfig	IOMMU Updates for Linux v6.8	2024-01-18 15:16:57 -08:00
Kconfig.debug	mm/slab: remove CONFIG_SLAB from all Kconfig and Makefile	2023-12-05 11:14:40 +01:00
khugepaged.c	header cleanups for 6.8	2024-01-10 16:43:55 -08:00
kmemleak.c	kmemleak: avoid RCU stalls when freeing metadata for per-CPU pointers	2023-12-12 10:57:07 -08:00
ksm.c	mm: convert page_try_share_anon_rmap() to folio_try_share_anon_rmap_[pte|pmd]()	2023-12-29 11:58:56 -08:00
list_lru.c	mm/list_lru.c: remove unused list_lru_from_kmem()	2023-12-20 14:48:11 -08:00
maccess.c
madvise.c	mm/madvise: make MADV_POPULATE_(READ|WRITE) handle VM_FAULT_RETRY properly	2024-04-27 17:13:02 +02:00
Makefile	kbuild: make -Woverride-init warnings more consistent	2024-04-10 16:38:00 +02:00
mapping_dirty_helpers.c
memblock.c	cxl fixes for 6.8-rc6	2024-02-24 15:53:40 -08:00
memcontrol.c	mm: memcontrol: clarify swapaccount=0 deprecation warning	2024-02-20 14:20:49 -08:00
memfd.c
memory-failure.c	mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled	2024-04-27 17:13:02 +02:00
memory-tiers.c	base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates'	2023-12-22 14:23:13 -08:00
memory.c	x86/mm/pat: fix VM_PAT handling in COW mappings	2024-04-10 16:38:19 +02:00
memory_hotplug.c	mm/memory_hotplug: fix memmap_on_memory sysfs value retrieval	2024-01-12 15:20:48 -08:00
mempolicy.c
mempool.c	Many singleton patches against the MM code. The patch series which	2024-01-09 11:18:47 -08:00
memremap.c	mm: remove stale example from comment	2023-12-29 11:58:26 -08:00
memtest.c	memtest: use {READ,WRITE}_ONCE in memory scanning	2024-04-03 15:32:22 +02:00
migrate.c	mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index	2024-02-23 17:27:13 -08:00
migrate_device.c	mm: convert page_try_share_anon_rmap() to folio_try_share_anon_rmap_[pte|pmd]()	2023-12-29 11:58:56 -08:00
mincore.c
mlock.c
mm_init.c	efi: disable mirror feature during crashkernel	2024-01-12 15:20:47 -08:00
mm_slot.h
mmap.c	mm, mmap: fix vma_merge() case 7 with vma_ops->close	2024-03-04 16:40:33 -08:00
mmap_lock.c
mmu_gather.c	mm/memory: page_remove_rmap() -> folio_remove_rmap_pte()	2023-12-29 11:58:54 -08:00
mmu_notifier.c
mmzone.c	zswap: shrink zswap pool based on memory pressure	2023-12-12 10:57:02 -08:00
mprotect.c
mremap.c
msync.c
nommu.c
oom_kill.c	mm, oom:dump_tasks add rss detailed information printing	2023-12-10 16:51:53 -08:00
page-writeback.c	block-6.8-2024-02-10	2024-02-10 08:02:48 -08:00
page_alloc.c	mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations	2024-03-04 16:40:32 -08:00
page_counter.c
page_ext.c
page_idle.c
page_io.c	zswap: memcontrol: implement zswap writeback disabling	2023-12-29 20:22:11 -08:00
page_isolation.c	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
page_owner.c	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
page_poison.c	mm/page_poison: replace kmap_atomic() with kmap_local_page()	2023-12-10 16:51:50 -08:00
page_reporting.c	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
page_reporting.h
page_table_check.c
page_vma_mapped.c	mm: thp: introduce multi-size THP sysfs interface	2023-12-20 14:48:12 -08:00
pagewalk.c	mm: pagewalk: assert write mmap lock only for walking the user page tables	2023-12-10 16:51:53 -08:00
percpu-internal.h
percpu-km.c
percpu-stats.c
percpu-vm.c
percpu.c	mm: Introduce flush_cache_vmap_early()	2023-12-14 00:23:17 -08:00
pgalloc-track.h
pgtable-generic.c
process_vm_access.c	mm: fix process_vm_rw page counts	2023-12-10 16:51:39 -08:00
ptdump.c
readahead.c	readahead: avoid multiple marked readahead pages	2024-01-25 23:52:20 -08:00
rmap.c	mm/rmap: rename COMPOUND_MAPPED to ENTIRELY_MAPPED	2023-12-29 11:58:56 -08:00
rodata_test.c
secretmem.c
shmem.c	mm/shmem: inline shmem_is_huge() for disabled transparent hugepages	2024-04-27 17:13:02 +02:00
shmem_quota.c	tmpfs: fix race on handling dquot rbtree	2024-04-03 15:32:38 +02:00
show_mem.c	mm, treewide: introduce NR_PAGE_ORDERS	2024-01-08 15:27:15 -08:00
shrinker.c	mm: shrinker: use kvzalloc_node() from expand_one_shrinker_info()	2024-01-05 09:58:32 -08:00
shrinker_debug.c
shuffle.c
shuffle.h	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
slab.h	mm/slab: move kmalloc() functions from slab_common.c to slub.c	2023-12-06 11:57:21 +01:00
slab_common.c	slub: use a folio in __kmalloc_large_node	2024-01-05 10:17:46 -08:00
slub.c	Many singleton patches against the MM code. The patch series which	2024-01-09 11:18:47 -08:00
sparse-vmemmap.c
sparse.c	mm/sparsemem: fix race in accessing memory_section->usage	2023-12-29 11:58:43 -08:00
swap.c
swap.h	mm/swap: fix race when skipping swapcache	2024-02-20 14:20:48 -08:00
swap_cgroup.c
swap_slots.c
swap_state.c	mm/swap_state: update zswap LRU's protection range with the folio locked	2024-02-20 14:20:48 -08:00
swapfile.c	mm: swap: fix race between free_swap_and_cache() and swapoff()	2024-04-03 15:32:15 +02:00
truncate.c	fs: convert error_remove_page to error_remove_folio	2023-12-10 16:51:42 -08:00
usercopy.c
userfaultfd.c	mm: userfaultfd: fix unexpected change to src_folio when UFFDIO_MOVE fails	2024-03-04 16:40:33 -08:00
util.c	mm/util: use kmap_local_page() in memcmp_pages()	2023-12-10 16:51:49 -08:00
vmalloc.c
vmpressure.c	eventfd: simplify eventfd_signal()	2023-11-28 14:08:38 +01:00
vmscan.c	mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations	2024-03-04 16:40:32 -08:00
vmstat.c	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
workingset.c	mm: ratelimit stat flush from workingset shrinker	2024-01-05 10:17:45 -08:00
z3fold.c
zbud.c
zpool.c
zsmalloc.c	mm: zsmalloc: return -ENOSPC rather than -EINVAL in zs_malloc while size is too large	2024-01-05 10:17:47 -08:00
zswap.c	mm: zswap: fix writeback shinker GFP_NOIO/GFP_NOFS recursion	2024-04-03 15:32:37 +02:00