• Andrea Arcangeli's avatar
    mm: thp: fix BUG on mm->nr_ptes · 1c641e84
    Andrea Arcangeli authored
    Dave Jones reports a few Fedora users hitting the BUG_ON(mm->nr_ptes...)
    in exit_mmap() recently.
    
    Quoting Hugh's discovery and explanation of the SMP race condition:
    
      "mm->nr_ptes had unusual locking: down_read mmap_sem plus
       page_table_lock when incrementing, down_write mmap_sem (or mm_users
       0) when decrementing; whereas THP is careful to increment and
       decrement it under page_table_lock.
    
       Now most of those paths in THP also hold mmap_sem for read or write
       (with appropriate checks on mm_users), but two do not: when
       split_huge_page() is called by hwpoison_user_mappings(), and when
       called by add_to_swap().
    
       It's conceivable that the latter case is responsible for the
       exit_mmap() BUG_ON mm->nr_ptes that has been reported on Fedora."
    
    The simplest way to fix it without having to alter the locking is to make
    split_huge_page() a noop in nr_ptes terms, so by counting the preallocated
    pagetables that exists for every mapped hugepage.  It was an arbitrary
    choice not to count them and either way is not wrong or right, because
    they are not used but they're still allocated.
    Reported-by: default avatarDave Jones <davej@redhat.com>
    Reported-by: default avatarHugh Dickins <hughd@google.com>
    Signed-off-by: default avatarAndrea Arcangeli <aarcange@redhat.com>
    Acked-by: default avatarHugh Dickins <hughd@google.com>
    Cc: David Rientjes <rientjes@google.com>
    Cc: Josh Boyer <jwboyer@redhat.com>
    Cc: <stable@vger.kernel.org>	[3.0.x, 3.1.x, 3.2.x]
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    1c641e84
huge_memory.c 63.6 KB