Vlastimil Babka b9e20f0da1 mm, compaction: make capture control handling safe wrt interrupts ... Hugh reports: "While stressing compaction, one run oopsed on NULL capc->cc in __free_one_page()'s task_capc(zone): compact_zone_order() had been interrupted, and a page was being freed in the return from interrupt. Though you would not expect it from the source, both gccs I was using (4.8.1 and 7.5.0) had chosen to compile compact_zone_order() with the ".cc = &cc" implemented by mov %rbx,-0xb0(%rbp) immediately before callq compact_zone - long after the "current->capture_control = &capc". An interrupt in between those finds capc->cc NULL (zeroed by an earlier rep stos). This could presumably be fixed by a barrier() before setting current->capture_control in compact_zone_order(); but would also need more care on return from compact_zone(), in order not to risk leaking a page captured by interrupt just before capture_control is reset. Maybe that is the preferable fix, but I felt safer for task_capc() to exclude the rather surprising possibility of capture at interrupt time" I have checked that gcc10 also behaves the same. The advantage of fix in compact_zone_order() is that we don't add another test in the page freeing hot path, and that it might prevent future problems if we stop exposing pointers to uninitialized structures in current task. So this patch implements the suggestion for compact_zone_order() with barrier() (and WRITE_ONCE() to prevent store tearing) for setting current->capture_control, and prevents page leaking with WRITE_ONCE/READ_ONCE in the proper order. Link: http://lkml.kernel.org/r/20200616082649.27173-1-vbabka@suse.cz Fixes: 5e1f0f098b ("mm, compaction: capture a page under direct compaction") Signed-off-by: Vlastimil Babka <vbabka@suse.cz> Reported-by: Hugh Dickins <hughd@google.com> Suggested-by: Hugh Dickins <hughd@google.com> Acked-by: Hugh Dickins <hughd@google.com> Cc: Alex Shi <alex.shi@linux.alibaba.com> Cc: Li Wang <liwang@redhat.com> Cc: Mel Gorman <mgorman@techsingularity.net> Cc: <stable@vger.kernel.org> [5.1+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2020-06-26 00:27:36 -07:00
..
kasan	mm: remove __ARCH_HAS_5LEVEL_HACK and include/asm-generic/5level-fixup.h	2020-06-04 19:06:21 -07:00
backing-dev.c	bdi: remove the name field in struct backing_dev_info	2020-05-09 16:15:13 -06:00
balloon_compaction.c	mm/balloon_compaction: suppress allocation warnings	2019-09-04 07:42:01 -04:00
cleancache.c	Driver Core and debugfs changes for 5.3-rc1	2019-07-12 12:24:03 -07:00
cma_debug.c	mm/cma_debug.c: use DEFINE_DEBUGFS_ATTRIBUTE to define debugfs fops	2019-12-01 12:59:09 -08:00
cma.c	mm: cma: NUMA node interface	2020-04-10 15:36:21 -07:00
cma.h
compaction.c	mm, compaction: make capture control handling safe wrt interrupts	2020-06-26 00:27:36 -07:00
debug_page_ref.c
debug_vm_pgtable.c	mm/debug_vm_pgtable: fix kernel crash by checking for THP support	2020-06-10 19:14:18 -07:00
debug.c	maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault	2020-06-17 10:57:41 -07:00
dmapool.c	mm/dmapool.c: micro-optimisation remove unnecessary branch	2020-04-07 10:43:42 -07:00
early_ioremap.c	mm/early_ioremap.c: use %pa to print resource_size_t variables	2020-01-31 10:30:38 -08:00
fadvise.c	mm: return void from various readahead functions	2020-06-02 10:59:06 -07:00
failslab.c
filemap.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
frame_vector.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
frontswap.c	mm/frontswap: fix some typos in frontswap.c	2020-06-04 19:06:24 -07:00
gup_benchmark.c	mm/gup_benchmark: support pin_user_pages() and related calls	2020-04-02 09:35:27 -07:00
gup.c	mm: Allow arches to provide ptep_get()	2020-06-20 22:14:53 +10:00
highmem.c	mm, x86/mm: Untangle address space layout definitions from basic pgtable type definitions	2019-12-10 10:12:55 +01:00
hmm.c	mmap locking API: add mmap_assert_locked() and mmap_assert_write_locked()	2020-06-09 09:39:14 -07:00
huge_memory.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
hugetlb_cgroup.c	mm: use fallthrough;	2020-04-07 10:43:41 -07:00
hugetlb.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
hwpoison-inject.c	mm/hwpoison-inject: use DEFINE_DEBUGFS_ATTRIBUTE to define debugfs fops	2019-12-01 12:59:09 -08:00
init-mm.c	mmap locking API: add MMAP_LOCK_INITIALIZER	2020-06-09 09:39:14 -07:00
internal.h	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
interval_tree.c
Kconfig	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next	2020-06-07 17:25:29 -07:00
Kconfig.debug	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
khugepaged.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
kmemleak-test.c
kmemleak.c	mm/kmemleak.c: use address-of operator on section symbols	2020-04-02 09:35:26 -07:00
ksm.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
list_lru.c	mm/list_lru: fix a typo in comment "numbesr"->"numbers"	2020-06-04 19:06:24 -07:00
maccess.c	maccess: rename probe_user_{read,write} to copy_{from,to}_user_nofault	2020-06-17 10:57:41 -07:00
madvise.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
Makefile	The Kernel Concurrency Sanitizer (KCSAN)	2020-06-11 18:55:43 -07:00
mapping_dirty_helpers.c	mm/mapping_dirty_helpers: update huge page-table entry callbacks	2020-04-02 09:35:29 -07:00
memblock.c	mm/memblock: fix a typo in comment "implict"->"implicit"	2020-06-04 19:06:23 -07:00
memcontrol.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
memfd.c	mm: page cache: store only head pages in i_pages	2019-09-24 15:54:08 -07:00
memory_hotplug.c	virtio: features, fixes	2020-06-10 13:42:09 -07:00
memory-failure.c	mm/memory-failure: send SIGBUS(BUS_MCEERR_AR) only to current thread	2020-06-11 18:17:47 -07:00
memory.c	mm: do_swap_page(): fix up the error code	2020-06-26 00:27:36 -07:00
mempolicy.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
mempool.c
memremap.c	mm/memremap: set caching mode for PCI P2PDMA memory to WC	2020-04-10 15:36:21 -07:00
memtest.c
migrate.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
mincore.c	mmap locking API: use coccinelle to convert mmap_sem rwsem call sites	2020-06-09 09:39:14 -07:00
mlock.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
mm_init.c	mm/mm_init.c: report kasan-tag information stored in page->flags	2020-06-02 10:59:12 -07:00
mmap.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
mmu_gather.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
mmu_notifier.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
mmzone.c
mprotect.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
mremap.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
msync.c	mmap locking API: use coccinelle to convert mmap_sem rwsem call sites	2020-06-09 09:39:14 -07:00
nommu.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
oom_kill.c	kernel: better document the use_mm/unuse_mm API contract	2020-06-10 19:14:18 -07:00
page_alloc.c	virtio: features, fixes	2020-06-10 13:42:09 -07:00
page_counter.c	mm, memcg: prevent memory.min load/store tearing	2020-04-02 09:35:29 -07:00
page_ext.c	mm/page_ext.c: drop pfn_present() check when onlining	2020-04-07 10:43:40 -07:00
page_idle.c	mm/page_idle.c: skip offline pages	2020-06-08 11:05:55 -07:00
page_io.c	mm: don't include asm/pgtable.h if linux/mm.h is already included	2020-06-09 09:39:13 -07:00
page_isolation.c	mm: Allow to offline unmovable PageOffline() pages via MEM_GOING_OFFLINE	2020-06-04 15:36:52 -04:00
page_owner.c	mm: rename gfpflags_to_migratetype to gfp_migratetype for same convention	2020-06-03 20:09:45 -07:00
page_poison.c	mm/page_poison.c: fix a typo in a comment	2019-09-24 15:54:08 -07:00
page_reporting.c	mm/page_reporting: add budget limit on how many pages can be reported per pass	2020-04-07 10:43:39 -07:00
page_reporting.h	mm: introduce include/linux/pgtable.h	2020-06-09 09:39:13 -07:00
page_vma_mapped.c	mm/page_vma_mapped.c: explicitly compare pfn for normal, hugetlbfs and THP page	2020-01-31 10:30:38 -08:00
page-writeback.c	mm/page-writeback: fix a typo in comment "effictive"->"effective"	2020-06-04 19:06:24 -07:00
pagewalk.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
percpu-internal.h
percpu-km.c
percpu-stats.c	percpu: update copyright emails to dennis@kernel.org	2020-04-01 10:09:12 -07:00
percpu-vm.c
percpu.c	mm: remove the pgprot argument to __vmalloc	2020-06-02 10:59:11 -07:00
pgtable-generic.c	mm: introduce include/linux/pgtable.h	2020-06-09 09:39:13 -07:00
process_vm_access.c	mmap locking API: use coccinelle to convert mmap_sem rwsem call sites	2020-06-09 09:39:14 -07:00
ptdump.c	mmap locking API: use coccinelle to convert mmap_sem rwsem call sites	2020-06-09 09:39:14 -07:00
readahead.c	mm: use memalloc_nofs_save in readahead path	2020-06-02 10:59:07 -07:00
rmap.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
rodata_test.c	maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault	2020-06-17 10:57:41 -07:00
shmem.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
shuffle.c	mm: adjust shuffle code to allow for future coalescing	2020-04-07 10:43:38 -07:00
shuffle.h	mm: adjust shuffle code to allow for future coalescing	2020-04-07 10:43:38 -07:00
slab_common.c	usercopy: mark dma-kmalloc caches as usercopy caches	2020-06-02 10:59:06 -07:00
slab.c	mm/page_alloc: integrate classzone_idx and high_zoneidx	2020-06-03 20:09:44 -07:00
slab.h	mm: kmem: rename (__)memcg_kmem_(un)charge_memcg() to __memcg_kmem_(un)charge()	2020-04-02 09:35:28 -07:00
slob.c	mm/sl[uo]b: export __kmalloc_track(_node)_caller	2020-03-26 14:45:51 +01:00
slub.c	maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault	2020-06-17 10:57:41 -07:00
sparse-vmemmap.c	mm: don't include asm/pgtable.h if linux/mm.h is already included	2020-06-09 09:39:13 -07:00
sparse.c	mm: don't include asm/pgtable.h if linux/mm.h is already included	2020-06-09 09:39:13 -07:00
swap_cgroup.c	mm: memcontrol: make swap tracking an integral part of memory control	2020-06-03 20:09:48 -07:00
swap_slots.c	mm/swap_slots.c: assign|reset cache slot by value directly	2020-04-02 09:35:27 -07:00
swap_state.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
swap.c	mm: swap: memcg: fix memcg stats for huge pages	2020-06-03 20:09:49 -07:00
swapfile.c	mmap locking API: use coccinelle to convert mmap_sem rwsem call sites	2020-06-09 09:39:14 -07:00
truncate.c	mm/thp: allow dropping THP from page cache	2019-10-19 06:32:33 -04:00
usercopy.c	usercopy: Avoid HIGHMEM pfn warning	2019-09-17 15:20:17 -07:00
userfaultfd.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
util.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
vmacache.c	kernel: better document the use_mm/unuse_mm API contract	2020-06-10 19:14:18 -07:00
vmalloc.c	mm/vmalloc: fix a typo in comment	2020-06-04 19:06:21 -07:00
vmpressure.c	mm: vmpressure: use mem_cgroup_is_root API	2020-04-02 09:35:31 -07:00
vmscan.c	mm/vmsan: fix some typos in comment	2020-06-04 19:06:23 -07:00
vmstat.c	mm/vmstat.c: convert to use DEFINE_SEQ_ATTRIBUTE macro	2020-06-04 19:06:26 -07:00
workingset.c	mm: vmscan: reclaim writepage is IO cost	2020-06-03 20:09:49 -07:00
z3fold.c	mm/z3fold: silence kmemleak false positives of slots	2020-05-28 11:35:40 -07:00
zbud.c	mm: use false for bool variable	2020-06-04 19:06:24 -07:00
zpool.c	zpool: add malloc_support_movable to zpool_driver	2019-09-24 15:54:12 -07:00
zsmalloc.c	mm: reorder includes after introduction of linux/pgtable.h	2020-06-09 09:39:13 -07:00
zswap.c	mm/zswap: allow setting default status, compressor and allocator in Kconfig	2020-04-07 10:43:41 -07:00