hugetlb/hugemmap: add new testcase hugemmap06.c
Description of Problem:
There is a race condition if we map a same file on different processes.
Region tracking is protected by mmap_sem and hugetlb_instantiation_mutex.
When we do mmap, we don't grab a hugetlb_instantiation_mutex, but only
mmap_sem (exclusively). This doesn't prevent other tasks from modifying
the region structure, so it can be modified by two processes concurrently.
Testcase hugemmap06.c is the trigger to cause system crash:
crash> bt -s
PID: 4492 TASK: ffff88033e437520 CPU: 2 COMMAND: "hugemmap06"
#0 [ffff88033dbb3960] machine_kexec+395 at ffffffff8103d1ab
#1 [ffff88033dbb39c0] crash_kexec+114 at ffffffff810cc4f2
#2 [ffff88033dbb3a90] oops_end+192 at ffffffff8153c840
#3 [ffff88033dbb3ac0] die+91 at ffffffff81010f5b
#4 [ffff88033dbb3af0] do_general_protection+338 at ffffffff8153c332
#5 [ffff88033dbb3b20] general_protection+37 at ffffffff8153bb05
[exception RIP: list_del+40]
RIP: ffffffff812a3598 RSP: ffff88033dbb3bd8 RFLAGS: 00010292
RAX: dead000000100100 RBX: ffff88013cf37340 RCX: 0000000000002dc2
RDX: dead000000200200 RSI: 0000000000000046 RDI: 0000000000000009
RBP: ffff88033dbb3be8 R8: 0000000000015598 R9: 0000000000000000
R10: 000000000000000f R11: 0000000000000009 R12: 000000000000000a
R13: ffff88033d64b9e8 R14: ffff88033e5b9720 R15: ffff88013cf37340
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0000
#6 [ffff88033dbb3bf0] region_add+154 at ffffffff811698da
#7 [ffff88033dbb3c40] alloc_huge_page+669 at ffffffff8116a61d
#8 [ffff88033dbb3ce0] hugetlb_fault+1083 at ffffffff8116b9bb
#9 [ffff88033dbb3d90] handle_mm_fault+917 at ffffffff81153295
#10 [ffff88033dbb3e00] __do_page_fault+326 at ffffffff8104f156
#11 [ffff88033dbb3f20] do_page_fault+62 at ffffffff8153e78e
#12 [ffff88033dbb3f50] page_fault+37 at ffffffff8153bb35
RIP: 00000000004027c6 RSP: 00007f7cadef9e80 RFLAGS: 00010297
RAX: 000000005a49238f RBX: 00007ffcb2d19320 RCX: 000000357498e084
RDX: 000000357498e0b0 RSI: 00007f7cadef9e5c RDI: 000000357498e4e0
RBP: 0000000000000008 R8: 000000357498e0a0 R9: 000000357498e100
R10: 00007f7cadefa9d0 R11: 0000000000000206 R12: 0000000000000007
R13: 0000000000000002 R14: 0000000000000003 R15: 00002aaaac000000
ORIG_RAX: ffffffffffffffff CS: 0033 SS: 002b
The fix are all these below commits:
f522c3ac00(mm, hugetlb: change variable name reservations to resv)
9119a41e90(mm, hugetlb: unify region structure handling)
7b24d8616b(mm, hugetlb: fix race in region tracking)
1406ec9ba6(mm, hugetlb: improve, cleanup resv_map parameters)
Signed-off-by: Li Wang <liwang@redhat.com>
Signed-off-by: Jan Stancek <jstancek@redhat.com>
4 files changed