Re: page-flags behavior on compound pages: a worry

From: Vlastimil Babka
Date: Wed Aug 12 2015 - 10:48:02 EST

On 08/12/2015 04:35 PM, Kirill A. Shutemov wrote:
On Thu, Aug 06, 2015 at 12:24:22PM -0700, Hugh Dickins wrote:
IIUC, the only potentially problematic callsites left are physical memory
scanners. This code requires audit. I'll do that.


I haven't finished the exercise yet. But here's an issue I believe present
in current *Linus* tree:

From e78eec7d7a8c4cba8b5952a997973f7741e704f4 Mon Sep 17 00:00:00 2001
From: "Kirill A. Shutemov" <kirill.shutemov@xxxxxxxxxxxxxxx>
Date: Wed, 12 Aug 2015 17:09:16 +0300
Subject: [PATCH] mm: fix potential race in isolate_migratepages_block()

Hugh has pointed that compound_head() call can be unsafe in some context.
There's one example:


!!PageTail() == true
tail->first_page = NULL
head = tail->first_page
tail->first_page = head
!!PageTail() == true
<head == NULL dereferencing>

The race is pure theoretical. I don't it's possible to trigger it in
practice. But who knows.

It's even less probable thanks to the fact that before this check we determined it's a PageLRU (and thus !PageTail).

This can be fixed by avoiding compound_head() in unsafe context.

This is OK because if page becomes tail and we read zero page count, it's not fatal.

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx>

Fixes: 119d6d59dc ("mm, compaction: avoid isolating pinned pages")

Potentially stable 3.15+ if theoretical races qualify. They don't per stable rules, but we seem to be bending that a lot anyway.

Cc: Hugh Dickins <hughd@xxxxxxxxxx>
Cc: David Rientjes <rientjes@xxxxxxxxxx>
Cc: Vlastimil Babka <vbabka@xxxxxxx>

Acked-by: Vlastimil Babka <vbabka@xxxxxxx>

mm/compaction.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/compaction.c b/mm/compaction.c
index 86f04e556f96..bec727b700d3 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -787,7 +787,7 @@ isolate_migratepages_block(struct compact_control *cc, unsigned long low_pfn,
* admittedly racy check.
if (!page_mapping(page) &&
- page_count(page) > page_mapcount(page))
+ atomic_read(&page->_count) > page_mapcount(page))

/* If we already hold the lock, we can skip some rechecking */

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at