Re: [PATCH -alternative] mm: hugetlbfs: Close race during teardownof hugetlbfs shared page tables V2 (resend)

[Larry Woodman]

On 07/26/2012 02:37 PM, Rik van Riel wrote:
> On 07/23/2012 12:04 AM, Hugh Dickins wrote:
>
> > I spent hours trying to dream up a better patch, trying various
> > approaches.  I think I have a nice one now, what do you think?  And
> > more importantly, does it work?  I have not tried to test it at all,
> > that I'm hoping to leave to you, I'm sure you'll attack it with gusto!
> >
> > If you like it, please take it over and add your comments and signoff
> > and send it in.  The second part won't come up in your testing, and 
> > could
> > be made a separate patch if you prefer: it's a related point that struck
> > me while I was playing with a different approach.
> >
> > I'm sorely tempted to leave a dangerous pair of eyes off the Cc,
> > but that too would be unfair.
> >
> > Subject-to-your-testing-
> > Signed-off-by: Hugh Dickins <hughd@xxxxxxxxxx>
>
> This patch looks good to me.
>
> Larry, does Hugh's patch survive your testing?
Like I said earlier, no.  However, I finally set up a reproducer that 
only takes a few seconds
on a large system and this totally fixes the problem:

-------------------------------------------------------------------------------------------------------------------------
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index c36febb..cc023b8 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2151,7 +2151,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, 
struct mm_struct *src,
                        goto nomem;

                /* If the pagetables are shared don't copy or take 
references */
-               if (dst_pte == src_pte)
+               if (*(unsigned long *)dst_pte == *(unsigned long *)src_pte)
                        continue;

                spin_lock(&dst->page_table_lock);
---------------------------------------------------------------------------------------------------------------------------

When we compare what the src_pte & dst_pte point to instead of their 
addresses everything works,
I suspect there is a missing memory barrier somewhere ???

Larry

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/