Messages in this thread | | | Subject | Re: [PATCH] mm/huge_memory.c: split should clone page flags before unfreezing pageref | From | Konstantin Khlebnikov <> | Date | Sun, 11 Feb 2018 16:13:14 +0300 |
| |
On 11.02.2018 14:07, Kirill A. Shutemov wrote: > On Sun, Feb 11, 2018 at 01:35:17PM +0300, Konstantin Khlebnikov wrote: >> THP split makes non-atomic change of tail page flags. This is almost ok >> because tail pages are locked and isolated but this breaks recent changes >> in page locking: non-atomic operation could clear bit PG_waiters. >> >> As a result concurrent sequence get_page_unless_zero() -> lock_page() >> might block forever. Especially if this page was truncated later. >> >> Fix is trivial: clone flags before unfreezing page reference counter. >> >> This race exists since commit 62906027091f ("mm: add PageWaiters indicating >> tasks are waiting for a page bit") while unsave unfreeze itself was added >> in commit 8df651c7059e ("thp: cleanup split_huge_page()"). > > Hm. Don't we have to have barrier between setting flags and updating > the refcounter in this case? Atomics don't generally have this semantics, > so you can see new refcount before new flags even after the change. >
Ok.
I see another problem here - clear_compound_head() is placed after unfreeze.
This opens race window with get/put_page after speculative get page. I think successful get_page_unless_zero() must stabilize compound_head() for tails as well as for heads.
| |