)]}' { "log": [ { "commit": "1a5a9906d4e8d1976b701f889d8f35d54b928f25", "tree": "e51912e725f224663a738045a4d0528d08da4572", "parents": [ "31f6765266417c0d99f0e922fe82848a7c9c2ae9" ], "author": { "name": "Andrea Arcangeli", "email": "aarcange@redhat.com", "time": "Wed Mar 21 16:33:42 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 21 17:54:54 2012 -0700" }, "message": "mm: thp: fix pmd_bad() triggering in code paths holding mmap_sem read mode\n\nIn some cases it may happen that pmd_none_or_clear_bad() is called with\nthe mmap_sem hold in read mode. In those cases the huge page faults can\nallocate hugepmds under pmd_none_or_clear_bad() and that can trigger a\nfalse positive from pmd_bad() that will not like to see a pmd\nmaterializing as trans huge.\n\nIt\u0027s not khugepaged causing the problem, khugepaged holds the mmap_sem\nin write mode (and all those sites must hold the mmap_sem in read mode\nto prevent pagetables to go away from under them, during code review it\nseems vm86 mode on 32bit kernels requires that too unless it\u0027s\nrestricted to 1 thread per process or UP builds). The race is only with\nthe huge pagefaults that can convert a pmd_none() into a\npmd_trans_huge().\n\nEffectively all these pmd_none_or_clear_bad() sites running with\nmmap_sem in read mode are somewhat speculative with the page faults, and\nthe result is always undefined when they run simultaneously. This is\nprobably why it wasn\u0027t common to run into this. For example if the\nmadvise(MADV_DONTNEED) runs zap_page_range() shortly before the page\nfault, the hugepage will not be zapped, if the page fault runs first it\nwill be zapped.\n\nAltering pmd_bad() not to error out if it finds hugepmds won\u0027t be enough\nto fix this, because zap_pmd_range would then proceed to call\nzap_pte_range (which would be incorrect if the pmd become a\npmd_trans_huge()).\n\nThe simplest way to fix this is to read the pmd in the local stack\n(regardless of what we read, no need of actual CPU barriers, only\ncompiler barrier needed), and be sure it is not changing under the code\nthat computes its value. Even if the real pmd is changing under the\nvalue we hold on the stack, we don\u0027t care. If we actually end up in\nzap_pte_range it means the pmd was not none already and it was not huge,\nand it can\u0027t become huge from under us (khugepaged locking explained\nabove).\n\nAll we need is to enforce that there is no way anymore that in a code\npath like below, pmd_trans_huge can be false, but pmd_none_or_clear_bad\ncan run into a hugepmd. The overhead of a barrier() is just a compiler\ntweak and should not be measurable (I only added it for THP builds). I\ndon\u0027t exclude different compiler versions may have prevented the race\ntoo by caching the value of *pmd on the stack (that hasn\u0027t been\nverified, but it wouldn\u0027t be impossible considering\npmd_none_or_clear_bad, pmd_bad, pmd_trans_huge, pmd_none are all inlines\nand there\u0027s no external function called in between pmd_trans_huge and\npmd_none_or_clear_bad).\n\n\t\tif (pmd_trans_huge(*pmd)) {\n\t\t\tif (next-addr !\u003d HPAGE_PMD_SIZE) {\n\t\t\t\tVM_BUG_ON(!rwsem_is_locked(\u0026tlb-\u003emm-\u003emmap_sem));\n\t\t\t\tsplit_huge_page_pmd(vma-\u003evm_mm, pmd);\n\t\t\t} else if (zap_huge_pmd(tlb, vma, pmd, addr))\n\t\t\t\tcontinue;\n\t\t\t/* fall through */\n\t\t}\n\t\tif (pmd_none_or_clear_bad(pmd))\n\nBecause this race condition could be exercised without special\nprivileges this was reported in CVE-2012-1179.\n\nThe race was identified and fully explained by Ulrich who debugged it.\nI\u0027m quoting his accurate explanation below, for reference.\n\n\u003d\u003d\u003d\u003d\u003d\u003d start quote \u003d\u003d\u003d\u003d\u003d\u003d\u003d\n mapcount 0 page_mapcount 1\n kernel BUG at mm/huge_memory.c:1384!\n\n At some point prior to the panic, a \"bad pmd ...\" message similar to the\n following is logged on the console:\n\n mm/memory.c:145: bad pmd ffff8800376e1f98(80000000314000e7).\n\n The \"bad pmd ...\" message is logged by pmd_clear_bad() before it clears\n the page\u0027s PMD table entry.\n\n 143 void pmd_clear_bad(pmd_t *pmd)\n 144 {\n -\u003e 145 pmd_ERROR(*pmd);\n 146 pmd_clear(pmd);\n 147 }\n\n After the PMD table entry has been cleared, there is an inconsistency\n between the actual number of PMD table entries that are mapping the page\n and the page\u0027s map count (_mapcount field in struct page). When the page\n is subsequently reclaimed, __split_huge_page() detects this inconsistency.\n\n 1381 if (mapcount !\u003d page_mapcount(page))\n 1382 printk(KERN_ERR \"mapcount %d page_mapcount %d\\n\",\n 1383 mapcount, page_mapcount(page));\n -\u003e 1384 BUG_ON(mapcount !\u003d page_mapcount(page));\n\n The root cause of the problem is a race of two threads in a multithreaded\n process. Thread B incurs a page fault on a virtual address that has never\n been accessed (PMD entry is zero) while Thread A is executing an madvise()\n system call on a virtual address within the same 2 MB (huge page) range.\n\n virtual address space\n .---------------------.\n | |\n | |\n .-|---------------------|\n | | |\n | | |\u003c-- B(fault)\n | | |\n 2 MB | |/////////////////////|-.\n huge \u003c |/////////////////////| \u003e A(range)\n page | |/////////////////////|-\u0027\n | | |\n | | |\n \u0027-|---------------------|\n | |\n | |\n \u0027---------------------\u0027\n\n - Thread A is executing an madvise(..., MADV_DONTNEED) system call\n on the virtual address range \"A(range)\" shown in the picture.\n\n sys_madvise\n // Acquire the semaphore in shared mode.\n down_read(\u0026current-\u003emm-\u003emmap_sem)\n ...\n madvise_vma\n switch (behavior)\n case MADV_DONTNEED:\n madvise_dontneed\n zap_page_range\n unmap_vmas\n unmap_page_range\n zap_pud_range\n zap_pmd_range\n //\n // Assume that this huge page has never been accessed.\n // I.e. content of the PMD entry is zero (not mapped).\n //\n if (pmd_trans_huge(*pmd)) {\n // We don\u0027t get here due to the above assumption.\n }\n //\n // Assume that Thread B incurred a page fault and\n .---------\u003e // sneaks in here as shown below.\n | //\n | if (pmd_none_or_clear_bad(pmd))\n | {\n | if (unlikely(pmd_bad(*pmd)))\n | pmd_clear_bad\n | {\n | pmd_ERROR\n | // Log \"bad pmd ...\" message here.\n | pmd_clear\n | // Clear the page\u0027s PMD entry.\n | // Thread B incremented the map count\n | // in page_add_new_anon_rmap(), but\n | // now the page is no longer mapped\n | // by a PMD entry (-\u003e inconsistency).\n | }\n | }\n |\n v\n - Thread B is handling a page fault on virtual address \"B(fault)\" shown\n in the picture.\n\n ...\n do_page_fault\n __do_page_fault\n // Acquire the semaphore in shared mode.\n down_read_trylock(\u0026mm-\u003emmap_sem)\n ...\n handle_mm_fault\n if (pmd_none(*pmd) \u0026\u0026 transparent_hugepage_enabled(vma))\n // We get here due to the above assumption (PMD entry is zero).\n do_huge_pmd_anonymous_page\n alloc_hugepage_vma\n // Allocate a new transparent huge page here.\n ...\n __do_huge_pmd_anonymous_page\n ...\n spin_lock(\u0026mm-\u003epage_table_lock)\n ...\n page_add_new_anon_rmap\n // Here we increment the page\u0027s map count (starts at -1).\n atomic_set(\u0026page-\u003e_mapcount, 0)\n set_pmd_at\n // Here we set the page\u0027s PMD entry which will be cleared\n // when Thread A calls pmd_clear_bad().\n ...\n spin_unlock(\u0026mm-\u003epage_table_lock)\n\n The mmap_sem does not prevent the race because both threads are acquiring\n it in shared mode (down_read). Thread B holds the page_table_lock while\n the page\u0027s map count and PMD table entry are updated. However, Thread A\n does not synchronize on that lock.\n\n\u003d\u003d\u003d\u003d\u003d\u003d end quote \u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\n[akpm@linux-foundation.org: checkpatch fixes]\nReported-by: Ulrich Obergfell \u003cuobergfe@redhat.com\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nAcked-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Dave Jones \u003cdavej@redhat.com\u003e\nAcked-by: Larry Woodman \u003clwoodman@redhat.com\u003e\nAcked-by: Rik van Riel \u003criel@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t\t[2.6.38+]\nCc: Mark Salter \u003cmsalter@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "dd78553b5e7a0b34c0b60478d04ee16d8d8f4fa7", "tree": "18bdb94761365c248392d29004f68d9181955ead", "parents": [ "c27fe4c8942d3ca715986f79cc26f44608d7d9fb" ], "author": { "name": "KOSAKI Motohiro", "email": "kosaki.motohiro@jp.fujitsu.com", "time": "Mon Jul 25 17:12:11 2011 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 25 20:57:09 2011 -0700" }, "message": "pagewalk: fix code comment for THP\n\nCommit bae9c19bf1 (\"thp: split_huge_page_mm/vma\") changed locking behavior\nof walk_page_range(). Thus this patch changes the comment too.\n\nSigned-off-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nCc: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Hiroyuki Kamezawa \u003ckamezawa.hiroyuki@gmail.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Matt Mackall \u003cmpm@selenic.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c27fe4c8942d3ca715986f79cc26f44608d7d9fb", "tree": "d954d0417c941f5e51cf029608311ef04acd9575", "parents": [ "6c6d5280431544e4036886ea74e3334a98bc5f96" ], "author": { "name": "KOSAKI Motohiro", "email": "kosaki.motohiro@jp.fujitsu.com", "time": "Mon Jul 25 17:12:10 2011 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 25 20:57:08 2011 -0700" }, "message": "pagewalk: add locking-rule comments\n\nOriginally, walk_hugetlb_range() didn\u0027t require a caller take any lock.\nBut commit d33b9f45bd (\"mm: hugetlb: fix hugepage memory leak in\nwalk_page_range\") changed its rule. Because it added find_vma() call in\nwalk_hugetlb_range().\n\nAny locking-rule change commit should write a doc too.\n\n[akpm@linux-foundation.org: clarify comment]\nSigned-off-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nCc: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Hiroyuki Kamezawa \u003ckamezawa.hiroyuki@gmail.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Matt Mackall \u003cmpm@selenic.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6c6d5280431544e4036886ea74e3334a98bc5f96", "tree": "1362944d254ff1dfa609d84a1e4182a77ce3ca07", "parents": [ "4b6ddbf7ed4ef2f40e0a27418146eedaa68953c6" ], "author": { "name": "KOSAKI Motohiro", "email": "kosaki.motohiro@jp.fujitsu.com", "time": "Mon Jul 25 17:12:09 2011 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 25 20:57:08 2011 -0700" }, "message": "pagewalk: don\u0027t look up vma if walk-\u003ehugetlb_entry is unused\n\nCurrently, walk_page_range() calls find_vma() every page table for walk\niteration. but it\u0027s completely unnecessary if walk-\u003ehugetlb_entry is\nunused. And we don\u0027t have to assume find_vma() is a lightweight\noperation. So this patch checks the walk-\u003ehugetlb_entry and avoids the\nfind_vma() call if possible.\n\nThis patch also makes some cleanups. 1) remove ugly uninitialized_var()\nand 2) #ifdef in function body.\n\nSigned-off-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nCc: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Hiroyuki Kamezawa \u003ckamezawa.hiroyuki@gmail.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Matt Mackall \u003cmpm@selenic.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "4b6ddbf7ed4ef2f40e0a27418146eedaa68953c6", "tree": "27ab200848514a467f656281073b9c0f86cb7dcc", "parents": [ "45ebb840257b060ec54416aebffd9747e210962c" ], "author": { "name": "KOSAKI Motohiro", "email": "kosaki.motohiro@jp.fujitsu.com", "time": "Mon Jul 25 17:12:09 2011 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jul 25 20:57:08 2011 -0700" }, "message": "pagewalk: fix walk_page_range() don\u0027t check find_vma() result properly\n\nThe doc of find_vma() says,\n\n /* Look up the first VMA which satisfies addr \u003c vm_end, NULL if none. */\n struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)\n {\n (snip)\n\nThus, caller should confirm whether the returned vma matches a desired one.\n\nSigned-off-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nCc: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Hiroyuki Kamezawa \u003ckamezawa.hiroyuki@gmail.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Matt Mackall \u003cmpm@selenic.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "033193275b3ffcfe7f3fde7b569f3d207f6cd6a0", "tree": "fc65fa02248f855f0f63e087f35a507b6abb5617", "parents": [ "278df9f451dc71dcd002246be48358a473504ad0" ], "author": { "name": "Dave Hansen", "email": "dave@linux.vnet.ibm.com", "time": "Tue Mar 22 16:32:56 2011 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Mar 22 17:44:04 2011 -0700" }, "message": "pagewalk: only split huge pages when necessary\n\nRight now, if a mm_walk has either -\u003epte_entry or -\u003epmd_entry set, it will\nunconditionally split any transparent huge pages it runs in to. In\npractice, that means that anyone doing a\n\n\tcat /proc/$pid/smaps\n\nwill unconditionally break down every huge page in the process and depend\non khugepaged to re-collapse it later. This is fairly suboptimal.\n\nThis patch changes that behavior. It teaches each -\u003epmd_entry handler\n(there are five) that they must break down the THPs themselves. Also, the\n_generic_ code will never break down a THP unless a -\u003epte_entry handler is\nactually set.\n\nThis means that the -\u003epmd_entry handlers can now choose to deal with THPs\nwithout breaking them down.\n\n[akpm@linux-foundation.org: coding-style fixes]\nSigned-off-by: Dave Hansen \u003cdave@linux.vnet.ibm.com\u003e\nAcked-by: Mel Gorman \u003cmel@csn.ul.ie\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nReviewed-by: Eric B Munson \u003cemunson@mgebm.net\u003e\nTested-by: Eric B Munson \u003cemunson@mgebm.net\u003e\nCc: Michael J Wolf \u003cmjwolf@us.ibm.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Matt Mackall \u003cmpm@selenic.com\u003e\nCc: Jeremy Fitzhardinge \u003cjeremy@goop.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "bae9c19bf12bb2a914a8e530270f41d36cc87c63", "tree": "19807de9c2cb9b47fa842a549bd8c2c21579e323", "parents": [ "e7a00c45f29c0155007aa150bf231a70fa470365" ], "author": { "name": "Andrea Arcangeli", "email": "aarcange@redhat.com", "time": "Thu Jan 13 15:46:46 2011 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jan 13 17:32:41 2011 -0800" }, "message": "thp: split_huge_page_mm/vma\n\nsplit_huge_page_pmd compat code. Each one of those would need to be\nexpanded to hundred of lines of complex code without a fully reliable\nsplit_huge_page_pmd design.\n\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nAcked-by: Rik van Riel \u003criel@redhat.com\u003e\nAcked-by: Mel Gorman \u003cmel@csn.ul.ie\u003e\nSigned-off-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "5f0af70a25593a9d53b87bc8d31902fb7cc63e40", "tree": "0abf2f2994398ac2ec11209ba9edc3b433622b3f", "parents": [ "e9959f0f37160e1f5351af828cc981712b5066c1" ], "author": { "name": "David Sterba", "email": "dsterba@suse.cz", "time": "Wed Nov 24 12:57:10 2010 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 25 06:50:46 2010 +0900" }, "message": "mm: remove call to find_vma in pagewalk for non-hugetlbfs\n\nCommit d33b9f45 (\"mm: hugetlb: fix hugepage memory leak in\nwalk_page_range()\") introduces a check if a vma is a hugetlbfs one and\nlater in 5dc37642 (\"mm hugetlb: add hugepage support to pagemap\") it is\nmoved under #ifdef CONFIG_HUGETLB_PAGE but a needless find_vma call is\nleft behind and its result is not used anywhere else in the function.\n\nThe side-effect of caching vma for @addr inside walk-\u003emm is neither\nutilized in walk_page_range() nor in called functions.\n\nSigned-off-by: David Sterba \u003cdsterba@suse.cz\u003e\nReviewed-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nAcked-by: Andi Kleen \u003cak@linux.intel.com\u003e\nCc: Andy Whitcroft \u003capw@canonical.com\u003e\nCc: David Rientjes \u003crientjes@google.com\u003e\nCc: Hugh Dickins \u003chugh.dickins@tiscali.co.uk\u003e\nCc: Lee Schermerhorn \u003clee.schermerhorn@hp.com\u003e\nCc: Matt Mackall \u003cmpm@selenic.com\u003e\nAcked-by: Mel Gorman \u003cmel@csn.ul.ie\u003e\nCc: Wu Fengguang \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "116354d177ba2da37e91cf884e3d11e67f825efd", "tree": "150227e8a5c9ce8b6dd9333593ed513c8c012686", "parents": [ "57119c34e53bbb8d244c3ff1335ef5145768538f" ], "author": { "name": "Naoya Horiguchi", "email": "n-horiguchi@ah.jp.nec.com", "time": "Tue Apr 06 14:35:04 2010 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 07 08:38:04 2010 -0700" }, "message": "pagemap: fix pfn calculation for hugepage\n\nWhen we look into pagemap using page-types with option -p, the value of\npfn for hugepages looks wrong (see below.) This is because pte was\nevaluated only once for one vma although it should be updated for each\nhugepage. This patch fixes it.\n\n $ page-types -p 3277 -Nl -b huge\n voffset offset len flags\n 7f21e8a00 11e400 1 ___U___________H_G________________\n 7f21e8a01 11e401 1ff ________________TG________________\n ^^^\n 7f21e8c00 11e400 1 ___U___________H_G________________\n 7f21e8c01 11e401 1ff ________________TG________________\n ^^^\n\nOne hugepage contains 1 head page and 511 tail pages in x86_64 and each\ntwo lines represent each hugepage. Voffset and offset mean virtual\naddress and physical address in the page unit, respectively. The\ndifferent hugepages should not have the same offset value.\n\nWith this patch applied:\n\n $ page-types -p 3386 -Nl -b huge\n voffset offset len flags\n 7fec7a600 112c00 1 ___UD__________H_G________________\n 7fec7a601 112c01 1ff ________________TG________________\n ^^^\n 7fec7a800 113200 1 ___UD__________H_G________________\n 7fec7a801 113201 1ff ________________TG________________\n ^^^\n OK\n\nMore info:\n\n- This patch modifies walk_page_range()\u0027s hugepage walker. But the\n change only affects pagemap_read(), which is the only caller of hugepage\n callback.\n\n- Without this patch, hugetlb_entry() callback is called per vma, that\n doesn\u0027t match the natural expectation from its name.\n\n- With this patch, hugetlb_entry() is called per hugepte entry and the\n callback can become much simpler.\n\nSigned-off-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nSigned-off-by: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nAcked-by: Matt Mackall \u003cmpm@selenic.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "5dc37642cbce34619e4588a9f0bdad1d2f870956", "tree": "00165a3a0b3d768abaf83cf44642f09398b989cc", "parents": [ "d33b9f45bd24a6391bc05e2b5a13c1b5787ca9c2" ], "author": { "name": "Naoya Horiguchi", "email": "n-horiguchi@ah.jp.nec.com", "time": "Mon Dec 14 18:00:01 2009 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 15 08:53:24 2009 -0800" }, "message": "mm hugetlb: add hugepage support to pagemap\n\nThis patch enables extraction of the pfn of a hugepage from\n/proc/pid/pagemap in an architecture independent manner.\n\nDetails\n-------\nMy test program (leak_pagemap) works as follows:\n - creat() and mmap() a file on hugetlbfs (file size is 200MB \u003d\u003d 100 hugepages,)\n - read()/write() something on it,\n - call page-types with option -p,\n - munmap() and unlink() the file on hugetlbfs\n\nWithout my patches\n------------------\n$ ./leak_pagemap\n flags page-count MB symbolic-flags long-symbolic-flags\n0x0000000000000000 1 0 __________________________________\n0x0000000000000804 1 0 __R________M______________________ referenced,mmap\n0x000000000000086c 81 0 __RU_lA____M______________________ referenced,uptodate,lru,active,mmap\n0x0000000000005808 5 0 ___U_______Ma_b___________________ uptodate,mmap,anonymous,swapbacked\n0x0000000000005868 12 0 ___U_lA____Ma_b___________________ uptodate,lru,active,mmap,anonymous,swapbacked\n0x000000000000586c 1 0 __RU_lA____Ma_b___________________ referenced,uptodate,lru,active,mmap,anonymous,swapbacked\n total 101 0\n\nThe output of page-types don\u0027t show any hugepage.\n\nWith my patches\n---------------\n$ ./leak_pagemap\n flags page-count MB symbolic-flags long-symbolic-flags\n0x0000000000000000 1 0 __________________________________\n0x0000000000030000 51100 199 ________________TG________________ compound_tail,huge\n0x0000000000028018 100 0 ___UD__________H_G________________ uptodate,dirty,compound_head,huge\n0x0000000000000804 1 0 __R________M______________________ referenced,mmap\n0x000000000000080c 1 0 __RU_______M______________________ referenced,uptodate,mmap\n0x000000000000086c 80 0 __RU_lA____M______________________ referenced,uptodate,lru,active,mmap\n0x0000000000005808 4 0 ___U_______Ma_b___________________ uptodate,mmap,anonymous,swapbacked\n0x0000000000005868 12 0 ___U_lA____Ma_b___________________ uptodate,lru,active,mmap,anonymous,swapbacked\n0x000000000000586c 1 0 __RU_lA____Ma_b___________________ referenced,uptodate,lru,active,mmap,anonymous,swapbacked\n total 51300 200\n\nThe output of page-types shows 51200 pages contributing to hugepages,\ncontaining 100 head pages and 51100 tail pages as expected.\n\n[akpm@linux-foundation.org: build fix]\nSigned-off-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Andi Kleen \u003cak@linux.intel.com\u003e\nCc: Wu Fengguang \u003cfengguang.wu@intel.com\u003e\nCc: Hugh Dickins \u003chugh.dickins@tiscali.co.uk\u003e\nCc: Mel Gorman \u003cmel@csn.ul.ie\u003e\nCc: Lee Schermerhorn \u003clee.schermerhorn@hp.com\u003e\nCc: Andy Whitcroft \u003capw@canonical.com\u003e\nCc: David Rientjes \u003crientjes@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d33b9f45bd24a6391bc05e2b5a13c1b5787ca9c2", "tree": "c79c7a452a18f513efbbc807440812432778332f", "parents": [ "4f16fc107d9c9b8a72aa19b189a9216e90a7aaef" ], "author": { "name": "Naoya Horiguchi", "email": "n-horiguchi@ah.jp.nec.com", "time": "Mon Dec 14 17:59:59 2009 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Dec 15 08:53:24 2009 -0800" }, "message": "mm: hugetlb: fix hugepage memory leak in walk_page_range()\n\nMost callers of pmd_none_or_clear_bad() check whether the target page is\nin a hugepage or not, but walk_page_range() do not check it. So if we\nread /proc/pid/pagemap for the hugepage on x86 machine, the hugepage\nmemory is leaked as shown below. This patch fixes it.\n\nDetails\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nMy test program (leak_pagemap) works as follows:\n - creat() and mmap() a file on hugetlbfs (file size is 200MB \u003d\u003d 100 hugepages,)\n - read()/write() something on it,\n - call page-types with option -p (walk around the page tables),\n - munmap() and unlink() the file on hugetlbfs\n\nWithout my patches\n------------------\n$ cat /proc/meminfo |grep \"HugePage\"\nHugePages_Total: 1000\nHugePages_Free: 1000\nHugePages_Rsvd: 0\nHugePages_Surp: 0\n$ ./leak_pagemap\n[snip output]\n$ cat /proc/meminfo |grep \"HugePage\"\nHugePages_Total: 1000\nHugePages_Free: 900\nHugePages_Rsvd: 0\nHugePages_Surp: 0\n$ ls /hugetlbfs/\n$\n\n100 hugepages are accounted as used while there is no file on hugetlbfs.\n\nWith my patches\n---------------\n$ cat /proc/meminfo |grep \"HugePage\"\nHugePages_Total: 1000\nHugePages_Free: 1000\nHugePages_Rsvd: 0\nHugePages_Surp: 0\n$ ./leak_pagemap\n[snip output]\n$ cat /proc/meminfo |grep \"HugePage\"\nHugePages_Total: 1000\nHugePages_Free: 1000\nHugePages_Rsvd: 0\nHugePages_Surp: 0\n$ ls /hugetlbfs\n$\n\nNo memory leaks.\n\nSigned-off-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Andi Kleen \u003cak@linux.intel.com\u003e\nCc: Wu Fengguang \u003cfengguang.wu@intel.com\u003e\nCc: Hugh Dickins \u003chugh.dickins@tiscali.co.uk\u003e\nCc: Mel Gorman \u003cmel@csn.ul.ie\u003e\nCc: Lee Schermerhorn \u003clee.schermerhorn@hp.com\u003e\nCc: Andy Whitcroft \u003capw@canonical.com\u003e\nCc: David Rientjes \u003crientjes@google.com\u003e\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "2165009bdf63f79716a36ad545df14c3cdf958b7", "tree": "83d1735f2104b6b5158be56a362856ac1079861d", "parents": [ "cfc53f65f56f9f33c0cf522124045ac5a64076b3" ], "author": { "name": "Dave Hansen", "email": "dave@linux.vnet.ibm.com", "time": "Thu Jun 12 15:21:47 2008 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jun 12 18:05:41 2008 -0700" }, "message": "pagemap: pass mm into pagewalkers\n\nWe need this at least for huge page detection for now, because powerpc\nneeds the vm_area_struct to be able to determine whether a virtual address\nis referring to a huge page (its pmd_huge() doesn\u0027t work).\n\nIt might also come in handy for some of the other users.\n\nSigned-off-by: Dave Hansen \u003cdave@linux.vnet.ibm.com\u003e\nAcked-by: Matt Mackall \u003cmpm@selenic.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "556637cdabcd5918c7d4a1a2679b8f86fc81e891", "tree": "a5bb95b50e88535966af3ad49017196b757fca64", "parents": [ "f022bfd58253099102218db5249220a7f4787114" ], "author": { "name": "Johannes Weiner", "email": "hannes@saeurebad.de", "time": "Mon Apr 28 02:11:47 2008 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 28 08:58:16 2008 -0700" }, "message": "mm: fix possible off-by-one in walk_pte_range()\n\nAfter the loop in walk_pte_range() pte might point to the first address after\nthe pmd it walks. The pte_unmap() is then applied to something bad.\n\nSpotted by Roel Kluin and Andreas Schwab.\n\nSigned-off-by: Johannes Weiner \u003channes@saeurebad.de\u003e\nCc: Roel Kluin \u003c12o3l@tiscali.nl\u003e\nCc: Andreas Schwab \u003cschwab@suse.de\u003e\nAcked-by: Matt Mackall \u003cmpm@selenic.com\u003e\nAcked-by: Mikael Pettersson \u003cmikpe@it.uu.se\u003e\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "7682486b3ee06f800d5b11033371c7c5e92e3057", "tree": "d0c2eda3204b085fc63200c787b2cf04f0298729", "parents": [ "6cb2a21049b8990df4576c5fce4d48d0206c22d5" ], "author": { "name": "Randy Dunlap", "email": "randy.dunlap@oracle.com", "time": "Wed Mar 19 17:00:40 2008 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Mar 19 18:53:35 2008 -0700" }, "message": "mm: fix various kernel-doc comments\n\nFix various kernel-doc notation in mm/:\n\nfilemap.c: add function short description; convert 2 to kernel-doc\nfremap.c: change parameter \u0027prot\u0027 to @prot\npagewalk.c: change \"-\" in function parameters to \":\"\nslab.c: fix short description of kmem_ptr_validate()\nswap.c: fix description \u0026 parameters of put_pages_list()\nswap_state.c: fix function parameters\nvmalloc.c: change \"@returns\" to \"Returns:\" since that is not a parameter\n\nSigned-off-by: Randy Dunlap \u003crandy.dunlap@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e6473092bd9116583ce9ab8cf1b6570e1aa6fc83", "tree": "e91a7ca6ce89f24a4a2d500d748dabf727c61887", "parents": [ "698dd4ba6b12e34e1e432c944c01478c0b2cd773" ], "author": { "name": "Matt Mackall", "email": "mpm@selenic.com", "time": "Mon Feb 04 22:29:01 2008 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@woody.linux-foundation.org", "time": "Tue Feb 05 09:44:16 2008 -0800" }, "message": "maps4: introduce a generic page walker\n\nIntroduce a general page table walker\n\nSigned-off-by: Matt Mackall \u003cmpm@selenic.com\u003e\nCc: Dave Hansen \u003chaveblue@us.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" } ] }