【openEuler-1.0-LTS】mm,memory_failure: always pin the page in madvise_inject_error

```
Soft offlining pfn 0x1433bf at process virtual address 0x20ffe000
Soft offlining pfn 0x45b80 at process virtual address 0x20fff000
soft offline: 0x45b80 page already poisoned
Soft offlining pfn 0x14f771 at process virtual address 0x20ffc000
Unable to handle kernel paging request at virtual address dfff200000000000
Mem abort info:
  ESR = 0x96000004
Soft offlining pfn 0x1368f4 at process virtual address 0x20ffd000
  Exception class = DABT (current EL), IL = 32 bits
Soft offlining pfn 0x131b04 at process virtual address 0x20ffe000
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
Soft offlining pfn 0x45b80 at process virtual address 0x20fff000
[dfff200000000000] address between user and kernel address ranges
soft offline: 0x45b80 page already poisoned
Internal error: Oops: 96000004 [#1] SMP
Modules linked in:
Process syz-executor.2 (pid: 24892, stack limit = 0x000000002c7b8d2c)
Soft offlining pfn 0x1abf36 at process virtual address 0x20ffc000
CPU: 0 PID: 24892 Comm: syz-executor.2 Not tainted 4.19.90+ #1
Hardware name: linux,dummy-virt (DT)
pstate: 20400005 (nzCv daif +PAN -UAO)
pc : try_to_unmap_one+0x37c/0x1a30 mm/rmap.c:1442
lr : try_to_unmap_one+0x374/0x1a30 mm/rmap.c:1442
sp : ffff8000f0637710
x29: ffff8000f0637710 x28: ffff20000b2d8080 
Soft offlining pfn 0x1411f9 at process virtual address 0x20ffd000
x27: 1ffff0001e0c6f3e x26: 0000000000000018 
Soft offlining pfn 0x1433b2 at process virtual address 0x20ffe000
x25: 0000000020000000 x24: ffff80015835bce8 
Soft offlining pfn 0x45b80 at process virtual address 0x20fff000
x23: ffff8000f0637860 x22: ffff8000d7e9d000 
soft offline: 0x45b80 page already poisoned
x21: 0000000000000000 x20: ffff7e0006180000 
Soft offlining pfn 0x136b5a at process virtual address 0x20ffc000
x19: dfff200000000000 x18: 0000000000000000 
x17: 0000000000000000 x16: 0000000000000000 
x15: 1ffff00044a01a7c x14: 1ffff0001c9ce621 
x13: 0000000000000000 x12: 1ffff0001c9ce5f2 
x11: 000000000000b889 x10: ffff8000e4e73108 
x9 : 1ffff0001c9ce624 x8 : ffff10001a08abb0 
x7 : ffff8000d31f8ec8 x6 : ffff80015835bd28 
x5 : 1ffff0001e0c6ef8 x4 : ffff80010d4b2000 
x3 : ffff200008000000 x2 : ffff2000123e6000 
x1 : 0000000000000000 x0 : 0000000000000000 
Call trace:
 try_to_unmap_one+0x37c/0x1a30 mm/rmap.c:1442
 rmap_walk_anon+0x264/0x740 mm/rmap.c:1891
 rmap_walk+0xf8/0x170 mm/rmap.c:1962
 try_to_unmap+0x270/0x300 mm/rmap.c:1780
 hwpoison_user_mappings+0x330/0xbf8 mm/memory-failure.c:1088
 memory_failure+0x7ac/0xe88 mm/memory-failure.c:1501
 madvise_inject_error mm/madvise.c:680 [inline]
 do_madvise+0x8bc/0x12b0 mm/madvise.c:837
 __do_sys_madvise mm/madvise.c:904 [inline]
 __se_sys_madvise mm/madvise.c:902 [inline]
 __arm64_sys_madvise+0x74/0x218 mm/madvise.c:902
 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
 el0_svc_common+0x134/0x570 arch/arm64/kernel/syscall.c:121
 el0_svc_handler+0x190/0x260 arch/arm64/kernel/syscall.c:190
 el0_svc+0x10/0x640 arch/arm64/kernel/entry.S:1028
Code: 35fffe00 97f49362 f94012f5 d343fea0 (38f36800) 
---[ end trace fa4e804926af089d ]---
Soft offlining pfn 0x13410a at process virtual address 0x20ffd000
----------------
Code disassembly (best guess):
   0:	35fffe00 	cbnz	w0, 0xffffffffffffffc0
   4:	97f49362 	bl	0xffffffffffd24d8c
   8:	f94012f5 	ldr	x21, [x23, #32]
   c:	d343fea0 	lsr	x0, x21, #3
* 10:	38f36800 	ldrsb	w0, [x0, x19] <-- trapping instruction
```

0xffff200008730858 <try_to_unmap_one+880>:	bl	0xffff2000084555e0 <__sanitizer_cov_trace_pc>
0xffff20000873085c <try_to_unmap_one+884>:	ldr	x21, [x23,  32]; x23(pvmw) -> x21
0xffff200008730860 <try_to_unmap_one+888>:	lsr	x0, x21, #3 ; pte_pfn
0xffff200008730864 <try_to_unmap_one+892>:	ldrsb	w0, [x0, x19]
0xffff200008730868 <try_to_unmap_one+896>:	cbnz	w0, 0xffff200008731d00 <try_to_unmap_one+6168>

可以明确 X23 存储的是 pvmw

crash-arm64> struct page_vma_mapped_walk -x ffff8000f0637860
struct page_vma_mapped_walk {
  page = 0xffff7e0006180000,
  vma = 0xffff80015835bce8,
  address = 0x20000000,
  pmd = 0xffff800145d6a800,
  pte = 0x0,
  ptl = 0xffff8000d7e9d064,
  flags = 0x0
}

发现 pmd != 0 && pte == 0， 结合 VM_BUG_ON_PAGE 提示 & page_vma_mapped_walk 函数的注释

/* Unexpected PMD-mapped THP? */
VM_BUG_ON_PAGE(!pvmw.pte, page);

* If @pvmw->pmd is set but @pvmw->pte is not, you have found PMD-mapped page
 * (usually THP). For PTE-mapped THP, you should run page_vma_mapped_walk() in
 * a loop to find all PTEs that map the THP.

说明产生错误的原因是 try_to_unmap_one 正在处理它无法处理的 THP.
由于 CONFIG_DEBUG_VM 没有打开，所以 VM_BUG_ON_PAGE 并没有产生core。

对于 THP, memory_failure 需要将页面完成拆分，因此是memory_failure 由于错误导致 THP 没有拆分，需要进一步分析。

出错的页面flag

crash-arm64> kmem 0xffff7e0006180000
      PAGE        PHYSICAL      MAPPING       INDEX CNT FLAGS
ffff7e0006180000 1c6000000 ffff800167509881    20000  2 7ffff0000248469 locked,uptodate,lru,active,arch_1,head,swapbacked,hwpoison

[  670.072457] Injecting memory failure for pfn 0x1c6000 at process virtual address 0x20000000

向 VA: 0x20000000 pfn: 0x1c6000  的地址注入 hard offline 产生的问题

1e8aaedb182d, "mm,memory_failure: always pin the page in madvise_inject_error", v5.11-rc1

当前做hard offline的时候，直接进行了put_page, 可能会导致页面被重新利用.
如果不释放，这个页面在当前场景不就不会被装配成THP，分配出去, 从而解决问题。

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识