Re: THP race?

On Tue, Feb 23, 2016 at 06:49:50PM +0300, Kirill A. Shutemov wrote:

Hi Andrea,

I suspect there's race with THP in __handle_mm_fault(). It's pure
theoretical and race window is small, but..

Consider following scenario:

  - THP got allocated by other thread just before "pmd_none() &&
    __pte_alloc()" check, so pmd_none() is false and we don't
    allocate the page table.

  - But before pmd_trans_huge() check the page got unmap by
    MADV_DONTNEED in other thread.

  - At this point we will call pte_offset_map() for pmd which is
    pmd_none().

Nothing pleasant would happen after this...

Do you see anything what would prevent this scenario?

No so I think we need s/pmd_trans_huge/pmd_trans_unstable/ and use the
atomic read in C to sort this out lockless. The MADV_DONTNEED part
that isn't holding the mmap_sem for writing unfortunately wasn't
sorted out immediately, that was unexpected in
fact. pmd_trans_unstable() was introduced precisely to handle this
trouble caused by MADV_DONTNEED running with the mmap_sem only for
reading which causes infinite possible transactions back and forth
between none and transhuge while holding only the mmap_sem for
reading.

==