[PATCH] mm/vmscan: Fix NR_ISOLATED_FILE corruption on 64-bit

[PATCH] mm/vmscan: Fix NR_ISOLATED_FILE corruption on 64-bit

[Nicholas Piggin]

Previously the negated unsigned long would be cast back to signed long
which would have the correct negative value. After commit 730ec8c01a2b
("mm/vmscan.c: change prototype for shrink_page_list"), the large
unsigned int converts to a large positive signed long.

Symptoms include CMA allocations hanging forever holding the cma_mutex
due to alloc_contig_range->...->isolate_migratepages_block waiting
forever in "while (unlikely(too_many_isolated(pgdat)))".

Cc: linux-mm@kvack.org
Cc: Maninder Singh <maninder1.s@samsung.com>
Cc: Vaneet Narang <v.narang@samsung.com>
Cc: Maninder Singh <maninder1.s@samsung.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Amit Sahrawat <a.sahrawat@samsung.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Vlastimil Babka <vbabka@suse.cz>
Fixes: 730ec8c01a2b ("mm/vmscan.c: change prototype for shrink_page_list")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
---
 mm/vmscan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index 1b8f0e059767..92c507bacf09 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1516,7 +1516,7 @@ unsigned int reclaim_clean_pages_from_list(struct zone *zone,
 	nr_reclaimed = shrink_page_list(&clean_pages, zone->zone_pgdat, &sc,
 			TTU_IGNORE_ACCESS, &stat, true);
 	list_splice(&clean_pages, page_list);
-	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE, -nr_reclaimed);
+	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE, -(long)nr_reclaimed);
 	/*
 	 * Since lazyfree pages are isolated from file LRU from the beginning,
 	 * they will rotate back to anonymous LRU in the end if it failed to
-- 
2.23.0

Re: [PATCH] mm/vmscan: Fix NR_ISOLATED_FILE corruption on 64-bit

[Michal Hocko]

On Thu 29-10-20 13:23:20, Nicholas Piggin wrote:
> Previously the negated unsigned long would be cast back to signed long
> which would have the correct negative value. After commit 730ec8c01a2b
> ("mm/vmscan.c: change prototype for shrink_page_list"), the large
> unsigned int converts to a large positive signed long.
> 
> Symptoms include CMA allocations hanging forever holding the cma_mutex
> due to alloc_contig_range->...->isolate_migratepages_block waiting
> forever in "while (unlikely(too_many_isolated(pgdat)))".

Nasty.

> Cc: linux-mm@kvack.org
> Cc: Maninder Singh <maninder1.s@samsung.com>
> Cc: Vaneet Narang <v.narang@samsung.com>
> Cc: Maninder Singh <maninder1.s@samsung.com>
> Cc: Michal Hocko <mhocko@suse.com>
> Cc: Amit Sahrawat <a.sahrawat@samsung.com>
> Cc: Mel Gorman <mgorman@suse.de>
> Cc: Vlastimil Babka <vbabka@suse.cz>
> Fixes: 730ec8c01a2b ("mm/vmscan.c: change prototype for shrink_page_list")
> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
> ---
>  mm/vmscan.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/vmscan.c b/mm/vmscan.c
> index 1b8f0e059767..92c507bacf09 100644
> --- a/mm/vmscan.c
> +++ b/mm/vmscan.c
> @@ -1516,7 +1516,7 @@ unsigned int reclaim_clean_pages_from_list(struct zone *zone,
>  	nr_reclaimed = shrink_page_list(&clean_pages, zone->zone_pgdat, &sc,
>  			TTU_IGNORE_ACCESS, &stat, true);
>  	list_splice(&clean_pages, page_list);
> -	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE, -nr_reclaimed);
> +	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE, -(long)nr_reclaimed);
>  	/*
>  	 * Since lazyfree pages are isolated from file LRU from the beginning,
>  	 * they will rotate back to anonymous LRU in the end if it failed to

You want the same also for -stat.nr_lazyfree_fail right?

-- 
Michal Hocko
SUSE Labs

Re: [PATCH] mm/vmscan: Fix NR_ISOLATED_FILE corruption on 64-bit

[Andrew Morton]

On Thu, 29 Oct 2020 14:11:03 +0100 Michal Hocko <mhocko@suse.com> wrote:

> On Thu 29-10-20 13:23:20, Nicholas Piggin wrote:
> > Previously the negated unsigned long would be cast back to signed long
> > which would have the correct negative value. After commit 730ec8c01a2b
> > ("mm/vmscan.c: change prototype for shrink_page_list"), the large
> > unsigned int converts to a large positive signed long.
> > 
> > Symptoms include CMA allocations hanging forever holding the cma_mutex
> > due to alloc_contig_range->...->isolate_migratepages_block waiting
> > forever in "while (unlikely(too_many_isolated(pgdat)))".
> 
> Nasty.
> 
> > Cc: linux-mm@kvack.org
> > Cc: Maninder Singh <maninder1.s@samsung.com>
> > Cc: Vaneet Narang <v.narang@samsung.com>
> > Cc: Maninder Singh <maninder1.s@samsung.com>
> > Cc: Michal Hocko <mhocko@suse.com>
> > Cc: Amit Sahrawat <a.sahrawat@samsung.com>
> > Cc: Mel Gorman <mgorman@suse.de>
> > Cc: Vlastimil Babka <vbabka@suse.cz>
> > Fixes: 730ec8c01a2b ("mm/vmscan.c: change prototype for shrink_page_list")
> > Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
> > ---
> >  mm/vmscan.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/mm/vmscan.c b/mm/vmscan.c
> > index 1b8f0e059767..92c507bacf09 100644
> > --- a/mm/vmscan.c
> > +++ b/mm/vmscan.c
> > @@ -1516,7 +1516,7 @@ unsigned int reclaim_clean_pages_from_list(struct zone *zone,
> >  	nr_reclaimed = shrink_page_list(&clean_pages, zone->zone_pgdat, &sc,
> >  			TTU_IGNORE_ACCESS, &stat, true);
> >  	list_splice(&clean_pages, page_list);
> > -	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE, -nr_reclaimed);
> > +	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE, -(long)nr_reclaimed);
> >  	/*
> >  	 * Since lazyfree pages are isolated from file LRU from the beginning,
> >  	 * they will rotate back to anonymous LRU in the end if it failed to
> 
> You want the same also for -stat.nr_lazyfree_fail right?

I did the below, and added a cc:stable.

--- a/mm/vmscan.c~mm-vmscan-fix-nr_isolated_file-corruption-on-64-bit-fix
+++ a/mm/vmscan.c
@@ -1516,7 +1516,8 @@ unsigned int reclaim_clean_pages_from_li
 	nr_reclaimed = shrink_page_list(&clean_pages, zone->zone_pgdat, &sc,
 			TTU_IGNORE_ACCESS, &stat, true);
 	list_splice(&clean_pages, page_list);
-	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE, -(long)nr_reclaimed);
+	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE,
+			    -(long)nr_reclaimed);
 	/*
 	 * Since lazyfree pages are isolated from file LRU from the beginning,
 	 * they will rotate back to anonymous LRU in the end if it failed to
@@ -1526,7 +1527,7 @@ unsigned int reclaim_clean_pages_from_li
 	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_ANON,
 			    stat.nr_lazyfree_fail);
 	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE,
-			    -stat.nr_lazyfree_fail);
+			    -(long)stat.nr_lazyfree_fail);
 	return nr_reclaimed;
 }
 
_

Re: [PATCH] mm/vmscan: Fix NR_ISOLATED_FILE corruption on 64-bit

[Michal Hocko]

On Thu 29-10-20 22:25:26, Andrew Morton wrote:
> On Thu, 29 Oct 2020 14:11:03 +0100 Michal Hocko <mhocko@suse.com> wrote:
> 
> > On Thu 29-10-20 13:23:20, Nicholas Piggin wrote:
> > > Previously the negated unsigned long would be cast back to signed long
> > > which would have the correct negative value. After commit 730ec8c01a2b
> > > ("mm/vmscan.c: change prototype for shrink_page_list"), the large
> > > unsigned int converts to a large positive signed long.
> > > 
> > > Symptoms include CMA allocations hanging forever holding the cma_mutex
> > > due to alloc_contig_range->...->isolate_migratepages_block waiting
> > > forever in "while (unlikely(too_many_isolated(pgdat)))".
> > 
> > Nasty.
> > 
> > > Cc: linux-mm@kvack.org
> > > Cc: Maninder Singh <maninder1.s@samsung.com>
> > > Cc: Vaneet Narang <v.narang@samsung.com>
> > > Cc: Maninder Singh <maninder1.s@samsung.com>
> > > Cc: Michal Hocko <mhocko@suse.com>
> > > Cc: Amit Sahrawat <a.sahrawat@samsung.com>
> > > Cc: Mel Gorman <mgorman@suse.de>
> > > Cc: Vlastimil Babka <vbabka@suse.cz>
> > > Fixes: 730ec8c01a2b ("mm/vmscan.c: change prototype for shrink_page_list")
> > > Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
> > > ---
> > >  mm/vmscan.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > 
> > > diff --git a/mm/vmscan.c b/mm/vmscan.c
> > > index 1b8f0e059767..92c507bacf09 100644
> > > --- a/mm/vmscan.c
> > > +++ b/mm/vmscan.c
> > > @@ -1516,7 +1516,7 @@ unsigned int reclaim_clean_pages_from_list(struct zone *zone,
> > >  	nr_reclaimed = shrink_page_list(&clean_pages, zone->zone_pgdat, &sc,
> > >  			TTU_IGNORE_ACCESS, &stat, true);
> > >  	list_splice(&clean_pages, page_list);
> > > -	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE, -nr_reclaimed);
> > > +	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE, -(long)nr_reclaimed);
> > >  	/*
> > >  	 * Since lazyfree pages are isolated from file LRU from the beginning,
> > >  	 * they will rotate back to anonymous LRU in the end if it failed to
> > 
> > You want the same also for -stat.nr_lazyfree_fail right?
> 
> I did the below, and added a cc:stable.
> 
> --- a/mm/vmscan.c~mm-vmscan-fix-nr_isolated_file-corruption-on-64-bit-fix
> +++ a/mm/vmscan.c
> @@ -1516,7 +1516,8 @@ unsigned int reclaim_clean_pages_from_li
>  	nr_reclaimed = shrink_page_list(&clean_pages, zone->zone_pgdat, &sc,
>  			TTU_IGNORE_ACCESS, &stat, true);
>  	list_splice(&clean_pages, page_list);
> -	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE, -(long)nr_reclaimed);
> +	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE,
> +			    -(long)nr_reclaimed);
>  	/*
>  	 * Since lazyfree pages are isolated from file LRU from the beginning,
>  	 * they will rotate back to anonymous LRU in the end if it failed to
> @@ -1526,7 +1527,7 @@ unsigned int reclaim_clean_pages_from_li
>  	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_ANON,
>  			    stat.nr_lazyfree_fail);
>  	mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE,
> -			    -stat.nr_lazyfree_fail);
> +			    -(long)stat.nr_lazyfree_fail);
>  	return nr_reclaimed;
>  }

Acked-by: Michal Hocko <mhocko@suse.com>

Btw. regular reclaim paths are OK because nr_taken is unsigned long.

Btw #2 I was quite surprised about the inconsistency for !SMP case where
__mod_node_page_state uses int for the delta.

Thanks!
-- 
Michal Hocko
SUSE Labs