From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 91C4CC433FE for ; Wed, 22 Dec 2021 02:14:57 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 02B5F6B0072; Tue, 21 Dec 2021 21:14:57 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id F1D3A6B0073; Tue, 21 Dec 2021 21:14:56 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E0BEA6B0074; Tue, 21 Dec 2021 21:14:56 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0105.hostedemail.com [216.40.44.105]) by kanga.kvack.org (Postfix) with ESMTP id D1ADC6B0072 for ; Tue, 21 Dec 2021 21:14:56 -0500 (EST) Received: from smtpin23.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 8A3AB180E1CC5 for ; Wed, 22 Dec 2021 02:14:56 +0000 (UTC) X-FDA: 78943812192.23.BE116CE Received: from out1.migadu.com (out1.migadu.com [91.121.223.63]) by imf09.hostedemail.com (Postfix) with ESMTP id 0A7DE14003F for ; Wed, 22 Dec 2021 02:14:50 +0000 (UTC) Date: Wed, 22 Dec 2021 11:14:45 +0900 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1640139293; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=/9QLrdP3oG8h0EWJQgoqlJH+JbboJwLSeHDc6dvgFQ0=; b=v5rJshvzgacUGbtNde/Bqx/AGvbfPQn6RfvKRHCaIXyN2Afuz4lp+wpT4ecRm91gzpPNEj hWriMASnMRy2cPOgeHlsxfQoDfEzJm64LUtgDwTQAW3HVEQ3385MQJ+SBIe2Vo+VIZhNLC WmsJuj9sHE6ymQMTqnCy4czYOkEdIa4= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Naoya Horiguchi To: Liu Shixin Cc: Naoya Horiguchi , Andrew Morton , Oscar Salvador , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH -next] mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page() Message-ID: <20211222021445.GA1534186@u2004> References: <20211221074908.3910286-1-liushixin2@huawei.com> <20211222003751.GA1529256@u2004> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: X-Migadu-Flow: FLOW_OUT X-Migadu-Auth-User: linux.dev Authentication-Results: imf09.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=v5rJshvz; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf09.hostedemail.com: domain of naoya.horiguchi@linux.dev designates 91.121.223.63 as permitted sender) smtp.mailfrom=naoya.horiguchi@linux.dev X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: 0A7DE14003F X-Stat-Signature: w9cxxg8f9pisf1kxj7muxqi3dup4pxun X-HE-Tag: 1640139290-805619 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Dec 22, 2021 at 09:49:18AM +0800, Liu Shixin wrote: > > > On 2021/12/22 8:37, Naoya Horiguchi wrote: > > On Tue, Dec 21, 2021 at 03:49:08PM +0800, Liu Shixin wrote: > >> Hulk Robot reported a panic in put_page_testzero() when testing madvise() > >> with MADV_SOFT_OFFLINE. The BUG() is triggered when retrying get_any_page(). > >> This is because we keep MF_COUNT_INCREASED flag in second try but the refcnt > >> is not increased. > > Hi Shixin, > > > > Thanks you for the report. > > > > I'm not still sure about the logic behind the bug. > > madvise(MADV_SOFT_OFFLINE) should not work on free pages because > > madvise_inject_error() pins the target page with get_user_pages_fast() > > (MF_COUNT_INCREASED means refcount is incremented by the caller). > > The retry logic can be called when soft_offline_free_page() fails, so > > the logic assumes that the target page is a free page. So why does > > clearing MF_COUNT_INCREASED affect and solve the issue? > > > > It seems to me that if soft_offline_page() is called on a free page > > with MF_COUNT_INCREASED set, then it's problematic itself. > > > > Thanks, > > Naoya Horiguchi > > The page is not free when soft_offline_page() is called. In get_any_page(), > if MF_COUNT_INCREASED is set and !HWPoisonHandlable(page), put_page() > will be called firstly and then goto try_again. The page is freed in this period. Okay, the logic is clear to me now. > >> > >> Fixes: b94e02822deb ("mm,hwpoison: try to narrow window race for free pages") > >> Reported-by: Hulk Robot > >> Signed-off-by: Liu Shixin Thank you very much. Acked-by: Naoya Horiguchi > >> --- > >> mm/memory-failure.c | 1 + > >> 1 file changed, 1 insertion(+) > >> > >> diff --git a/mm/memory-failure.c b/mm/memory-failure.c > >> index 68d9a35f8908..160526f83bcb 100644 > >> --- a/mm/memory-failure.c > >> +++ b/mm/memory-failure.c > >> @@ -2288,6 +2288,7 @@ int soft_offline_page(unsigned long pfn, int flags) > >> } else if (ret == 0) { > >> if (soft_offline_free_page(page) && try_again) { > >> try_again = false; > >> + flags &= ~MF_COUNT_INCREASED; > >> goto retry; > >> } > >> } > >> -- > >> 2.25.1 > >> > > . > > >