From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0BB45ECAAA1 for ; Fri, 28 Oct 2022 04:06:00 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 4EFC56B0072; Fri, 28 Oct 2022 00:06:00 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 49FEE6B0073; Fri, 28 Oct 2022 00:06:00 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3683B8E0001; Fri, 28 Oct 2022 00:06:00 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 27FC46B0072 for ; Fri, 28 Oct 2022 00:06:00 -0400 (EDT) Received: from smtpin23.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id F094D4035B for ; Fri, 28 Oct 2022 04:05:59 +0000 (UTC) X-FDA: 80069020038.23.A861B27 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) by imf24.hostedemail.com (Postfix) with ESMTP id 89F5418000A for ; Fri, 28 Oct 2022 04:05:59 +0000 (UTC) Received: by mail-pl1-f173.google.com with SMTP id y4so3819137plb.2 for ; Thu, 27 Oct 2022 21:05:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fromorbit-com.20210112.gappssmtp.com; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=DjNDCmtaDyTi+sX4Pf3JIZExNUHwda3QT7q2egtTo8o=; b=ehFygeg6pvPoUkRY2wnMRQX/o1fRtwAX2R3z3ASXeuUd78DEW1Z0nOfhPXJ7NogC0e E0UbLdWdbkarxIyEEd8gNYTSs6idNgMz4PDO7QZ1IccG63wEFOnKex96rkTUx9Z278JD qr46xCNErRJJXJ6MKtLu6n+gLu067+MrzJph+FoBOz23+WMqdL6X/7TBvxUgaerW23Pa RytfAcL/b5LdIpIUSZnF+HKARwDQSeUcTXpg5ae2oSMKp98nOmyjZiAq0jFTs+njWFaQ TlF9KYDEIny2rsoEnvGq23Kp798C1TIb7AVzzuhXOvDe1n4VrWKSRsafY0gvLDg4YjeN NkPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=DjNDCmtaDyTi+sX4Pf3JIZExNUHwda3QT7q2egtTo8o=; b=4lJYT8D8zbPzAlbYXtxG2d7yIkxbl1pgwRuNaVMVAJ1/YWwvik2udTImDCoibL9x98 aezqzanU3M0d6Vjo8mwwhFnHP+k+AUm5TV7xKVWATjg+rie9tq8oKbrbVb9ohT8sMdRw mZ9f+AGqmG44u0qkxwMkJLuAoLeZAlDF8St226OBKoZth56DEAki374xWesVfj1BzG7V ucbvgJiiA3SYhejflyTcqxGZnTN1IAA2TMuRFqHHRKNo+H1ef7dZ6lc7Ui3oErnM/WNy B9Y+c8+BwIhgfgg7KhRweZj0ubw5j7vsVBoFPxYYPqWEUHtn9ufPTuyB/QvKulcQ3HFo 0f5A== X-Gm-Message-State: ACrzQf3aXEHEYxqPbLr7IcbuWLK0WPGMn5nK1WzkP5Z4JCSC4lsTZXBG HTnfH1f2hUhNUrdXyrNAY8Ifig== X-Google-Smtp-Source: AMsMyM5FMep431PxudoLZ+qRT7bNktV8krQz5EsyQfpx+NFq0RdtPmkCAgZVxbZob/qWSUVYMWQcfA== X-Received: by 2002:a17:902:74c3:b0:182:57fa:b9c4 with SMTP id f3-20020a17090274c300b0018257fab9c4mr566074plt.104.1666929958311; Thu, 27 Oct 2022 21:05:58 -0700 (PDT) Received: from dread.disaster.area (pa49-181-106-210.pa.nsw.optusnet.com.au. [49.181.106.210]) by smtp.gmail.com with ESMTPSA id a4-20020a1709027e4400b001801aec1f6bsm1945602pln.141.2022.10.27.21.05.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Oct 2022 21:05:57 -0700 (PDT) Received: from dave by dread.disaster.area with local (Exim 4.92.3) (envelope-from ) id 1ooGd0-007Gjv-PK; Fri, 28 Oct 2022 15:05:54 +1100 Date: Fri, 28 Oct 2022 15:05:54 +1100 From: Dave Chinner To: Matthew Wilcox Cc: Zhaoyang Huang , "zhaoyang.huang" , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, ke.wang@unisoc.com, steve.kang@unisoc.com, baocong.liu@unisoc.com, linux-fsdevel@vger.kernel.org Subject: Re: [RFC PATCH] mm: move xa forward when run across zombie page Message-ID: <20221028040554.GU2703033@dread.disaster.area> References: <20221018223042.GJ2703033@dread.disaster.area> <20221019220424.GO2703033@dread.disaster.area> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: ARC-Authentication-Results: i=1; imf24.hostedemail.com; dkim=pass header.d=fromorbit-com.20210112.gappssmtp.com header.s=20210112 header.b=ehFygeg6; dmarc=none; spf=none (imf24.hostedemail.com: domain of david@fromorbit.com has no SPF policy when checking 209.85.214.173) smtp.mailfrom=david@fromorbit.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1666929959; a=rsa-sha256; cv=none; b=q0bmFkhx30jEMnfKQP3uebiaJAao/lh3JXGkYVKOj/IkN8AZKmHu+NxJrTfubSoucs/2dT GMgDUuN98zjsGoStGyuTt+YaDdCg1Ij/NfCo8QZRyGetnKugCi0UZk+UUhgE617edLK8ou Latg2yodSgz9GDajwNee9qjOjNuaDyk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1666929959; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=DjNDCmtaDyTi+sX4Pf3JIZExNUHwda3QT7q2egtTo8o=; b=BWRBCzVt+ndBBcHyZ+GLCia7WN9olmKiXSrsixJaiU/68aTLD8Coxsgy4eUyMTMT6cBSJm hbUpFzdGTIKuT9TVG6oTysk0UznfP8W7apDJUel8eulg4a95f1j/dRwTTPbjC+/RHR+2Qc 2G12ZSImtYeKh71h3OMfzOcg1b0tal0= Authentication-Results: imf24.hostedemail.com; dkim=pass header.d=fromorbit-com.20210112.gappssmtp.com header.s=20210112 header.b=ehFygeg6; dmarc=none; spf=none (imf24.hostedemail.com: domain of david@fromorbit.com has no SPF policy when checking 209.85.214.173) smtp.mailfrom=david@fromorbit.com X-Rspam-User: X-Stat-Signature: 4a98tz7yyi7ny35jkfjje6kihb5pbksr X-Rspamd-Queue-Id: 89F5418000A X-Rspamd-Server: rspam11 X-HE-Tag: 1666929959-930774 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Oct 26, 2022 at 05:01:57PM +0100, Matthew Wilcox wrote: > On Thu, Oct 20, 2022 at 10:52:14PM +0100, Matthew Wilcox wrote: > > But I think the tests you've done refute that theory. I'm all out of > > ideas at the moment. > > I have a new idea. In page_cache_delete_batch(), we don't set the > order of the entry before calling xas_store(). That means we can end > up in a situation where we have an order-2 folio in the page cache, > delete it and end up with a NULL pointer at (say) index 20 and sibling > entries at indices 21-23. We can come along (potentially much later) > and put an order-0 folio back at index 20. Now all of indices 20-23 > point to the index-20, order-0 folio. Worse, the xarray node can be > freed with the sibling entries still intact and then be reallocated by > an entirely different xarray. > > I don't know if this is going to fix the problem you're seeing. I can't > quite draw a line from this situation to your symptoms. I came across > it while auditing all the places which set folio->mapping to NULL. > I did notice a mis-ordering; all the other places first remove the folio > from the xarray before setting folio to NULL, but I have a hard time > connecting that to your symptoms either. > > diff --git a/include/linux/xarray.h b/include/linux/xarray.h > index 44dd6d6e01bc..cc1fd1f849a7 100644 > --- a/include/linux/xarray.h > +++ b/include/linux/xarray.h > @@ -1617,6 +1617,12 @@ static inline void xas_advance(struct xa_state *xas, unsigned long index) > xas->xa_offset = (index >> shift) & XA_CHUNK_MASK; > } > > +static inline void xas_adjust_order(struct xa_state *xas, unsigned int order) > +{ > + xas->xa_shift = order - (order % XA_CHUNK_SHIFT); > + xas->xa_sibs = (1 << (order % XA_CHUNK_SHIFT)) - 1; > +} > + > /** > * xas_set_order() - Set up XArray operation state for a multislot entry. > * @xas: XArray operation state. > @@ -1628,8 +1634,7 @@ static inline void xas_set_order(struct xa_state *xas, unsigned long index, > { > #ifdef CONFIG_XARRAY_MULTI > xas->xa_index = order < BITS_PER_LONG ? (index >> order) << order : 0; > - xas->xa_shift = order - (order % XA_CHUNK_SHIFT); > - xas->xa_sibs = (1 << (order % XA_CHUNK_SHIFT)) - 1; > + xas_adjust_order(xas, order); > xas->xa_node = XAS_RESTART; > #else > BUG_ON(order > 0); > diff --git a/mm/filemap.c b/mm/filemap.c > index 08341616ae7a..6e3f486131e4 100644 > --- a/mm/filemap.c > +++ b/mm/filemap.c > @@ -305,11 +305,13 @@ static void page_cache_delete_batch(struct address_space *mapping, > > WARN_ON_ONCE(!folio_test_locked(folio)); > > + if (!folio_test_hugetlb(folio)) > + xas_adjust_order(&xas, folio_order(folio)); > + xas_store(&xas, NULL); > folio->mapping = NULL; > /* Leave folio->index set: truncation lookup relies on it */ > > i++; > - xas_store(&xas, NULL); > total_pages += folio_nr_pages(folio); > } > mapping->nrpages -= total_pages; Nope, that ain't it. I think I've got the data corruption fix sorted now (at least, g/270 isn't assert failing on stray delalloc extents anymore), so if that's the case, I can spend some time actively trying to track this down.... -Dave. -- Dave Chinner david@fromorbit.com