From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id E94F1C83F33 for ; Tue, 5 Sep 2023 09:09:29 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 24356940009; Tue, 5 Sep 2023 05:09:29 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 1F1BC8E001A; Tue, 5 Sep 2023 05:09:29 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 0E235940009; Tue, 5 Sep 2023 05:09:29 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id F0CBA8E001A for ; Tue, 5 Sep 2023 05:09:28 -0400 (EDT) Received: from smtpin08.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id B8623160B8F for ; Tue, 5 Sep 2023 09:09:28 +0000 (UTC) X-FDA: 81201970416.08.9D21BDC Received: from outbound-smtp17.blacknight.com (outbound-smtp17.blacknight.com [46.22.139.234]) by imf26.hostedemail.com (Postfix) with ESMTP id 881AB140002 for ; Tue, 5 Sep 2023 09:09:26 +0000 (UTC) Authentication-Results: imf26.hostedemail.com; dkim=none; dmarc=none; spf=pass (imf26.hostedemail.com: domain of mgorman@techsingularity.net designates 46.22.139.234 as permitted sender) smtp.mailfrom=mgorman@techsingularity.net ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1693904967; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=PmS4Ic0+g7Pwe+FZR7FTsbezCsHurKVYacB2+qUOnGQ=; b=j3g7cLyQT1/IVHDWcktSRnVZ691sr6wjozVGIhJw6m6pa03StD479XvwpWi+010VhjY61o xrQv443I58lRyMhPyL/GIwMx15aj9gOzRqvvoQaHPu0wAQ6eMCiuZgc4fUBKnKdlU/O7nF i7Tdvj/OOAGC37kwmPzNyYjjYcL4ZBw= ARC-Authentication-Results: i=1; imf26.hostedemail.com; dkim=none; dmarc=none; spf=pass (imf26.hostedemail.com: domain of mgorman@techsingularity.net designates 46.22.139.234 as permitted sender) smtp.mailfrom=mgorman@techsingularity.net ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1693904967; a=rsa-sha256; cv=none; b=Y3Xu6J/I3igyDxWZ04j3yiF0s7VerMznuj02rq1fa1a91MpVYdm1NQdhdhuXP5rzuf1JWf pCvuWZg0lazICT7BdpLZuAb7UpLpeOq5tNqzOdIGH5+kI0bFjVxXYsTUoNdw8ZbeEB4Xw2 ryLLCnTgWQxSIj+g76McHnsmxXvzWZ0= Received: from mail.blacknight.com (pemlinmail01.blacknight.ie [81.17.254.10]) by outbound-smtp17.blacknight.com (Postfix) with ESMTPS id 4263C1C3B52 for ; Tue, 5 Sep 2023 10:09:24 +0100 (IST) Received: (qmail 1592 invoked from network); 5 Sep 2023 09:09:24 -0000 Received: from unknown (HELO techsingularity.net) (mgorman@techsingularity.net@[84.203.20.191]) by 81.17.254.9 with ESMTPSA (AES256-SHA encrypted, authenticated); 5 Sep 2023 09:09:24 -0000 Date: Tue, 5 Sep 2023 10:09:22 +0100 From: Mel Gorman To: Lecopzer Chen Cc: akpm@linux-foundation.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, vbabka@suse.cz, nsaenzju@redhat.com, yj.chiang@mediatek.com, Mark-pk Tsai , Joe Liu Subject: Re: [PATCH] mm: page_alloc: fix cma pageblock was stolen in rmqueue fallback Message-ID: <20230905090922.zy7srh33rg5c3zao@techsingularity.net> References: <20230830111332.7599-1-lecopzer.chen@mediatek.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-15 Content-Disposition: inline In-Reply-To: <20230830111332.7599-1-lecopzer.chen@mediatek.com> X-Rspam-User: X-Stat-Signature: ao4e7bsa9osrdo7cx8adtgoe65tq5wp9 X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 881AB140002 X-HE-Tag: 1693904966-270419 X-HE-Meta: U2FsdGVkX1+o+mHgYDAeJOBMlu8HjMStIJMTDYDBQErPdq6LswrF0iVpWSPNkvEJ9RLhAmZnkIfvunb/29OxMnShy881K+PfSuWTp2ZNm3GBhgfj4+Hqmw7EvZ200WV4nqCcITV4xKHL88VLCtIG/XjsvFcaUjTL3u/Shgz87qaCrwXjmMcf0ex1tMj9tZEvlq/zDbTcy+wQJX8h4S1ouVKpnQDH2w/B8/DexABC/FX63J2NUG4L1yoGXniAsh5CGiB9M9XBbMedQ+DJcgjRdDWpekxU8GvU1ARpaZuqnAP/lddhdb2NmPnejIRFrG0ZAy86kmIlJtN4F3HB+/SHAqxJrsELvMsvwIOCQR/NmHkV0oLXDunIJPT94hjl2aa0vtNI+v2BU0Aig5QkIi4406RjfMkUqM3LsSnQmCj+bbtDgbRDAgQS4C2aryKidXlJT+rCIYKUN6vfshn7fLDJ4v9pbFKFXWlVNTgLCIdFKc2hGXYMFkMRZRlzPDcSKUPxxZ/D8pkrWpmC1qrkb5d9jXjiNZG2pJ7tfEmB6It386V0ELRR0tKg2s5OYwc3tjr9ruEBSdh3lWClX13QsLVPemQbmtDz6H7wp3IW/70CsU51jVUZUN9Oriz/SGnwVzCMzDhnUlXYjmtf8y8MAksppX9qHLXvuvFR1DJen8o+sZF6VIlRkDn7a0a5KUBiHuK07Kz4ZnC4EllNR4H5FT/4ENODsyWWzDcEWl3sDnOW+sj+JsGCIISEWid/eKi9QLh+D7oo1lhdVIRAp5SY1dlFOY80aO3e9Nz4AJ2aIFDeKHSaenXIijmykgDnXU87aIFyGP4HggNuf40kPJ/J8QJAMC3P+0GEQjiAh40BhW+ZeNENkufBtwY39sGBM/bxfSgaw8Bvf6Wizmea47r3ToUgCSD9bbC3WzVq6hM6K4wPI/gkXgg/S/CWp3tuuog1eumLLQKAlUtS6W+bZAl0QZS hOCYU57R yNCrI7VGpW2hkcgj1y0ObRfstDIrWBDzYnBs59Vs/lTNSz9lFV/VVPq152w+/pRg+hjq4oZSBV5z74LhRxy6c1oFYR60x8YYdKbzd/Zz9WEo6lMCjVnOp1BCVuLEpnBBtQ9GeYy5MSY5QAa8cM6S514gZFVMenL3X9LfmA3tHx74gBP//0i0FFEJBfRMWFoz6nhYZ6ynKwBoKwAiL3dbgQhfkTgTDsKP0P8m5N3Shhvcuq8U4lMAgERxUv+WTJSZMwnq2FbnL3uVxi+1n6SbcMGZNJ3KORQrvDjRfjv7slCVsgDY59b69CJNWK1FetpISdsY41dPa/ip6j4q7wgH2pmh6oA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Aug 30, 2023 at 07:13:33PM +0800, Lecopzer Chen wrote: > commit 4b23a68f9536 ("mm/page_alloc: protect PCP lists with a > spinlock") fallback freeing page to free_one_page() if pcp trylock > failed. This make MIGRATE_CMA be able to fallback and be stolen > whole pageblock by MIGRATE_UNMOVABLE in the page allocation. > > PCP free is fine because free_pcppages_bulk() will always get > migratetype again before freeing the page, thus this only happen when > someone tried to put CMA page in to other MIGRATE_TYPE's freelist. > > Fixes: 4b23a68f9536 ("mm/page_alloc: protect PCP lists with a spinlock") > Reported-by: Joe Liu > Signed-off-by: Lecopzer Chen > Cc: Mark-pk Tsai > Cc: Joe Liu Sorry for the long delay and thanks Lecopzer for the patch. This changelog is difficult to parse but the fix may also me too specific and could be more robust against types other than CMA. It is true that a failed PCP acquire may return a !is_migrate_isolate page to the wrong list but it's more straight-forward to unconditionally lookup the PCP migratetype of the spinlock is not acquired. How about this? It unconditionally looks up the PCP migratetype after spinlock contention. It's build tested only --8<-- mm: page_alloc: Free pages to correct buddy list after PCP lock contention Commit 4b23a68f9536 ("mm/page_alloc: protect PCP lists with a spinlock") returns pages to the buddy list on PCP lock contention. However, for migratetypes that are not MIGRATE_PCPTYPES, the migratetype may have been clobbered already for pages that are not being isolated. In practice, this means that CMA pages may be returned to the wrong buddy list. While this might be harmless in some cases as it is MIGRATE_MOVABLE, the pageblock could be reassigned in rmqueue_fallback and prevent a future CMA allocation. Lookup the PCP migratetype against unconditionally if the PCP lock is contended. [lecopzer.chen@mediatek.com: CMA-specific fix] Fixes: 4b23a68f9536 ("mm/page_alloc: protect PCP lists with a spinlock") Reported-by: Joe Liu Signed-off-by: Mel Gorman --- mm/page_alloc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 452459836b71..4053c377fee8 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -2428,7 +2428,13 @@ void free_unref_page(struct page *page, unsigned int order) free_unref_page_commit(zone, pcp, page, migratetype, order); pcp_spin_unlock(pcp); } else { - free_one_page(zone, page, pfn, order, migratetype, FPI_NONE); + /* + * The page migratetype may have been clobbered for types + * (type >= MIGRATE_PCPTYPES && !is_migrate_isolate) so + * must be rechecked. + */ + free_one_page(zone, page, pfn, order, + get_pcppage_migratetype(page), FPI_NONE); } pcp_trylock_finish(UP_flags); }