From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4F0DC25B74 for ; Thu, 30 May 2024 08:18:49 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 00FAC6B0098; Thu, 30 May 2024 04:18:49 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id F01986B009B; Thu, 30 May 2024 04:18:48 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id DF0806B009C; Thu, 30 May 2024 04:18:48 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id C244F6B0098 for ; Thu, 30 May 2024 04:18:48 -0400 (EDT) Received: from smtpin30.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 538F2161672 for ; Thu, 30 May 2024 08:18:48 +0000 (UTC) X-FDA: 82174361136.30.78D50E7 Received: from mail-lj1-f178.google.com (mail-lj1-f178.google.com [209.85.208.178]) by imf22.hostedemail.com (Postfix) with ESMTP id 76D13C0008 for ; Thu, 30 May 2024 08:18:45 +0000 (UTC) Authentication-Results: imf22.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=j7EJ5RJS; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf22.hostedemail.com: domain of huangzhaoyang@gmail.com designates 209.85.208.178 as permitted sender) smtp.mailfrom=huangzhaoyang@gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1717057125; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=/zaL5WD7NTrZXgrCgxrS4DuBKHjHniNbKiAgaYsZSm8=; b=4hbB79JtI4mnRvul2w3wZ3+MSgV2mJj/YPqOamiC/eY6ZMZc/6lqNF/cVPe/aI0p8ZzD6a IxeZ+kj74W3sPi67LOCcKvC7SHxD3nqQb9wx0JEsfNDrHlsIoWi/dRe7aSX0tDctmiwElW 9vABHi1iskY1x5TGdAApZM6uCjMbeaU= ARC-Authentication-Results: i=1; imf22.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=j7EJ5RJS; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf22.hostedemail.com: domain of huangzhaoyang@gmail.com designates 209.85.208.178 as permitted sender) smtp.mailfrom=huangzhaoyang@gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1717057125; a=rsa-sha256; cv=none; b=aFAHtt1vYwLXl+Hzkcrpdul0BkFfiJ/1quMDxHa8roiaseC66PNtvYDc3iBFEpp5ON6Nc4 mMUdoC+cIGlnpV46CC1y6PwikAQ2jzWwBCZ1k/n3LHznX0L8ttmEtgVlDbDdnR+3/vS4Ij ksA2MmRZrfAPvdKLJGf1/+yz2/MJMrw= Received: by mail-lj1-f178.google.com with SMTP id 38308e7fff4ca-2e95a74d51fso8404331fa.2 for ; Thu, 30 May 2024 01:18:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1717057124; x=1717661924; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=/zaL5WD7NTrZXgrCgxrS4DuBKHjHniNbKiAgaYsZSm8=; b=j7EJ5RJSkUWIPfr3mb4/9hKCZ7Z2u5w2FLQQZNZN0Jwj5RR2XAq2jlmrhGzEW2TgGw CbpidO3sf/8Cv6oKDQV7XWLW/oAry3YvxCPvdwcBnlxqbfyWAAZIV5g8StBvMtsC4hKB DSSBL1uQ7vI4xhcKuOritbJeRjVJJpzYCkrj6CmH6CcKOwsKsZIiipOGS9deAO0FU9Md TUgtPdBkN/WMYaShpsRZj5cRWS5s19J/lvhrHzWrunZE7iUawCIAPsMm8FpmreWJaFgD dDBqfKJYJZ7siWpJhXvQHL/J6ZarWKEqLdxc5+oGXKUFmXRCtoadT4I/ZSyeT+gNP7aO NYww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1717057124; x=1717661924; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=/zaL5WD7NTrZXgrCgxrS4DuBKHjHniNbKiAgaYsZSm8=; b=okEGTafAbqyY6aZtngl5phxbfvjqsTuu/1zx0W7ooFzcs5SBmI29Q80tE+Cyc6fZqI OX90y5WqwF3Pdxc46EfaTdkCVwVu2lyHYEJmV/mCgZvYciPKx1IeNIiJPM913AitAXyh ce6rpXINnBDpNyGh1HCfDPWGPCR2L7vm7qBBbZGsbMWymHc6U9Tnu0x/QUXWR8WTO/fV v4ujO3TLiIAQ+bTcN6jyHKiCQy4Guns9IDUK9ZIT6C/U3JG7DN5v4KL/onW6XGwyoW75 15wAX36q0XdXqKI5ub5iBKkTAiTEn9P5+VB/E7NjbhSy6FbdHww00aGNqQWfO1J2XeDA gSag== X-Forwarded-Encrypted: i=1; AJvYcCUcLvXrzPwOhIOTywyHWgQJ5/NYyCGJs/9JEFwHwkXftUdsFSOz1SSzb3H5afEOVBxs8bML0rtY8P0hRW0jg7RUKk4= X-Gm-Message-State: AOJu0YygrbP2LQVDuG70fJLjB//vgC33mtbFpPY/4KSvjyH9uPpgR/VU EWU3zc5wvCeNoN7o2EhQmGIMX1ugCddCw3W+Q9mzw+u1xDvWiZLMemZFZ94KPeMmI37ocOmzHTL T/dV9gBhKJ+AJhMb3wPvtCmKwotY= X-Google-Smtp-Source: AGHT+IGfnzM04cgjZOM34LIMfzSs8VxbR1kCAU/6ZNji/seMTGawYM31bLJqAb8oXPM0EjOJ+2axtTo0pFZ0XEobT34= X-Received: by 2002:a2e:8ec8:0:b0:2e1:fa3f:67bd with SMTP id 38308e7fff4ca-2ea8486d338mr10047371fa.36.1717057123451; Thu, 30 May 2024 01:18:43 -0700 (PDT) MIME-Version: 1.0 References: <20240530025144.1570865-1-zhaoyang.huang@unisoc.com> In-Reply-To: From: Zhaoyang Huang Date: Thu, 30 May 2024 16:18:32 +0800 Message-ID: Subject: Re: [PATCH] mm: fix incorrect vbq reference in purge_fragmented_block To: Baoquan He Cc: "zhaoyang.huang" , Andrew Morton , Uladzislau Rezki , Christoph Hellwig , Lorenzo Stoakes , linux-mm@kvack.org, linux-kernel@vger.kernel.org, steve.kang@unisoc.com, Thomas Gleixner Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Queue-Id: 76D13C0008 X-Stat-Signature: i8wn48fawxt1ppzfsqh38pyoity3dfzf X-Rspam-User: X-Rspamd-Server: rspam08 X-HE-Tag: 1717057125-282916 X-HE-Meta: U2FsdGVkX19pc8A5GLcPxOETAEyisqVLZpzTvTtYZV7Huoe+gLDy4QB66c1nH5A5yE3xF2vDzQzyGyozZbCvBDSV7dxQXIzNjAnzZJTnzhZZ8GPbqVMEDCgFjPl85d3piSRUHXS+Re1wnO5Uet0BXYCk0ts/ZKXKBcJKDCjpQQ2hKZ2Ddg6Np1TXMGWO1kYDKmtx3yqDJQZ1/25AoRWF+uYk6hupXaxgAjG+dJ8qR/DwNh8/otYi0e281wlY32uuUllvWWNGGy1fEjiHfRab0+YFqxHKF445c6TzoF00u5esoreq5NVR4Onmc2ZTsxeOPwEUuqk0PJgDLt0R6B1Gb1AUbYq4HZLa53E5EtXprlkDhd8Nsa1DJ6YW7SfmPsDTpI5qLwAnNMopRhjCtSVC5V+GqKh8wMU2htdodpepY5FuHijRWm7SSG77fnc4ljl3hxhJTSpJzFQWvNMCZem7s0xHLC+KW7ApJvmRhc4IkgTS2Qg0asVw1nIOG5Akw1IkDwH6pChbGRmBStBKMgZ+2mvGzNbi7bSG+B6srg23Cmlb139iR2svBG4hdgAojBoA3aUDK5zGBYo71WhmK+EwXk3IXwzFRCQgK1J2IBr3ZWA8PyDZ+u5WZiQeF8f7zZuGuVDFDXceFUkU42kTM3MwxNSYGoKpXl5Fd9IniqhNdipDwYtmeELZUDxx/CVJYBMt6+yJ8BSqjiYr3p6fIr/DiWyYsqqy2EpxWtVd4+QulwiBi3qI4GOovs0jFKzAi8cVzFXppMMAgxDn8FHylnUHRByJN+GLlKbkQi9YRsn09nzicVAKWKTIpQX5eFRllRJEvb+sxvTCc4hxTr7x83xAd4NLbou68CUkzdnloCtR9MvbN5PJi4qJV37wZdhlBQrkUSNifqeKIvvWETnp9CJ3Ao7vBFC18bpTCweiehiqkJkSapoYwLALZTxtMvUtP33RqTsHF0XtMRyeHN+6lrH jUm8ggIQ yU57dshkPnEJhm4qakI7+rpBQZaQi1oTvm6KkVhY/oCxmuwmR49fyoz7TgQfvOTmrj1st6hp0vlPg8ClbCATW5Gilif0GS4COvqGds4oJDS9mNPBxtP0qADElWC3InKsNmbsJ95QX9Zeh18LqfJNxF6CgXsxMVXOrram/dAotZZDAMNJQ7QoL7LiVz9ZOgXuvfM7oqhQhFQv+auKA5uP8eKCgbPIrXBf4/QfnLAfLybbQmO3erpbXWm3ue2i4Te0OzmgrX+b1tzTeLePAhznVbaKymQ0jaBMnXdy0xdNE4YKIdVDMFSligfMFSsTbanYUe0VngN+WTIc0T/gNDCtojB3JpNzorekZ3+B2VWORb3YGYtAHVJ2whZUj+xh/YjKRyCdTzPZB8B7SJ04Ry3bQpnmIQyG408o9WIZ9LHsKvtVr6lHLx8liqYxwcSpdg490vMdb3fQEhWb3JPjl+xeTN14wczB8ktRx9NAQesNziHPPi6Q= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Thu, May 30, 2024 at 3:54=E2=80=AFPM Baoquan He wrote: > > On 05/30/24 at 03:35pm, Zhaoyang Huang wrote: > > On Thu, May 30, 2024 at 3:19=E2=80=AFPM Baoquan He wro= te: > > > > > > On 05/30/24 at 10:51am, zhaoyang.huang wrote: > > > > From: Zhaoyang Huang > > > > > > > > Broken vbq->free reported on a v6.6 based system which is caused > > > > by invalid vbq->lock protect over vbq->free in purge_fragmented_blo= ck. > > > > This should be introduced by the Fixes below which ignored vbq->loc= k > > > > matter. > > > > > > It will be helpful to provide more details, what's the symptom of the > > > brekage, and in which case vbq->free is broken. > > Vmalloc area runs out in our ARM64 system during an erofs test as > > vm_map_ram failed[1]. We find that one vbq->free->next point to > > vbq->free which makes list_for_each_entry_rcu can not iterate the list > > and find the BUG. > > Thanks for these information which are very helpful and important. > They need be put in log for easier understanding. ok, I will update the commit message in the next version. > about the vbq->free list breakage by the run out vmalloc area, could vm_map_ram()->vb_alloc() will allocate new vb->va which corresponding to 4MB vmalloc area as list_for_each_entry_rcu returns immediately when vbq->free->next points to vbq->free. That is to say, 65536 times of page fault after the list's broken will run out of the whole vmalloc area. > you say more about how it's caused? And do you think we need fix that > vbq->free list breakage either? IMO, the purge_fragmented_block->list_del_rcu could race with new_vmap_block->list_add_tail_rcu when vbq is wrongly referenced. > > > > > [1] > > PID: 1 TASK: ffffff80802b4e00 CPU: 6 COMMAND: "init" > > #0 [ffffffc08006afe0] __switch_to at ffffffc08111d5cc > > #1 [ffffffc08006b040] __schedule at ffffffc08111dde0 > > #2 [ffffffc08006b0a0] schedule at ffffffc08111e294 > > #3 [ffffffc08006b0d0] schedule_preempt_disabled at ffffffc08111e3f0 > > #4 [ffffffc08006b140] __mutex_lock at ffffffc08112068c > > #5 [ffffffc08006b180] __mutex_lock_slowpath at ffffffc08111f8f8 > > #6 [ffffffc08006b1a0] mutex_lock at ffffffc08111f834 > > #7 [ffffffc08006b1d0] reclaim_and_purge_vmap_areas at ffffffc0803ebc3c > > #8 [ffffffc08006b290] alloc_vmap_area at ffffffc0803e83fc > > #9 [ffffffc08006b300] vm_map_ram at ffffffc0803e78c0 > > #10 [ffffffc08006b420] z_erofs_lz4_decompress at ffffffc0806a49b0 > > #11 [ffffffc08006b670] z_erofs_decompress_queue at ffffffc0806a8fd0 > > #12 [ffffffc08006b860] z_erofs_runqueue at ffffffc0806a8744 > > #13 [ffffffc08006b970] z_erofs_readahead at ffffffc0806a6cfc > > #14 [ffffffc08006ba00] read_pages at ffffffc08037ed78 > > #15 [ffffffc08006ba70] page_cache_ra_unbounded at ffffffc08037eb58 > > #16 [ffffffc08006bb00] page_cache_ra_order at ffffffc08037f42c > > #17 [ffffffc08006bbb0] do_sync_mmap_readahead at ffffffc080371d3c > > #18 [ffffffc08006bc40] filemap_fault at ffffffc080371774 > > #19 [ffffffc08006bd60] handle_mm_fault at ffffffc0803cc118 > > #20 [ffffffc08006bdc0] do_page_fault at ffffffc08112a618 > > #21 [ffffffc08006be20] do_translation_fault at ffffffc08112a36c > > #22 [ffffffc08006be30] do_mem_abort at ffffffc0800bfbf0 > > #23 [ffffffc08006be70] el0_ia at ffffffc08111583c > > #24 [ffffffc08006bea0] el0t_64_sync_handler at ffffffc0811156a4 > > #25 [ffffffc08006bfe0] el0t_64_sync at ffffffc080091584 > > > > > > > > > > > > > > > Fixes: fc1e0d980037 ("mm/vmalloc: prevent stale TLBs in fully utili= zed blocks") > > > > > > > > Signed-off-by: Zhaoyang Huang > > > > --- > > > > mm/vmalloc.c | 11 +++++++---- > > > > 1 file changed, 7 insertions(+), 4 deletions(-) > > > > > > > > diff --git a/mm/vmalloc.c b/mm/vmalloc.c > > > > index 22aa63f4ef63..112b50431725 100644 > > > > --- a/mm/vmalloc.c > > > > +++ b/mm/vmalloc.c > > > > @@ -2614,9 +2614,10 @@ static void free_vmap_block(struct vmap_bloc= k *vb) > > > > } > > > > > > > > static bool purge_fragmented_block(struct vmap_block *vb, > > > > - struct vmap_block_queue *vbq, struct list_head *purge= _list, > > > > - bool force_purge) > > > > + struct list_head *purge_list, bool force_purge) > > > > { > > > > + struct vmap_block_queue *vbq; > > > > + > > > > if (vb->free + vb->dirty !=3D VMAP_BBMAP_BITS || > > > > vb->dirty =3D=3D VMAP_BBMAP_BITS) > > > > return false; > > > > @@ -2625,6 +2626,8 @@ static bool purge_fragmented_block(struct vma= p_block *vb, > > > > if (!(force_purge || vb->free < VMAP_PURGE_THRESHOLD)) > > > > return false; > > > > > > > > + vbq =3D container_of(addr_to_vb_xa(vb->va->va_start), > > > > + struct vmap_block_queue, vmap_blocks); > > > > /* prevent further allocs after releasing lock */ > > > > WRITE_ONCE(vb->free, 0); > > > > /* prevent purging it again */ > > > > @@ -2664,7 +2667,7 @@ static void purge_fragmented_blocks(int cpu) > > > > continue; > > > > > > > > spin_lock(&vb->lock); > > > > - purge_fragmented_block(vb, vbq, &purge, true); > > > > + purge_fragmented_block(vb, &purge, true); > > > > spin_unlock(&vb->lock); > > > > } > > > > rcu_read_unlock(); > > > > @@ -2801,7 +2804,7 @@ static void _vm_unmap_aliases(unsigned long s= tart, unsigned long end, int flush) > > > > * not purgeable, check whether there is dirt= y > > > > * space to be flushed. > > > > */ > > > > - if (!purge_fragmented_block(vb, vbq, &purge_l= ist, false) && > > > > + if (!purge_fragmented_block(vb, &purge_list, = false) && > > > > vb->dirty_max && vb->dirty !=3D VMAP_BBMA= P_BITS) { > > > > unsigned long va_start =3D vb->va->va= _start; > > > > unsigned long s, e; > > > > -- > > > > 2.25.1 > > > > > > > > > > > > > >