From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4B1E7C433F5 for ; Thu, 3 Mar 2022 19:52:00 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id C632D8D0003; Thu, 3 Mar 2022 14:51:59 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id C12D48D0001; Thu, 3 Mar 2022 14:51:59 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id ADB4F8D0003; Thu, 3 Mar 2022 14:51:59 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0080.hostedemail.com [216.40.44.80]) by kanga.kvack.org (Postfix) with ESMTP id 9E4878D0001 for ; Thu, 3 Mar 2022 14:51:59 -0500 (EST) Received: from smtpin29.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 5D3AE9518F for ; Thu, 3 Mar 2022 19:51:59 +0000 (UTC) X-FDA: 79204120758.29.509E772 Received: from mail-ej1-f50.google.com (mail-ej1-f50.google.com [209.85.218.50]) by imf15.hostedemail.com (Postfix) with ESMTP id B5981A0007 for ; Thu, 3 Mar 2022 19:51:58 +0000 (UTC) Received: by mail-ej1-f50.google.com with SMTP id p15so12952490ejc.7 for ; Thu, 03 Mar 2022 11:51:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hjmWT/W5MRqML4fV3l4pipH2e7/zhAuEQ7CGP/nmDbM=; b=bNXFAaflB55BjF2vEloQHSSJIxeOGy0jLkFcVy1CXkF0XyVe0a9nTBaTyP5kHa+g+e mA5iKiBRiynFpXgd6FGPvYFk1Wn1UKWvLgSr7rMghEftWcpW/zwxua6wkisl9n/TdxBS 1tUshZbkOaiprXD4UTmcZsamRW+UmrZ6PMEu6JBcvXY8p1Ly/PI4w1Bqws3U0H2z3sI0 5umEPO11T9SzsU1DCEbPSYRgkQxXt+pjLTexGJrFnaaCtafbNXyxxsc/M6oyTkEIUYqR LgDEUkPmo/Sam58MWhBfdm3OBF+USHeiDJsXS1hH70P6D7/SPsZc2CnFkj/Cpm4AM9Gs TzlQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hjmWT/W5MRqML4fV3l4pipH2e7/zhAuEQ7CGP/nmDbM=; b=PZQJqjM+gc1B6kHmw3u0hNxlcrso/MfNtzzuVIZNDqyCXigiv6FdiJ733UFQcrJAdO zP85RdnsvCtLPsCMdZD/by1CsEnRTHpKZawKXulioDVRmCiPa8oVpl7NLNRARANt1Jo3 gyYu5RT4lj9KHoDQXxoWPKF4fKwDC61A8Ol8Pf5nGUe6QZYCKrdwWbCIsCka7xMG8Bja urmRl88Sn+wMwdshAh52jwgEAmZM6pCNmzg1HNkLgw8vf6eIc1cexTsmpe0sKqhWz1TP 70AYBJYJ6ph9fxjNH7FvELlVbI6c9xWjsjDjh7joQP++mRrOMq2sjPm3CvhtDC/cvpFS zqDw== X-Gm-Message-State: AOAM53383DEGYRmZ1L6RzStBSLxgkvks2eXENZIHQo0aiRowHhuu0DS4 LBZF0AGZb4JF/GJoek063AAUMl90Ka8rH+AHjTI= X-Google-Smtp-Source: ABdhPJzuicciNIaD29btjcvtEpl11t9WodpI6Lk5thTnnh5192JvUE8OYxi/RYjedjFjZS4JW2dJz9TUg3MQ+Gkswzc= X-Received: by 2002:a17:906:5d12:b0:6da:960c:7e30 with SMTP id g18-20020a1709065d1200b006da960c7e30mr2855735ejt.380.1646337117337; Thu, 03 Mar 2022 11:51:57 -0800 (PST) MIME-Version: 1.0 References: <84792468-f512-e48f-378c-e34c3641e97@google.com> In-Reply-To: <84792468-f512-e48f-378c-e34c3641e97@google.com> From: Yang Shi Date: Thu, 3 Mar 2022 11:51:45 -0800 Message-ID: Subject: Re: [PATCH mmotm] mm/thp: refix __split_huge_pmd_locked() for migration PMD To: Hugh Dickins Cc: Andrew Morton , Ralph Campbell , Zi Yan , "Kirill A. Shutemov" , Linux Kernel Mailing List , Linux MM Content-Type: text/plain; charset="UTF-8" X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: B5981A0007 X-Rspam-User: Authentication-Results: imf15.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=bNXFAafl; spf=pass (imf15.hostedemail.com: domain of shy828301@gmail.com designates 209.85.218.50 as permitted sender) smtp.mailfrom=shy828301@gmail.com; dmarc=pass (policy=none) header.from=gmail.com X-Stat-Signature: 53py1bx79gq4s4f6gcwdqs998d648met X-HE-Tag: 1646337118-403857 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Mar 2, 2022 at 5:43 PM Hugh Dickins wrote: > > Migration entries do not contribute to a page's reference count: move > __split_huge_pmd_locked()'s page_ref_add() into pmd_migration's else > block (along with the page_count() check - a page is quite likely to > to have reference count frozen to 0 when a migration entry is found). > > This will fix a very rare anonymous memory leak, after a split_huge_pmd() > raced with an anon split_huge_page() or an anon THP migrate_pages(): since > the wrongly raised refcount stopped the page (perhaps small, perhaps huge, > depending on when the race hit) from ever being freed. At first I thought > there were worse risks, from prematurely unfreezing a frozen page: but now > think that would only affect page cache pages, which do not come this way > (except for anonymous pages in swap cache, perhaps). Thanks for catching this. I agree there may be anon memory leak due to bumped refcount. But I don't think it could affect page cache page since that code (bumping refcount) is never called for page cache page IIUC. The patch looks good to me. Reviewed-by: Yang Shi > > Fixes: ec0abae6dcdf ("mm/thp: fix __split_huge_pmd_locked() for migration PMD") > Signed-off-by: Hugh Dickins > --- > That's an unfair "Fixes": it did not introduce the problem, but it > missed this aspect of the problem; and will be a good guide to where this > refix should go if stable backports are asked for. > > mm/huge_memory.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > --- a/mm/huge_memory.c > +++ b/mm/huge_memory.c > @@ -2039,9 +2039,9 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, > young = pmd_young(old_pmd); > soft_dirty = pmd_soft_dirty(old_pmd); > uffd_wp = pmd_uffd_wp(old_pmd); > + VM_BUG_ON_PAGE(!page_count(page), page); > + page_ref_add(page, HPAGE_PMD_NR - 1); > } > - VM_BUG_ON_PAGE(!page_count(page), page); > - page_ref_add(page, HPAGE_PMD_NR - 1); > > /* > * Withdraw the table only after we mark the pmd entry invalid.