From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 313B3C433F5 for ; Thu, 19 May 2022 07:25:00 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 964916B0074; Thu, 19 May 2022 03:24:59 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 915086B0075; Thu, 19 May 2022 03:24:59 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 803646B0078; Thu, 19 May 2022 03:24:59 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 6FCC56B0074 for ; Thu, 19 May 2022 03:24:59 -0400 (EDT) Received: from smtpin01.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 2A6E020AC1 for ; Thu, 19 May 2022 07:24:59 +0000 (UTC) X-FDA: 79481655918.01.89F8B86 Received: from mail-yb1-f177.google.com (mail-yb1-f177.google.com [209.85.219.177]) by imf17.hostedemail.com (Postfix) with ESMTP id C3CE940005 for ; Thu, 19 May 2022 07:24:33 +0000 (UTC) Received: by mail-yb1-f177.google.com with SMTP id x2so7218583ybi.8 for ; Thu, 19 May 2022 00:24:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=konsulko.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6QjAwwxwtAPBPx+OeTR5L/KL5q3yUlrIq0gFBmYE7r8=; b=MV73efXzQNZHid3RSq8DxrFnQffNHwbjltUA792xVO8th6yvXTPQ0021TSNky6MRS/ ELvAlkVAq/K4PV7sXYbiseqyl9svMlpQf0l6Hrgzm7qkEFpPjpBiokBx0oFxJ9EMhIFi zFpRfgXtbZEDPYwRso06NoVufse1OzIx7R4Q0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6QjAwwxwtAPBPx+OeTR5L/KL5q3yUlrIq0gFBmYE7r8=; b=XP7F8JwIzIFc5blNe8/rasO00nKeFAnITa1W1bTZBYG6JLaoQcJruY2eA4V8/TmB1q zsyJVSqYKDCXJj5Qnr5GHJbdXpPN9EYmnJPwmBAmFa1hBvJZVG0iAPWx38fIQcWO0T8Z XDPRF5PVYBm46PUfD8f09RwM8Otpf5Q/6xRd1YxDnNFpeeiMCWUGnDsid8/pxE/WIaz9 jcF743/yxhqfqJMYMya3wampTqfku321xzZEkmUEvheAcCXwXh2AU45vgjCO5eacM/X1 1CfRm8hHX4tBbrKQbWkG3nLqhj7QDgAZD2iujDdpY10ewK6t/TBGPhXTibbciYEMWa3x N5ZQ== X-Gm-Message-State: AOAM530B4eS69W80ql5SS3IaNns2nOizKfEQOyjo3CCy6/ZM3mkuTFMB D9aV0n36QrVbBctrYul+kBLpxBA66VniqlIxhbybpA== X-Google-Smtp-Source: ABdhPJxo7X7HyndWjvS5Xv8GzWtggOsI1vFJxK7ql2rSaufrLJn2KFvOfhB3bkSKLj082fcG8X4a/8OhUocsP01ptDo= X-Received: by 2002:a05:6902:f:b0:64d:84a6:2386 with SMTP id l15-20020a056902000f00b0064d84a62386mr2878273ybh.437.1652945097903; Thu, 19 May 2022 00:24:57 -0700 (PDT) MIME-Version: 1.0 References: <20220429064051.61552-1-linmiaohe@huawei.com> <20220429064051.61552-9-linmiaohe@huawei.com> In-Reply-To: <20220429064051.61552-9-linmiaohe@huawei.com> From: Vitaly Wool Date: Thu, 19 May 2022 09:24:46 +0200 Message-ID: Subject: Re: [PATCH 8/9] mm/z3fold: fix z3fold_reclaim_page races with z3fold_free To: Miaohe Lin Cc: Andrew Morton , Linux-MM , LKML Content-Type: text/plain; charset="UTF-8" X-Stat-Signature: 5oeequsq6766fqpsw9jk4ww5x7f7nm8a X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: C3CE940005 Authentication-Results: imf17.hostedemail.com; dkim=pass header.d=konsulko.com header.s=google header.b=MV73efXz; spf=pass (imf17.hostedemail.com: domain of vitaly.wool@konsulko.com designates 209.85.219.177 as permitted sender) smtp.mailfrom=vitaly.wool@konsulko.com; dmarc=pass (policy=none) header.from=konsulko.com X-Rspam-User: X-HE-Tag: 1652945073-246321 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, Apr 29, 2022 at 8:40 AM Miaohe Lin wrote: > > Think about the below scene: > > CPU1 CPU2 > z3fold_reclaim_page z3fold_free > spin_lock(&pool->lock) get_z3fold_header -- hold page_lock > kref_get_unless_zero > kref_put--zhdr->refcount can be 1 now > !z3fold_page_trylock > kref_put -- zhdr->refcount is 0 now > release_z3fold_page > WARN_ON(!list_empty(&zhdr->buddy)); -- we're on buddy now! > spin_lock(&pool->lock); -- deadlock here! > > z3fold_reclaim_page might race with z3fold_free and will lead to pool lock > deadlock and zhdr buddy non-empty warning. To fix this, defer getting the > refcount until page_lock is held just like what __z3fold_alloc does. Note > this has the side effect that we won't break the reclaim if we meet a soon > to be released z3fold page now. > > Fixes: dcf5aedb24f8 ("z3fold: stricter locking and more careful reclaim") > Signed-off-by: Miaohe Lin > --- > mm/z3fold.c | 18 +++--------------- > 1 file changed, 3 insertions(+), 15 deletions(-) > > diff --git a/mm/z3fold.c b/mm/z3fold.c > index 4a3cd2ff15b0..a7769befd74e 100644 > --- a/mm/z3fold.c > +++ b/mm/z3fold.c > @@ -519,13 +519,6 @@ static void __release_z3fold_page(struct z3fold_header *zhdr, bool locked) > atomic64_dec(&pool->pages_nr); > } > > -static void release_z3fold_page(struct kref *ref) > -{ > - struct z3fold_header *zhdr = container_of(ref, struct z3fold_header, > - refcount); > - __release_z3fold_page(zhdr, false); > -} > - > static void release_z3fold_page_locked(struct kref *ref) > { > struct z3fold_header *zhdr = container_of(ref, struct z3fold_header, > @@ -1317,12 +1310,7 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries) > break; > } > > - if (kref_get_unless_zero(&zhdr->refcount) == 0) { > - zhdr = NULL; > - break; > - } > if (!z3fold_page_trylock(zhdr)) { > - kref_put(&zhdr->refcount, release_z3fold_page); > zhdr = NULL; > continue; /* can't evict at this point */ > } > @@ -1333,14 +1321,14 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries) > */ > if (zhdr->foreign_handles || > test_and_set_bit(PAGE_CLAIMED, &page->private)) { > - if (!kref_put(&zhdr->refcount, > - release_z3fold_page_locked)) > - z3fold_page_unlock(zhdr); > + z3fold_page_unlock(zhdr); > zhdr = NULL; > continue; /* can't evict such page */ > } > list_del_init(&zhdr->buddy); > zhdr->cpu = -1; > + /* See comment in __z3fold_alloc. */ > + kref_get(&zhdr->refcount); > break; > } > Reviewed-by: Vitaly Wool > -- > 2.23.0 >