From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1283FC25B76 for ; Thu, 6 Jun 2024 02:42:21 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 9FDBF6B0082; Wed, 5 Jun 2024 22:42:20 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 9AD066B00A0; Wed, 5 Jun 2024 22:42:20 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 874C56B00A1; Wed, 5 Jun 2024 22:42:20 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 681DD6B0082 for ; Wed, 5 Jun 2024 22:42:20 -0400 (EDT) Received: from smtpin25.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 13B1540929 for ; Thu, 6 Jun 2024 02:42:20 +0000 (UTC) X-FDA: 82198914840.25.EB7D57F Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by imf05.hostedemail.com (Postfix) with ESMTP id 27961100007 for ; Thu, 6 Jun 2024 02:42:17 +0000 (UTC) Authentication-Results: imf05.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=GUIIr7Ce; spf=pass (imf05.hostedemail.com: domain of bhe@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=bhe@redhat.com; dmarc=pass (policy=none) header.from=redhat.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1717641738; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=rF5m20l5EfPvWWblQabpJhD2bWhVAxo9SZyKSImgFRM=; b=z+6gdSokteeqCEJHfA84xARcJIb+gUu4fuwUduuFra3/RRK1iR2c8mvr27BoYINW4t2QmP 9+tGK4UGaRJ84cxEOohBkSojO+U/iDRl71H7iasJuS21sW0UAekKaonD0svQ9mzr2ndyMz HjlcYc3QjharP36b8XnLhWorO6L649w= ARC-Authentication-Results: i=1; imf05.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=GUIIr7Ce; spf=pass (imf05.hostedemail.com: domain of bhe@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=bhe@redhat.com; dmarc=pass (policy=none) header.from=redhat.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1717641738; a=rsa-sha256; cv=none; b=S97w+oezbAyLEIO9fyxHIYRvXbS3ebvqKtM6MX/Ttt5OcR/ZvUfumyeQPBokIkBwVlqbuQ C97M7dbagf2HMvOArk5wyp7V1NOTUR9M1H0HSOL2GF+GabHGMsbkXdfWMM3U91F59arRpY FWzNP+meXSKA+/6ZIo6G9mazNuonbv8= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1717641737; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=rF5m20l5EfPvWWblQabpJhD2bWhVAxo9SZyKSImgFRM=; b=GUIIr7Ce4Mf/Lmnbr2auzab9dtu0ST7PYv9+Oneh3L3sbuQMe1FDp3y+admbS2k1Rf67+x SbsdstxIfxwQvbz4+JjQSxaWgGH/CRIRkBPjRxhc44i9qj9tsiCTykisTEdzRHtbtvDlyf eXAnDyySxSz8v/GB5ISczHrcsvILu2Y= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-543-IuZwjLf_ORSph_LhBUbrgA-1; Wed, 05 Jun 2024 22:42:13 -0400 X-MC-Unique: IuZwjLf_ORSph_LhBUbrgA-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 382758007A1; Thu, 6 Jun 2024 02:42:13 +0000 (UTC) Received: from localhost (unknown [10.72.113.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id AF1532140FC5; Thu, 6 Jun 2024 02:42:10 +0000 (UTC) Date: Thu, 6 Jun 2024 10:42:07 +0800 From: Baoquan He To: Zhaoyang Huang Cc: "zhaoyang.huang" , Andrew Morton , Uladzislau Rezki , Christoph Hellwig , Lorenzo Stoakes , Thomas Gleixner , hailong liu , linux-mm@kvack.org, linux-kernel@vger.kernel.org, steve.kang@unisoc.com Subject: Re: [PATCHv4 1/1] mm: fix incorrect vbq reference in purge_fragmented_block Message-ID: References: <20240604022232.1669983-1-zhaoyang.huang@unisoc.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.6 X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 27961100007 X-Stat-Signature: yes7m51mmidqqwp19jyp4j6o4bt7gak4 X-Rspam-User: X-HE-Tag: 1717641737-828685 X-HE-Meta: U2FsdGVkX19FaEiZuUPmwfM9GeO1tjP7CzGHB83ow+xp6QXPcKETppvUFFLFbMvUCxrllAS/efr/eclJ3MTnPlbDw+TnpMNykTot1rk6dh2x4By+HjWeSW6uq1FKhcE4SinxuQxHM5t5Oe4k0CMMKpBcFJLCdWlHfgFSmr+Bf/5e/YrmexW3Nmu0EEgA51Narvuxi4zMgyo/t2zm6q8WY+mkA/sI5rMBJ31zWMinpoTcUsjZFOybhQUpWM/TnkGlkNoAlZOtZHE8xC+7yNSNjJ4LdBP18c/daRtJr5hDNgLqpKd3eBZ4asKrLoRD9ipRviM//d7oxy4y70evROiJkrdSOn6cv1yGqVt4W8nl1CzxTaPY2fAdhA0XCpqBPk1PcuRCwuyNw5eftdrGRSQOugkjrC7Oa1BUwa8nsYDZBXZTnpu2kka9CiDUUCBP3PAyjzl+vQbJvdYgeNYqjhBNyFswa+es5hOqOCarzAmgkNVDakKDOfd97zeeNrcNO0/4jCgPjcCL/9Gbs8J8Pk2+2bHLeb10TO6rCFOWqiEh/b6dbVDJq0VlHM7xer6hZ9wbU/P9cIvegPvdZ6RsKQuXb0/PHX8meNaAjX61146REkXFwCRPOiya7vmwehP7mBIDVVR2A6B6MrQD+py37BU1wK37XoY0uxdm/w5ltOqUJZA32DXxB5t7NoHDWwS6VS60ZYtjr00qg20FP/I5uEm1E3rWE+lvC5XUDSzWm/pkQa7JTRlAcq2TjWMfrqYkYmNpjpKVafQ4pT/SvXReaP/9CjT2XfC8IdCnN/ybmpO5IdoMs4H6LkHZqFFJ417p1gKOCNCx/ZzcsJ2E+pxVYoBxWCxg0dx+xaOHmlj0L2i7ciTDhHEmr0fBXr64zWKQJEzh00n3QA8sQhtt6kiDZD9ZQlkQXYJ3A/5emJZFvPj7BY/JsdEgMFvzhwE0AZ0DlrcZyL86viElHy2np0DMB0f a6CVr7Rc Iog6u7NxlqL5rWmTZkBVvkZqah4UcYwDaanW8VY+EeSS1YgtCBEbS573/+a39hycIaVWecIU2crPHgLw8LZjHM6ZGyHrXyyOBmvdnXykzwf3dXQ2QgBgkADWG20ZzBDDu+Cl6azVHCJmDApj3EkoXT+273WKxDZzlVlOvBcYvNyXwFzNC51/7jLwccEb1N6xEUducIiBkVn0q2MGt3iy0y8VWzcYzJLgs1hruJuBAe0UDXxTV3DtTwR8+RzNHl5uciiR1XTAtlUEGDmapELI8K1ie5DpTnK1H4cIZicJ1AL5rJ5nu8k/+OyeENVYQlvkkeMttH4GQxc8v52xYBdZbzZINktLdbwOHoJj0f5SNc93PfV0ijhFjxiNFStuTZHTY+sXPdA8G4Oj4Wg6A2s1Iag6fOsc6RiDF+Jp8JmtC37HngSFK5IK1yqcITZvm8nw3v8JF X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 06/06/24 at 10:28am, Zhaoyang Huang wrote: > This patch is urgent for the Android world which uses v6.6 now. Is > there any comments on this? Thanks! You should take the way Willf and I suggested, to adjust the vba->free to only contain the vb belonging to it. Have you tested the draft patch? > > On Tue, Jun 4, 2024 at 10:23 AM zhaoyang.huang > wrote: > > > > From: Zhaoyang Huang > > > > vmalloc area runs out in our ARM64 system during an erofs test as > > vm_map_ram failed[1]. By following the debug log, we find that > > vm_map_ram()->vb_alloc() will allocate new vb->va which corresponding > > to 4MB vmalloc area as list_for_each_entry_rcu returns immediately > > when vbq->free->next points to vbq->free. That is to say, 65536 times > > of page fault after the list's broken will run out of the whole > > vmalloc area. This should be introduced by one vbq->free->next point to > > vbq->free which makes list_for_each_entry_rcu can not iterate the list > > and find the BUG. > > > > [1] > > PID: 1 TASK: ffffff80802b4e00 CPU: 6 COMMAND: "init" > > #0 [ffffffc08006afe0] __switch_to at ffffffc08111d5cc > > #1 [ffffffc08006b040] __schedule at ffffffc08111dde0 > > #2 [ffffffc08006b0a0] schedule at ffffffc08111e294 > > #3 [ffffffc08006b0d0] schedule_preempt_disabled at ffffffc08111e3f0 > > #4 [ffffffc08006b140] __mutex_lock at ffffffc08112068c > > #5 [ffffffc08006b180] __mutex_lock_slowpath at ffffffc08111f8f8 > > #6 [ffffffc08006b1a0] mutex_lock at ffffffc08111f834 > > #7 [ffffffc08006b1d0] reclaim_and_purge_vmap_areas at ffffffc0803ebc3c > > #8 [ffffffc08006b290] alloc_vmap_area at ffffffc0803e83fc > > #9 [ffffffc08006b300] vm_map_ram at ffffffc0803e78c0 > > > > Fixes: fc1e0d980037 ("mm/vmalloc: prevent stale TLBs in fully utilized blocks") > > > > For detailed reason of broken list, please refer to below URL > > https://lore.kernel.org/all/20240531024820.5507-1-hailong.liu@oppo.com/ > > > > Suggested-by: Hailong.Liu > > Signed-off-by: Zhaoyang Huang > > --- > > v2: introduce cpu in vmap_block to record the right CPU number > > v3: use get_cpu/put_cpu to prevent schedule between core > > v4: replace get_cpu/put_cpu by another API to avoid disabling preemption > > --- > > --- > > mm/vmalloc.c | 21 +++++++++++++++------ > > 1 file changed, 15 insertions(+), 6 deletions(-) > > > > diff --git a/mm/vmalloc.c b/mm/vmalloc.c > > index 22aa63f4ef63..89eb034f4ac6 100644 > > --- a/mm/vmalloc.c > > +++ b/mm/vmalloc.c > > @@ -2458,6 +2458,7 @@ struct vmap_block { > > struct list_head free_list; > > struct rcu_head rcu_head; > > struct list_head purge; > > + unsigned int cpu; > > }; > > > > /* Queue of free and dirty vmap blocks, for allocation and flushing purposes */ > > @@ -2585,8 +2586,15 @@ static void *new_vmap_block(unsigned int order, gfp_t gfp_mask) > > free_vmap_area(va); > > return ERR_PTR(err); > > } > > - > > - vbq = raw_cpu_ptr(&vmap_block_queue); > > + /* > > + * list_add_tail_rcu could happened in another core > > + * rather than vb->cpu due to task migration, which > > + * is safe as list_add_tail_rcu will ensure the list's > > + * integrity together with list_for_each_rcu from read > > + * side. > > + */ > > + vb->cpu = raw_smp_processor_id(); > > + vbq = per_cpu_ptr(&vmap_block_queue, vb->cpu); > > spin_lock(&vbq->lock); > > list_add_tail_rcu(&vb->free_list, &vbq->free); > > spin_unlock(&vbq->lock); > > @@ -2614,9 +2622,10 @@ static void free_vmap_block(struct vmap_block *vb) > > } > > > > static bool purge_fragmented_block(struct vmap_block *vb, > > - struct vmap_block_queue *vbq, struct list_head *purge_list, > > - bool force_purge) > > + struct list_head *purge_list, bool force_purge) > > { > > + struct vmap_block_queue *vbq = &per_cpu(vmap_block_queue, vb->cpu); > > + > > if (vb->free + vb->dirty != VMAP_BBMAP_BITS || > > vb->dirty == VMAP_BBMAP_BITS) > > return false; > > @@ -2664,7 +2673,7 @@ static void purge_fragmented_blocks(int cpu) > > continue; > > > > spin_lock(&vb->lock); > > - purge_fragmented_block(vb, vbq, &purge, true); > > + purge_fragmented_block(vb, &purge, true); > > spin_unlock(&vb->lock); > > } > > rcu_read_unlock(); > > @@ -2801,7 +2810,7 @@ static void _vm_unmap_aliases(unsigned long start, unsigned long end, int flush) > > * not purgeable, check whether there is dirty > > * space to be flushed. > > */ > > - if (!purge_fragmented_block(vb, vbq, &purge_list, false) && > > + if (!purge_fragmented_block(vb, &purge_list, false) && > > vb->dirty_max && vb->dirty != VMAP_BBMAP_BITS) { > > unsigned long va_start = vb->va->va_start; > > unsigned long s, e; > > -- > > 2.25.1 > > >