* Re: [PATCH] PCI/P2PDMA: Reset page reference count when page mapping fails
2026-01-12 0:54 [PATCH] PCI/P2PDMA: Reset page reference count when page mapping fails Alistair Popple
@ 2026-01-12 4:40 ` Balbir Singh
2026-01-12 17:13 ` Bjorn Helgaas
2026-01-13 23:34 ` Logan Gunthorpe
2 siblings, 0 replies; 4+ messages in thread
From: Balbir Singh @ 2026-01-12 4:40 UTC (permalink / raw)
To: Alistair Popple, helgaas
Cc: houtao, linux-kernel, linux-pci, linux-mm, linux-nvme, bhelgaas,
logang, leonro, gregkh, tj, rafael, dakr, akpm, david,
lorenzo.stoakes, kbusch, axboe, hch, sagi, houtao1
On 1/12/26 10:54, Alistair Popple wrote:
> When mapping a p2pdma page the page reference count is initialised to
> 1 prior to calling vm_insert_page(). This is to avoid vm_insert_page()
> warning if the page refcount is zero. Prior to setting the page count
> there is a check to ensure the page is currently free (ie. has a zero
> reference count).
>
> However vm_insert_page() can fail. In this case the pages are freed
> back to the genalloc pool, but that does not reset the page refcount.
> So a future allocation of the same page will see the elevated page
> refcount from the previous set_page_count() call triggering the
> VM_WARN_ON_ONCE_PAGE checking that the page is free.
>
> Fix this by resetting the page refcount back to zero using
> set_page_count(). Note that put_page() is not used because that
> would result in freeing the page twice due to implicitly calling
> p2pdma_folio_free().
>
> Fixes: b7e282378773 ("mm/mm_init: move p2pdma page refcount initialisation to p2pdma")
> Signed-off-by: Alistair Popple <apopple@nvidia.com>
>
> ---
>
> This was found by inspection. I don't currently have a good setup that
> exercises the p2pmem_alloc_mmap() path so this has only been compile
> tested - additional testing would be appreciated.
> ---
> drivers/pci/p2pdma.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c
> index dd64ec830fdd..3b29246b9e86 100644
> --- a/drivers/pci/p2pdma.c
> +++ b/drivers/pci/p2pdma.c
> @@ -152,6 +152,12 @@ static int p2pmem_alloc_mmap(struct file *filp, struct kobject *kobj,
> ret = vm_insert_page(vma, vaddr, page);
> if (ret) {
> gen_pool_free(p2pdma->pool, (uintptr_t)kaddr, len);
> +
> + /*
> + * Reset the page count. We don't use put_page() because
> + * we don't want to trigger the p2pdma_folio_free() path.
> + */
> + set_page_count(page, 0);
> percpu_ref_put(ref);
> return ret;
> }
The change looks good!
Acked-by: Balbir Singh <balbirs@nvidia.com>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] PCI/P2PDMA: Reset page reference count when page mapping fails
2026-01-12 0:54 [PATCH] PCI/P2PDMA: Reset page reference count when page mapping fails Alistair Popple
2026-01-12 4:40 ` Balbir Singh
@ 2026-01-12 17:13 ` Bjorn Helgaas
2026-01-13 23:34 ` Logan Gunthorpe
2 siblings, 0 replies; 4+ messages in thread
From: Bjorn Helgaas @ 2026-01-12 17:13 UTC (permalink / raw)
To: Alistair Popple
Cc: houtao, linux-kernel, linux-pci, linux-mm, linux-nvme, bhelgaas,
logang, leonro, gregkh, tj, rafael, dakr, akpm, david,
lorenzo.stoakes, kbusch, axboe, hch, sagi, houtao1
On Mon, Jan 12, 2026 at 11:54:40AM +1100, Alistair Popple wrote:
> When mapping a p2pdma page the page reference count is initialised to
> 1 prior to calling vm_insert_page(). This is to avoid vm_insert_page()
> warning if the page refcount is zero. Prior to setting the page count
> there is a check to ensure the page is currently free (ie. has a zero
> reference count).
>
> However vm_insert_page() can fail. In this case the pages are freed
> back to the genalloc pool, but that does not reset the page refcount.
> So a future allocation of the same page will see the elevated page
> refcount from the previous set_page_count() call triggering the
> VM_WARN_ON_ONCE_PAGE checking that the page is free.
>
> Fix this by resetting the page refcount back to zero using
> set_page_count(). Note that put_page() is not used because that
> would result in freeing the page twice due to implicitly calling
> p2pdma_folio_free().
>
> Fixes: b7e282378773 ("mm/mm_init: move p2pdma page refcount initialisation to p2pdma")
> Signed-off-by: Alistair Popple <apopple@nvidia.com>
Applied to pci/p2pdma for v6.20, thanks!
> ---
>
> This was found by inspection. I don't currently have a good setup that
> exercises the p2pmem_alloc_mmap() path so this has only been compile
> tested - additional testing would be appreciated.
> ---
> drivers/pci/p2pdma.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c
> index dd64ec830fdd..3b29246b9e86 100644
> --- a/drivers/pci/p2pdma.c
> +++ b/drivers/pci/p2pdma.c
> @@ -152,6 +152,12 @@ static int p2pmem_alloc_mmap(struct file *filp, struct kobject *kobj,
> ret = vm_insert_page(vma, vaddr, page);
> if (ret) {
> gen_pool_free(p2pdma->pool, (uintptr_t)kaddr, len);
> +
> + /*
> + * Reset the page count. We don't use put_page() because
> + * we don't want to trigger the p2pdma_folio_free() path.
> + */
> + set_page_count(page, 0);
> percpu_ref_put(ref);
> return ret;
> }
> --
> 2.51.0
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] PCI/P2PDMA: Reset page reference count when page mapping fails
2026-01-12 0:54 [PATCH] PCI/P2PDMA: Reset page reference count when page mapping fails Alistair Popple
2026-01-12 4:40 ` Balbir Singh
2026-01-12 17:13 ` Bjorn Helgaas
@ 2026-01-13 23:34 ` Logan Gunthorpe
2 siblings, 0 replies; 4+ messages in thread
From: Logan Gunthorpe @ 2026-01-13 23:34 UTC (permalink / raw)
To: Alistair Popple, helgaas
Cc: houtao, linux-kernel, linux-pci, linux-mm, linux-nvme, bhelgaas,
leonro, gregkh, tj, rafael, dakr, akpm, david, lorenzo.stoakes,
kbusch, axboe, hch, sagi, houtao1
Hi Alistair,
On 2026-01-11 17:54, Alistair Popple wrote:
> When mapping a p2pdma page the page reference count is initialised to
> 1 prior to calling vm_insert_page(). This is to avoid vm_insert_page()
> warning if the page refcount is zero. Prior to setting the page count
> there is a check to ensure the page is currently free (ie. has a zero
> reference count).
>
> However vm_insert_page() can fail. In this case the pages are freed
> back to the genalloc pool, but that does not reset the page refcount.
> So a future allocation of the same page will see the elevated page
> refcount from the previous set_page_count() call triggering the
> VM_WARN_ON_ONCE_PAGE checking that the page is free.
>
> Fix this by resetting the page refcount back to zero using
> set_page_count(). Note that put_page() is not used because that
> would result in freeing the page twice due to implicitly calling
> p2pdma_folio_free().
>
> Fixes: b7e282378773 ("mm/mm_init: move p2pdma page refcount initialisation to p2pdma")
> Signed-off-by: Alistair Popple <apopple@nvidia.com>
I had time today to pull out some old hardware and run this patch
through my old p2pdma smoke tests. I don't think the tests exercise the
change, but it looks correct to me on review.
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Thanks for the fix!
Logan
^ permalink raw reply [flat|nested] 4+ messages in thread