From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1C02C433DF for ; Thu, 27 Aug 2020 12:20:25 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id ABEC922CB1 for ; Thu, 27 Aug 2020 12:20:25 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="H+uXV9mP" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org ABEC922CB1 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=infradead.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 554918E0018; Thu, 27 Aug 2020 08:20:25 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 4DD7F8E0006; Thu, 27 Aug 2020 08:20:25 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3CC798E0018; Thu, 27 Aug 2020 08:20:25 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0139.hostedemail.com [216.40.44.139]) by kanga.kvack.org (Postfix) with ESMTP id 236CD8E0006 for ; Thu, 27 Aug 2020 08:20:25 -0400 (EDT) Received: from smtpin06.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id CEA888248068 for ; Thu, 27 Aug 2020 12:20:24 +0000 (UTC) X-FDA: 77196256368.06.spot81_3b076382706d Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin06.hostedemail.com (Postfix) with ESMTP id 9C3D710064AB4 for ; Thu, 27 Aug 2020 12:20:24 +0000 (UTC) X-HE-Tag: spot81_3b076382706d X-Filterd-Recvd-Size: 3700 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) by imf05.hostedemail.com (Postfix) with ESMTP for ; Thu, 27 Aug 2020 12:20:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=WR0JbwYpcKbUOXFKigJtskF/5Rf4W2AfrlUuN1W+bsM=; b=H+uXV9mPRYjsGIq94MPTzLDOHg AhABlz1ms+kupgpq6eu6blxwpVJHiBxNdDdF7DDdfGVnbfURALdJc0roZONNxy7U0tFsG6mtyFbDv tJZQoIFzewHaBFfia7THTczhceUNnACC2J88y+Hct9uiQ/Jhp549tEpYeW1hHjLcteIdX6E3jp2k6 Ze/qeVOM+252nE2Tl6kvMsuEAOHf9mjTjPShX8wnLqHLDbtVG5p1RG1P27Sg8IWYJfUBtisxYr3WQ YLMqfxxlm9x43PkLVQYD6UpYWveA+A3c7ZVI20iEk4D/XJ9xekJIQMtfCOznX9Gzf9hr0s9I+QTvR VGdXosvQ==; Received: from willy by casper.infradead.org with local (Exim 4.92.3 #3 (Red Hat Linux)) id 1kBGt9-0001qR-2P; Thu, 27 Aug 2020 12:20:19 +0000 Date: Thu, 27 Aug 2020 13:20:19 +0100 From: Matthew Wilcox To: Hugh Dickins Cc: Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, kirill@shutemov.name, Nicholas Piggin Subject: Race between freeing and waking page Message-ID: <20200827122019.GC14765@casper.infradead.org> References: <1598273705-69124-1-git-send-email-alex.shi@linux.alibaba.com> <20200824114204.cc796ca182db95809dd70a47@linux-foundation.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Rspamd-Queue-Id: 9C3D710064AB4 X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam03 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Aug 27, 2020 at 12:01:00AM -0700, Hugh Dickins wrote: > It was a crash from checking PageWaiters on a Tail in wake_up_page(), > called from end_page_writeback(), from ext4_finish_bio(): yet the > page a tail of a shmem huge page. Linus's wake_up_page_bit() changes? > No, I don't think so. It seems to me that once end_page_writeback() > has done its test_clear_page_writeback(), it has no further hold on > the struct page, which could be reused as part of a compound page > by the time of wake_up_page()'s PageWaiters check. But I probably > need to muse on that for longer. I think you're right. Example: truncate_inode_pages_range() pagevec_lookup_entries() lock_page() --- ctx switch --- ext4_finish_bio() end_page_writeback() test_clear_page_writeback() --- ctx switch --- wait_on_page_writeback() <- noop truncate_inode_page() unlock_page() pagevec_release() ... page can now be allocated --- ctx switch --- wake_up_page() PageWaiters then has that check for PageTail. This isn't unique to ext4; the iomap completion path behaves the exact same way. The thing is, this is a harmless race. It seems unnecessary for anybody here to incur the overhead of adding a page ref to be sure the page isn't reallocated. We don't want to wake up the waiters before clearing the bit in question. I'm tempted to suggest this: static void wake_up_page(struct page *page, int bit) { - if (!PageWaiters(page)) + if (PageTail(page) || !PageWaiters(page)) return; wake_up_page_bit(page, bit); which only adds an extra read to the struct page that we were going to access anyway. Even that seems unnecessary though; PageWaiters is going to be clear. Maybe we can just change the PF policy from PF_ONLY_HEAD to PF_ANY. I don't think it's critical that we have this check. Nick?