From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 58129C433EF for ; Wed, 27 Oct 2021 02:29:54 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id C449461074 for ; Wed, 27 Oct 2021 02:29:53 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org C449461074 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.dev Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id 0821480007; Tue, 26 Oct 2021 22:29:53 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 03158940007; Tue, 26 Oct 2021 22:29:52 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E62A880007; Tue, 26 Oct 2021 22:29:52 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0166.hostedemail.com [216.40.44.166]) by kanga.kvack.org (Postfix) with ESMTP id D3FE0940007 for ; Tue, 26 Oct 2021 22:29:52 -0400 (EDT) Received: from smtpin28.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 8DD158249980 for ; Wed, 27 Oct 2021 02:29:52 +0000 (UTC) X-FDA: 78740637024.28.E904DDB Received: from out10.migadu.com (out10.migadu.com [46.105.121.227]) by imf25.hostedemail.com (Postfix) with ESMTP id A7368B000193 for ; Wed, 27 Oct 2021 02:29:45 +0000 (UTC) Date: Wed, 27 Oct 2021 11:29:37 +0900 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1635301789; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=nQGDOP/LiQ5qzBi3yIx/uAb2j3FzvKGJHPlYNIgLsaI=; b=iArym7oen0t74ifKxfuMX6gQLNj3u84i6EINnK5MlGKMIWEoRAAeLUYUlWA2Hm2YSR4QI+ uSaQf4JgCWzDAe3VSuqff8w9xmpP+xgQh+p8pGjEbtcNEIPZfudnANO58dJKEK2WLrvuXo i59u53fcevjv2Rva6VXt1I2SOjRhwwA= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Naoya Horiguchi To: Ding Hui Cc: Naoya Horiguchi , linux-mm@kvack.org, Andrew Morton , David Hildenbrand , Oscar Salvador , Michal Hocko , Tony Luck , "Aneesh Kumar K.V" , Miaohe Lin , Yang Shi , Peter Xu , Naoya Horiguchi , linux-kernel@vger.kernel.org Subject: Re: [PATCH RESEND v2 4/4] mm/hwpoison: fix unpoison_memory() Message-ID: <20211027022937.GB2707645@u2004> References: <20211025232634.GA2651726@u2004> <0d83410a-4377-35ee-66ec-0dbeb5e8801f@sangfor.com.cn> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <0d83410a-4377-35ee-66ec-0dbeb5e8801f@sangfor.com.cn> X-Migadu-Flow: FLOW_OUT X-Migadu-Auth-User: naoya.horiguchi@linux.dev X-Rspamd-Server: rspam03 X-Rspamd-Queue-Id: A7368B000193 X-Stat-Signature: zhpgoccxq74dhq9e1rxnmg8rwnfw8f6c Authentication-Results: imf25.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=iArym7oe; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf25.hostedemail.com: domain of naoya.horiguchi@linux.dev designates 46.105.121.227 as permitted sender) smtp.mailfrom=naoya.horiguchi@linux.dev X-HE-Tag: 1635301785-255918 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Oct 27, 2021 at 09:26:08AM +0800, Ding Hui wrote: > On 2021/10/26 7:27, Naoya Horiguchi wrote: > > (Please ignore previous patch 4/4 which leaves the replied message at > > the end of body, this was due to my wrong manual edit, sorry about noise. > > I resend 4/4.) > > > > From: Naoya Horiguchi > > > > After recent soft-offline rework, error pages can be taken off from > > buddy allocator, but the existing unpoison_memory() does not properly > > undo the operation. Moreover, due to the recent change on > > __get_hwpoison_page(), get_page_unless_zero() is hardly called for > > hwpoisoned pages. So __get_hwpoison_page() highly likely returns zero > > Sorry, can you explain that __get_hwpoison_page() likely go which branch to > return zero for hwpoisoned pages ? > > not returns -EBUSY because HWPoisonHandlable() is false ? Sorry, you're right, the return value mentioned here was changed since v1, so I should have updated the description. ... > > @@ -1958,9 +2023,7 @@ int unpoison_memory(unsigned long pfn) > > { > > struct page *page; > > struct page *p; > > - int freeit = 0; > > - int ret = 0; > > - unsigned long flags = 0; > > + int ret = -EBUSY; > > static DEFINE_RATELIMIT_STATE(unpoison_rs, DEFAULT_RATELIMIT_INTERVAL, > > DEFAULT_RATELIMIT_BURST); > > @@ -1996,24 +2059,27 @@ int unpoison_memory(unsigned long pfn) > > goto unlock_mutex; > > } > > - if (!get_hwpoison_page(p, flags)) { > > - if (TestClearPageHWPoison(p)) > > - num_poisoned_pages_dec(); > > - unpoison_pr_info("Unpoison: Software-unpoisoned free page %#lx\n", > > - pfn, &unpoison_rs); > > + if (PageSlab(page)) > > As I reported before [1], get refcount to a PageTable(page) is not safe, > maybe let huge_pmd_unshare() go to wrong branch, so can you also avoid > PageTable(page) here ? > > [1]: https://lore.kernel.org/linux-mm/271d0f41-0599-9d5d-0555-47189f476243@sangfor.com.cn/ Sure, I'll add it. > > > goto unlock_mutex; > > - } > > - if (TestClearPageHWPoison(page)) { > > - unpoison_pr_info("Unpoison: Software-unpoisoned page %#lx\n", > > - pfn, &unpoison_rs); > > - num_poisoned_pages_dec(); > > - freeit = 1; > > - } > > + ret = get_hwpoison_page(p, MF_UNPOISON); > > + if (!ret) { > > + ret = clear_page_hwpoison(&unpoison_rs, p); > > in this case, the page p has zero refcount, with HWPoison flag, but without > MAGIC_HWPOISON, where it come from ? race condition or normal case ? Is > there any examples please ? memory_failure() could set HWPoison flag at any time, so if a memory error happens on a page which a just being freed, that could be linked to buddy freelist with HWPoison flag. Another example is hugetlb's case, if memory_failrue() is called for a free hugetlb page and somehow dissolve_free_huge_page() fails in handling path, the hugepage remains with HWPoison flag set and refcount 0. BTW, considering this case, I found that clear_page_hwpoison() should be called for "page" instead of "p", which will be fixed in the next version. Thanks, Naoya Horiguchi