From: "HORIGUCHI NAOYA(堀口 直也)" <naoya.horiguchi@nec.com>
To: Miaohe Lin <linmiaohe@huawei.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>,
"akpm@linux-foundation.org" <akpm@linux-foundation.org>,
"linux-mm@kvack.org" <linux-mm@kvack.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH 1/4] mm/memory-failure.c: fix race with changing page compound again
Date: Mon, 7 Mar 2022 07:01:55 +0000 [thread overview]
Message-ID: <20220307070155.GA591088@hori.linux.bs1.fc.nec.co.jp> (raw)
In-Reply-To: <999a0f88-9465-0c93-e922-8aa80fa64f81@huawei.com>
On Mon, Mar 07, 2022 at 11:44:20AM +0800, Miaohe Lin wrote:
> On 2022/3/5 3:32, Mike Kravetz wrote:
> > On 3/4/22 00:26, HORIGUCHI NAOYA(堀口 直也) wrote:
> >> On Mon, Feb 28, 2022 at 10:02:42PM +0800, Miaohe Lin wrote:
> >>> There is a race window where we got the compound_head, the hugetlb page
> >>> could be freed to buddy, or even changed to another compound page just
> >>> before we try to get hwpoison page. If this happens, just bail out.
> >>
> >> I think that when some hugetlb page is about to change into other type/size
> >> of compound page, it has to go through buddy allocator because hugetlb pages
> >> are maintained in separate memory allocator and they never change into other
> >> normal state directly. memory_failure_hugetlb() takes refcount before
> >> lock_page(), so the hugetlb page seems not change between get_hwpoison_page()
> >> and lock_page(). So it this new check really necessary?
> >
> > A hugetlb page could change size without going through buddy via the new
> > demote functionality [1]. Only hugetlb pages on the hugetlb free list can
> > be demoted.
> >
> > We should not demote a page if poison is set. However, there is no check in
> > the demote code. IIUC, poison is set early in the memory error handling
> > process, even before taking ref on page. Demote code needs to be fixed so
> > that poisoned pages are not demoted. I can do that.
> >
> > With this change in place, then I think Naoya's statement that hugetlb pages
> > can not change state is correct and this patch is not necessary.
> >
>
> Sorry for my confusing commit words. What I mean to tell is indeed the below race:
> CPU 1 CPU 2
> memory_failure_hugetlb
> struct page *head = compound_head(p);
> hugetlb page is freed to buddy, or
> even changed to another compound page
> as we haven't held the page refcnt now
> get_hwpoison_page -- page is not what we want now...
>
> Does this make sense for both of you? Many thanks for comment and reply! :)
Thanks for elaboration, I agree with you (I simply overlooked this race, sorry).
And please add this in the commit log.
> +
> + /**
> + * The page could have changed compound pages due to race window.
> + * If this happens just bail out.
> + */
> + if (!PageHuge(p) || compound_head(p) != head) {
> + action_result(pfn, MF_MSG_DIFFERENT_COMPOUND, MF_IGNORED);
> + res = -EBUSY;
> + goto out;
> + }
Let me have one comment on the diff. The result code MF_MSG_DIFFERENT_COMPOUND
might not fit when PageHuge is false in the check (because it's no longer a
compound page). Maybe you may invent another result code, or changes
MF_MSG_DIFFERENT_COMPOUND (for example) to MF_MSG_DIFFERENT_PAGE_SIZE?
>
> > Does that sound reasonable?
> >
> > [1] https://lore.kernel.org/linux-mm/20211007181918.136982-1-mike.kravetz@oracle.com/
>
> This is really a nice feature. Thanks.
Yes. Hugepage demotion after entering memory_failure_hugetlb() should
cause the race, so we need the check after page lock.
Thanks,
Naoya Horiguchi
next prev parent reply other threads:[~2022-03-07 7:03 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-28 14:02 [PATCH 0/4] A few fixup patches for memory failure Miaohe Lin
2022-02-28 14:02 ` [PATCH 1/4] mm/memory-failure.c: fix race with changing page compound again Miaohe Lin
2022-03-04 8:26 ` HORIGUCHI NAOYA(堀口 直也)
2022-03-04 19:32 ` Mike Kravetz
2022-03-07 3:44 ` Miaohe Lin
2022-03-07 7:01 ` HORIGUCHI NAOYA(堀口 直也) [this message]
2022-03-07 19:07 ` Mike Kravetz
2022-03-08 6:56 ` HORIGUCHI NAOYA(堀口 直也)
2022-03-08 11:28 ` Miaohe Lin
2022-02-28 14:02 ` [PATCH 2/4] mm/memory-failure.c: fix wrong user reference report Miaohe Lin
2022-03-04 8:27 ` HORIGUCHI NAOYA(堀口 直也)
2022-03-07 11:26 ` Miaohe Lin
2022-03-07 20:14 ` Yang Shi
2022-03-08 13:11 ` Miaohe Lin
2022-03-08 18:51 ` Yang Shi
2022-03-09 8:30 ` Miaohe Lin
2022-02-28 14:02 ` [PATCH 3/4] mm/memory-failure.c: avoid calling invalidate_inode_page() with unexpected pages Miaohe Lin
2022-02-28 14:02 ` [PATCH 4/4] mm/memory-failure.c: fix potential VM_BUG_ON_PAGE in split_huge_page_to_list Miaohe Lin
2022-03-04 8:28 ` HORIGUCHI NAOYA(堀口 直也)
2022-03-07 7:07 ` Miaohe Lin
2022-03-07 19:53 ` Yang Shi
2022-03-08 12:36 ` Miaohe Lin
2022-03-08 18:47 ` Yang Shi
2022-03-09 8:45 ` Miaohe Lin
2022-03-10 11:46 ` Miaohe Lin
2022-03-10 19:32 ` Yang Shi
2022-03-11 1:54 ` Miaohe Lin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220307070155.GA591088@hori.linux.bs1.fc.nec.co.jp \
--to=naoya.horiguchi@nec.com \
--cc=akpm@linux-foundation.org \
--cc=linmiaohe@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mike.kravetz@oracle.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).