From: Miaohe Lin <email@example.com>
To: Muchun Song <firstname.lastname@example.org>
Cc: Andrew Morton <email@example.com>,
Minchan Kim <firstname.lastname@example.org>, <email@example.com>,
<firstname.lastname@example.org>, LKML <email@example.com>,
Linux Memory Management List <firstname.lastname@example.org>
Subject: Re: [Phishing Risk] [External] [PATCH 2/3] mm/zsmalloc.c: combine two atomic ops in zs_pool_dec_isolated()
Date: Fri, 25 Jun 2021 17:32:23 +0800 [thread overview]
Message-ID: <email@example.com> (raw)
On 2021/6/25 16:46, Miaohe Lin wrote:
> On 2021/6/25 15:29, Muchun Song wrote:
>> On Fri, Jun 25, 2021 at 2:32 PM Miaohe Lin <firstname.lastname@example.org> wrote:
>>> On 2021/6/25 13:01, Muchun Song wrote:
>>>> On Thu, Jun 24, 2021 at 8:40 PM Miaohe Lin <email@example.com> wrote:
>>>>> atomic_long_dec_and_test() is equivalent to atomic_long_dec() and
>>>>> atomic_long_read() == 0. Use it to make code more succinct.
>>>> Actually, they are not equal. atomic_long_dec_and_test implies a
>>>> full memory barrier around it but atomic_long_dec and atomic_long_read
>>> Many thanks for comment. They are indeed not completely equal as you said.
>>> What I mean is they can do the same things we want in this specified context.
>>> Thanks again.
>> I don't think so. Using individual operations can eliminate memory barriers.
>> We will pay for the barrier if we use atomic_long_dec_and_test here.
> The combination of atomic_long_dec and atomic_long_read usecase is rare and looks somehow
> weird. I think it's worth to do this with the cost of barrier.
It seems there is race between zs_pool_dec_isolated and zs_unregister_migration if pool->destroying
is reordered before the atomic_long_dec and atomic_long_read ops. So this memory barrier is necessary:
pool->destroying != true
pool->destroying = true;
wait_event with atomic_long_read(&pool->isolated_pages) != 0
atomic_long_read(&pool->isolated_pages) == 0
Thus wake_up_all is missed.
And the comment in zs_pool_dec_isolated() said:
* There's no possibility of racing, since wait_for_isolated_drain()
* checks the isolated count under &class->lock after enqueuing
* on migration_wait.
But I found &class->lock is indeed not acquired for wait_for_isolated_drain(). So I think the above race
is possible. Does this make senses for you ?
>>>> That RMW operations that have a return value is equal to the following.
>>>> non-RMW operations or RMW operations that have no return value
>>>>> Signed-off-by: Miaohe Lin <firstname.lastname@example.org>
>>>>> mm/zsmalloc.c | 3 +--
>>>>> 1 file changed, 1 insertion(+), 2 deletions(-)
>>>>> diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
>>>>> index 1476289b619f..0b4b23740d78 100644
>>>>> --- a/mm/zsmalloc.c
>>>>> +++ b/mm/zsmalloc.c
>>>>> @@ -1828,13 +1828,12 @@ static void putback_zspage_deferred(struct zs_pool *pool,
>>>>> static inline void zs_pool_dec_isolated(struct zs_pool *pool)
>>>>> VM_BUG_ON(atomic_long_read(&pool->isolated_pages) <= 0);
>>>>> - atomic_long_dec(&pool->isolated_pages);
>>>>> * There's no possibility of racing, since wait_for_isolated_drain()
>>>>> * checks the isolated count under &class->lock after enqueuing
>>>>> * on migration_wait.
>>>>> - if (atomic_long_read(&pool->isolated_pages) == 0 && pool->destroying)
>>>>> + if (atomic_long_dec_and_test(&pool->isolated_pages) && pool->destroying)
next prev parent reply other threads:[~2021-06-25 9:32 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-24 12:39 [PATCH 0/3] Cleanup for zsmalloc Miaohe Lin
2021-06-24 12:39 ` [PATCH 1/3] mm/zsmalloc.c: remove confusing code in obj_free() Miaohe Lin
2021-06-24 12:39 ` [PATCH 2/3] mm/zsmalloc.c: combine two atomic ops in zs_pool_dec_isolated() Miaohe Lin
2021-06-25 5:01 ` [Phishing Risk] [External] " Muchun Song
2021-06-25 6:32 ` Miaohe Lin
2021-06-25 7:29 ` Muchun Song
2021-06-25 8:46 ` Miaohe Lin
2021-06-25 9:32 ` Miaohe Lin [this message]
2021-06-25 10:40 ` Muchun Song
2021-07-01 2:43 ` Miaohe Lin
2021-06-24 12:39 ` [PATCH 3/3] mm/zsmalloc.c: improve readability for async_free_zspage() Miaohe Lin
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).