2022-07-25 01:36:36

by Jaewon Kim

[permalink] [raw]
Subject: [PATCH] page_alloc: fix invalid watemark check on a negative value

There was a report that a task is waiting at the
throttle_direct_reclaim. The pgscan_direct_throttle in vmstat was
increasing.

This is a bug where zone_watermark_fast returns true even when the free
is very low. The commit f27ce0e14088 ("page_alloc: consider highatomic
reserve in watermark fast") changed the watermark fast to consider
highatomic reserve. But it did not handle a negative value case which
can be happened when reserved_highatomic pageblock is bigger than the
actual free.

If watermark is considered as ok for the negative value, allocating
contexts for order-0 will consume all free pages without direct reclaim,
and finally free page may become depleted except highatomic free.

Then allocating contexts may fall into throttle_direct_reclaim. This
symptom may easily happen in a system where wmark min is low and other
reclaimers like kswapd does not make free pages quickly.

To handle the negative value, get the value as long type like
__zone_watermark_ok does.

Reported-by: GyeongHwan Hong <[email protected]>
Signed-off-by: Jaewon Kim <[email protected]>
---
mm/page_alloc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index e008a3df0485..cf667fae132e 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3968,11 +3968,12 @@ static inline bool zone_watermark_fast(struct zone *z, unsigned int order,
* need to be calculated.
*/
if (!order) {
+ long min = mark;
long fast_free;

fast_free = free_pages;
fast_free -= __zone_watermark_unusable_free(z, 0, alloc_flags);
- if (fast_free > mark + z->lowmem_reserve[highest_zoneidx])
+ if (fast_free > min + z->lowmem_reserve[highest_zoneidx])
return true;
}

--
2.17.1


2022-07-25 08:51:21

by Mel Gorman

[permalink] [raw]
Subject: Re: [PATCH] page_alloc: fix invalid watemark check on a negative value

On Mon, Jul 25, 2022 at 10:28:43AM +0900, Jaewon Kim wrote:
> There was a report that a task is waiting at the
> throttle_direct_reclaim. The pgscan_direct_throttle in vmstat was
> increasing.
>
> This is a bug where zone_watermark_fast returns true even when the free
> is very low. The commit f27ce0e14088 ("page_alloc: consider highatomic
> reserve in watermark fast") changed the watermark fast to consider
> highatomic reserve. But it did not handle a negative value case which
> can be happened when reserved_highatomic pageblock is bigger than the
> actual free.
>
> If watermark is considered as ok for the negative value, allocating
> contexts for order-0 will consume all free pages without direct reclaim,
> and finally free page may become depleted except highatomic free.
>
> Then allocating contexts may fall into throttle_direct_reclaim. This
> symptom may easily happen in a system where wmark min is low and other
> reclaimers like kswapd does not make free pages quickly.
>
> To handle the negative value, get the value as long type like
> __zone_watermark_ok does.
>
> Reported-by: GyeongHwan Hong <[email protected]>
> Signed-off-by: Jaewon Kim <[email protected]>

Add

Fixes: f27ce0e14088 ("page_alloc: consider highatomic reserve in watermark fast")

The fix is fine as-is but it's not immediately obvious why this
can wrap negative as it depends on an implementation detail of
__zone_watermark_unusable_free. The variable copy just to change the sign
could get accidentally "fixed" later as a micro-optimisation (same if the
type of mark was changed) so maybe leave a comment like

/* unusable may over-estimate high-atomic reserves */

Otherwise

Acked-by: Mel Gorman <[email protected]>

The problem could also be made explicit with something like below. I know
you are copying the logic of __zone_watermark_ok but I don't think min
can go negative there.

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 934d1b5a5449..f8f50a2aa43e 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4048,11 +4048,15 @@ static inline bool zone_watermark_fast(struct zone *z, unsigned int order,
* need to be calculated.
*/
if (!order) {
- long fast_free;
+ long usable_free;
+ long reserved;

- fast_free = free_pages;
- fast_free -= __zone_watermark_unusable_free(z, 0, alloc_flags);
- if (fast_free > mark + z->lowmem_reserve[highest_zoneidx])
+ usable_free = free_pages;
+ reserved = __zone_watermark_unusable_free(z, 0, alloc_flags);
+
+ /* reserved may over estimate high-atomic reserves. */
+ usable_free -= min(usable_free, reserved);
+ if (usable_free > mark + z->lowmem_reserve[highest_zoneidx])
return true;
}

--
Mel Gorman
SUSE Labs

2022-07-25 10:20:49

by Jaewon Kim

[permalink] [raw]
Subject: RE: [PATCH] page_alloc: fix invalid watemark check on a negative value

>On Mon, Jul 25, 2022 at 10:28:43AM +0900, Jaewon Kim wrote:
>> There was a report that a task is waiting at the
>> throttle_direct_reclaim. The pgscan_direct_throttle in vmstat was
>> increasing.
>>
>> This is a bug where zone_watermark_fast returns true even when the free
>> is very low. The commit f27ce0e14088 ("page_alloc: consider highatomic
>> reserve in watermark fast") changed the watermark fast to consider
>> highatomic reserve. But it did not handle a negative value case which
>> can be happened when reserved_highatomic pageblock is bigger than the
>> actual free.
>>
>> If watermark is considered as ok for the negative value, allocating
>> contexts for order-0 will consume all free pages without direct reclaim,
>> and finally free page may become depleted except highatomic free.
>>
>> Then allocating contexts may fall into throttle_direct_reclaim. This
>> symptom may easily happen in a system where wmark min is low and other
>> reclaimers like kswapd does not make free pages quickly.
>>
>> To handle the negative value, get the value as long type like
>> __zone_watermark_ok does.
>>
>> Reported-by: GyeongHwan Hong <[email protected]>
>> Signed-off-by: Jaewon Kim <[email protected]>
>
>Add
>
>Fixes: f27ce0e14088 ("page_alloc: consider highatomic reserve in watermark fast")

I will add the Fixes.

>
>The fix is fine as-is but it's not immediately obvious why this
>can wrap negative as it depends on an implementation detail of
>__zone_watermark_unusable_free. The variable copy just to change the sign
>could get accidentally "fixed" later as a micro-optimisation (same if the
>type of mark was changed) so maybe leave a comment like
>
> /* unusable may over-estimate high-atomic reserves */
>
>Otherwise
>
>Acked-by: Mel Gorman <[email protected]>

Thank you for your Ack
Yes leaving comment will be helpful. Actually let me take your patch.
I think this but is obvious and fix is sipmle, I can resubmit right away.

>
>The problem could also be made explicit with something like below. I know
>you are copying the logic of __zone_watermark_ok but I don't think min
>can go negative there.

The min in __zone_watermark_ok is positive because mark is always unsigned.
But I think free_pages in __zone_watermark_ok can go negative because of the
same reason.

>
>diff --git a/mm/page_alloc.c b/mm/page_alloc.c
>index 934d1b5a5449..f8f50a2aa43e 100644
>--- a/mm/page_alloc.c
>+++ b/mm/page_alloc.c
>@@ -4048,11 +4048,15 @@ static inline bool zone_watermark_fast(struct zone *z, unsigned int order,
> * need to be calculated.
> */
> if (!order) {
>- long fast_free;
>+ long usable_free;
>+ long reserved;
>
>- fast_free = free_pages;
>- fast_free -= __zone_watermark_unusable_free(z, 0, alloc_flags);
>- if (fast_free > mark + z->lowmem_reserve[highest_zoneidx])
>+ usable_free = free_pages;
>+ reserved = __zone_watermark_unusable_free(z, 0, alloc_flags);
>+
>+ /* reserved may over estimate high-atomic reserves. */
>+ usable_free -= min(usable_free, reserved);
>+ if (usable_free > mark + z->lowmem_reserve[highest_zoneidx])
> return true;
> }
>
>--
>Mel Gorman
>SUSE Labs