Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
Date:   Tue, 5 Apr 2022 12:43:41 +0200
From:   Michal Hocko <mhocko@suse.com>
To:     Alexander Sverdlin <alexander.sverdlin@nokia.com>
Cc:     Nicholas Piggin <npiggin@gmail.com>,
        Alexander Duyck <alexanderduyck@fb.com>,
        Matthew Wilcox <willy@infradead.org>,
        Hugh Dickins <hughd@google.com>, Yu Zhao <yuzhao@google.com>,
        Mel Gorman <mgorman@techsingularity.net>,
        Lee Schermerhorn <lee.schermerhorn@hp.com>,
        Sasha Levin <sashal@kernel.org>,
        Andrew Morton <akpm@linux-foundation.org>, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org
Subject: Re: mm: swap: locking in release_pages()
Message-ID: <YkwdRnuQBjoJ01YK@dhcp22.suse.cz>
References: <89009285-c75d-0f09-5b08-d133c42a18f9@nokia.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <89009285-c75d-0f09-5b08-d133c42a18f9@nokia.com>
Precedence: bulk

On Tue 05-04-22 12:20:15, Alexander Sverdlin wrote:
> Dear mm developers!
> 
> After experiencing a crash in release_pages() [1] I'm trying to understand the locking in the release_pages():
> 
> No matter if we consider v5.17 or v5.4 (as in my case), they both have similar locking patterns:

Similar but the notable difference is that 5.4 used per node lru locking
while newer versions 5.11+ kernels use per memcg locking. If you see the
issue on 5.4 then this is unlikely a regression.
[...]
> What I don't understand here is, what guarantees us that "if (PageLRU(page))" condition
> is still valid after we swap the locks in "if (pgdat != locked_pgdat)" case?

The underlying reasoning is that the PageLRU handling is done after the
last reference has been dropped. isolate_lru_page and others should
elevate the reference count before isolating page from LRU lists.
Some callers user TestClearPageLRU

> If we check under one lock and VM_BUG_ON_PAGE() under another lock, what actually stops
> it from crashing as below or BUG() from time to time?
G

> 
> 1. Crash of v5.4.170 on an ARM32 machine:
> 
> Unable to handle kernel NULL pointer dereference at virtual address 00000104
> pgd = e138149d
> [00000104] *pgd=84d2fd003, *pmd=8ffd6f003
> Internal error: Oops: a07 [#1] PREEMPT SMP ARM
> ...
> CPU: 1 PID: 6172 Comm: AaSysInfoRColle Tainted: G    B      O      5.4.170-... #1
> Hardware name: Keystone
> PC is at release_pages+0x194/0x358
> LR is at release_pages+0x10c/0x358

Which LOC does this correspond to? (faddr2line should give you a nice
output).
-- 
Michal Hocko
SUSE Labs