Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Zi Yan <ziy@nvidia.com>
To:     Xianting Tian <xianting.tian@linux.alibaba.com>
Cc:     akpm@linux-foundation.org, vbabka@suse.cz, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org, stable@vger.kernel.org,
        huanyi.xj@alibaba-inc.com, guoren@kernel.org,
        zjb194813@alibaba-inc.com, tianhu.hh@alibaba-inc.com
Subject: Re: [RESEND PATCH] mm: page_alloc: validate buddy before check the
 migratetype
Date:   Mon, 13 Jun 2022 11:22:54 -0400
Message-ID: <0262A4FB-5A9B-47D3-8F1A-995509F56279@nvidia.com>
In-Reply-To: <20220613131046.3009889-1-xianting.tian@linux.alibaba.com>
References: <20220613131046.3009889-1-xianting.tian@linux.alibaba.com>
Content-Type: multipart/signed;
 boundary="=_MailMate_1CE0925E-B4FF-407D-AE4B-20DBE557C614_=";
 micalg=pgp-sha512; protocol="application/pgp-signature"
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?kXVmGcaMQY6N+Qb+g0WSAQA62R3R8plAar6JZZ9U4m41t3CEqLt2A3oBVCgz?=
 =?us-ascii?Q?kEHgENrgcdgSG+Re/W5IGqqE4HiBq09xp0mEqxVCqHxN1rNiNIUyxpkiyKIa?=
 =?us-ascii?Q?thYpuTJp1IR/DoYA99TX71WAJ3BeBau0JNLjcjCzAP6Rt8ZsD5IFAWxAhOhB?=
 =?us-ascii?Q?QpLkCmT7Zqp9IVaN5nqoHX7yjNTiKjb/tsEhvHzn33pNQPp1MzCbj8tYIqCg?=
 =?us-ascii?Q?OWTeSLoAav7naeJuvZypY3+x7fy7dzEiUi9fEU2+16yl8bIwPMj2cRXLNPpH?=
 =?us-ascii?Q?tls2GnV1rPRe26ix2qvF2LMSg7U6dUpvWGKo78W1BzUluKqqUK26BvjeOzxK?=
 =?us-ascii?Q?t6pwRdSbw2/RBNTYC4F0rgaImqFOlbmS9m24Em1f807NtKFBQS9BflvDqbTh?=
 =?us-ascii?Q?obHYVpdppJOt1L8OHOAVzBv6LRfJH6FkAEpfuGR9g9Z8xxemVqBaUL1lEVcR?=
 =?us-ascii?Q?5oKe/+6GLk5xXusYOVH8+TgUcLkB+ZU803SHEjQ2M00QCbwr3jHKh2LrQLGW?=
 =?us-ascii?Q?NX4l3t0dxFohxrfYymhpqyIthz8gjpEC8NpxKFuiZqiqZSeTw3mMYod7zIsV?=
 =?us-ascii?Q?v2zln8R050njGshiTGyZP6B/3lQIXHvEZxXXHH5bb5NjIO8RIE+Kd0kTyRwD?=
 =?us-ascii?Q?D13E5eqpT6Sb3kFFg/YFBK3Fbixpp8G0zllSpfiaIGBMuQJB22St/9oDQeKJ?=
 =?us-ascii?Q?q5THzFlNCF3DJ/723umvjco3i6jGoIT2eTYo0TJAdbtnLZhEgPrxzd52Cjun?=
 =?us-ascii?Q?djLq2UVkrRK+TUWAoymQtyBgQck/x+irnlAjpvqBqmXA1MZythiRIV47+Jjx?=
 =?us-ascii?Q?wignQEdB0flRNUDpr75OzNG5xV6cwZl34enZqLszaHDKp9lZv/YB9xzMSDQ+?=
 =?us-ascii?Q?F7LbkwJCoBjIrSUbu2Y7+0C1uuZB+JGON+WcXiQMJALkGpJd1PyKkbp6ZHU7?=
 =?us-ascii?Q?pnmnAJiiy/bhr3lS2ycuEOOhXKvj5nAvQw+RZiypewCmb6v2TNM5brTmrzKy?=
 =?us-ascii?Q?6i5iv1jv0qGdEfaaCE4WVDi2rWnpsp7z91nXjgXh++izH7zPikK3LfYCVWrn?=
 =?us-ascii?Q?d1v/sfbFsZJBOJ4EXHHJXDuSFkxtXsu7jQm2vbRv4zR7X8c4semk3CIbqR20?=
 =?us-ascii?Q?IBw0WtN0LWrRN3ISDcPUlgQ0Qm7Up8Pf/XiOrNMbw9QoTqLmHL75nVJfnh9a?=
 =?us-ascii?Q?iRpfPJ8bZXqI+dtNuLhrq1mtaOi7BFETIccCPlckkIHLS0QyXhg0VWnO82vh?=
 =?us-ascii?Q?tI8SPvxP28WJsGfboPjljgxIMTCERyK/VtY+hr571x3pIge/AACv3bJuUSgp?=
 =?us-ascii?Q?rccwq49WGPFMfIQxzbuUqyA2jlSYNPNQVdKl6RHwL1jZ6SM8S1DE8mmhQFjd?=
 =?us-ascii?Q?Leum+bfjgLP2g1NFOfuCPjlAJEl97hIfTlDjZEbPV9LYfHaB8FVjdKoxFm7b?=
 =?us-ascii?Q?tHkIsnRa+RRTGbOTZnAW5QXAhr5Z6EzyCnF/Mxca/JZYXMSrrlqoAB9R3TyJ?=
 =?us-ascii?Q?fJ//O2CK9TfTHNvo2fNmwFIxQFIwH0AJI/tQkvXoREBT/n2WuRipGUDyW/GA?=
 =?us-ascii?Q?Zh1Nkj3RwD3iwCJNX/qHhvePWbalZVBTQ7pPNWvb5Xx+s1bElE+wP3nrqKDd?=
 =?us-ascii?Q?F/GO3yACVaepJCwRbsPc7dE0yoTs7mV0vmYZgZfk5F29XQ6hcGV6vcGBypHN?=
 =?us-ascii?Q?of9e/SWNWpWvdpSii2OV873q/qlxgwtJbN4n1QEXuk1/srFCuDR8j6EusdS9?=
 =?us-ascii?Q?erXgL2Ulag=3D=3D?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6abcf5a2-b946-42f0-2f11-08da4d5097d5
X-MS-Exchange-CrossTenant-AuthSource: DS7PR12MB5744.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jun 2022 15:22:56.7649
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 24GY/AVEoElhBBcXo2jk56lk5DU2SgL2gQGkI4coACPXRarLvZKoFYWJ2VWwcIGC
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR12MB4232
X-Spam-Status: No, score=-2.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,
        RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

--=_MailMate_1CE0925E-B4FF-407D-AE4B-20DBE557C614_=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Hi Xianting,

Thanks for your patch.

On 13 Jun 2022, at 9:10, Xianting Tian wrote:

> Commit 787af64d05cd ("mm: page_alloc: validate buddy before check its m=
igratetype.")
> added buddy check code. But unfortunately, this fix isn't backported to=

> linux-5.17.y and the former stable branches. The reason is it added wro=
ng
> fixes message:
>      Fixes: 1dd214b8f21c ("mm: page_alloc: avoid merging non-fallbackab=
le
> 			   pageblocks with others")

No, the Fixes tag is right. The commit above does need to validate buddy.=


> Actually, this issue is involved by commit:
>      commit d9dddbf55667 ("mm/page_alloc: prevent merging between isola=
ted and other pageblocks")
>
> For RISC-V arch, the first 2M is reserved for sbi, so the start PFN is =
512,
> but it got buddy PFN 0 for PFN 0x2000:
>      0 =3D 0x2000 ^ (1 << 12)
> With the illegal buddy PFN 0, it got an illegal buddy page, which cause=
d
> crash in __get_pfnblock_flags_mask().

It seems that the RISC-V arch reveals a similar bug from d9dddbf55667.
Basically, this bug will only happen when PFN=3D0x2000 is merging up and
there are some isolated pageblocks.

BTW, what does first reserved 2MB imply? All 4KB pages from first 2MB are=

set to PageReserved?

>
> With the patch, it can avoid the calling of get_pageblock_migratetype()=
 if
> it isn't buddy page.

You might miss the __find_buddy_pfn() caller in unset_migratetype_isolate=
()
from mm/page_isolation.c, if you are talking about linux-5.17.y and forme=
r
version. There, page_is_buddy() is also not called and is_migrate_isolate=
_page()
is called, which calls get_pageblock_migratetype() too.

>
> Fixes: d9dddbf55667 ("mm/page_alloc: prevent merging between isolated a=
nd other pageblocks")
> Cc: stable@vger.kernel.org
> Reported-by: zjb194813@alibaba-inc.com
> Reported-by: tianhu.hh@alibaba-inc.com
> Signed-off-by: Xianting Tian <xianting.tian@linux.alibaba.com>
> ---
>  mm/page_alloc.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> index b1caa1c6c887..5b423caa68fd 100644
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -1129,6 +1129,9 @@ static inline void __free_one_page(struct page *p=
age,
>
>  			buddy_pfn =3D __find_buddy_pfn(pfn, order);
>  			buddy =3D page + (buddy_pfn - pfn);
> +
> +			if (!page_is_buddy(page, buddy, order))
> +				goto done_merging;
>  			buddy_mt =3D get_pageblock_migratetype(buddy);
>
>  			if (migratetype !=3D buddy_mt
> -- =

> 2.17.1

--
Best Regards,
Yan, Zi
--=_MailMate_1CE0925E-B4FF-407D-AE4B-20DBE557C614_=
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQJDBAEBCgAtFiEE6rR4j8RuQ2XmaZol4n+egRQHKFQFAmKnVk4PHHppeUBudmlk
aWEuY29tAAoJEOJ/noEUByhURRYQAIpv3JXGEvCl33BmpJY2qRrIPwHBwPfiKTko
FiU0ddUF2Tj14mmyNHQ2IgkhrshWuuCfPNyfAFtC7yW08Nzl5hncqsmOVQH+sIwK
lmGnwgu/qTRwwer86SFItFdPDT3EMxKj79dcCnv5MRjPmoiy20vGDxHs5PTDbd6V
g9/KoQ+jzGrBfwgairhibJ5zK3pnjqTkzdc4rWXLiKqgQNCt5bCZXDhJFTMRbCUL
dzauu5SjFWh2d7V/PUbxRP+sfakLmeY3qxQn4cuWzpTvgVn/Nw0AkI+eSwjHr6Fe
BE+KSl2KwSOAU09rkPYiXg5TW1RjCPpV+KPfuX+myakEQqfZrwxdL58W+SwVImMT
5SSzshgKZRvSStarwtpuqwwua9Egdi825r9r+pwZndJdLvBgBGQxA8sJ+zfMwSQo
WsVoYtOT1O7fA4omtQWmkSbpQD/y9z7BhAyv9WUXCrBeFGgZ3bT/Vh0QWMrUS2Lk
vj7iaK+cgwLqsAaUsgEv9sLnAlTy5DFOBbSJsAR5UkK3iY3L+B7hFRrzn6Qb/YIq
bJtXHW9j/KiV+hbGJzkHXb1mU+9fOJtTfkBsR+j3AgvDrH6HVhoFOTOEkEUHaPBo
a2t4y7/Ff/Bnw9PmxBLbDxAaGl5+RpUELrx1RPBL7kq9gMLbkmHuA0VGGH3oCiFD
50Y40rrJ
=LY47
-----END PGP SIGNATURE-----

--=_MailMate_1CE0925E-B4FF-407D-AE4B-20DBE557C614_=--