Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <2d607f47-71fa-9505-b355-7203eb327bab@bytedance.com>
Date:   Thu, 23 Jun 2022 10:36:10 +0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0)
 Gecko/20100101 Thunderbird/91.10.0
Subject: Re: [PATCH v12 12/14] mm: multi-gen LRU: debugfs interface
Content-Language: en-US
To:     Yu Zhao <yuzhao@google.com>
Cc:     Andrew Morton <akpm@linux-foundation.org>,
        Andi Kleen <ak@linux.intel.com>,
        Aneesh Kumar <aneesh.kumar@linux.ibm.com>,
        Catalin Marinas <catalin.marinas@arm.com>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        Hillf Danton <hdanton@sina.com>, Jens Axboe <axboe@kernel.dk>,
        Johannes Weiner <hannes@cmpxchg.org>,
        Jonathan Corbet <corbet@lwn.net>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Matthew Wilcox <willy@infradead.org>,
        Mel Gorman <mgorman@suse.de>,
        Michael Larabel <Michael@michaellarabel.com>,
        Michal Hocko <mhocko@kernel.org>,
        Mike Rapoport <rppt@kernel.org>,
        Peter Zijlstra <peterz@infradead.org>,
        Tejun Heo <tj@kernel.org>, Vlastimil Babka <vbabka@suse.cz>,
        Will Deacon <will@kernel.org>,
        Linux ARM <linux-arm-kernel@lists.infradead.org>,
        "open list:DOCUMENTATION" <linux-doc@vger.kernel.org>,
        linux-kernel <linux-kernel@vger.kernel.org>,
        Linux-MM <linux-mm@kvack.org>,
        the arch/x86 maintainers <x86@kernel.org>,
        Kernel Page Reclaim v2 <page-reclaim@google.com>,
        Brian Geffon <bgeffon@google.com>,
        Jan Alexander Steffens <heftig@archlinux.org>,
        Oleksandr Natalenko <oleksandr@natalenko.name>,
        Steven Barrett <steven@liquorix.net>,
        Suleiman Souhlal <suleiman@google.com>,
        Daniel Byrne <djbyrne@mtu.edu>,
        Donald Carr <d@chaos-reins.com>,
        =?UTF-8?Q?Holger_Hoffst=c3=a4tte?= <holger@applied-asynchrony.com>,
        Konstantin Kharlamov <Hi-Angel@yandex.ru>,
        Shuang Zhai <szhai2@cs.rochester.edu>,
        Sofia Trinh <sofia.trinh@edi.works>,
        Vaibhav Jain <vaibhav@linux.ibm.com>
References: <20220614071650.206064-1-yuzhao@google.com>
 <20220614071650.206064-13-yuzhao@google.com>
 <214db251-827c-715c-54cf-9c0e9bb5fe30@bytedance.com>
 <CAOUHufZ8xaVKZD7LNeo8AZv_xywvwef4P8CjdO+npijLHEUfWg@mail.gmail.com>
From:   Qi Zheng <zhengqi.arch@bytedance.com>
In-Reply-To: <CAOUHufZ8xaVKZD7LNeo8AZv_xywvwef4P8CjdO+npijLHEUfWg@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 2022/6/23 03:13, Yu Zhao wrote:
> On Wed, Jun 22, 2022 at 3:16 AM Qi Zheng <zhengqi.arch@bytedance.com> wrote:
> 
>>> +static ssize_t lru_gen_seq_write(struct file *file, const char __user *src,
>>> +                              size_t len, loff_t *pos)
>>> +{
>>> +     void *buf;
>>> +     char *cur, *next;
>>> +     unsigned int flags;
>>> +     struct blk_plug plug;
>>> +     int err = -EINVAL;
>>> +     struct scan_control sc = {
>>> +             .may_writepage = true,
>>> +             .may_unmap = true,
>>> +             .may_swap = true,
>>> +             .reclaim_idx = MAX_NR_ZONES - 1,
>>> +             .gfp_mask = GFP_KERNEL,
>>> +     };
>>> +
>>> +     buf = kvmalloc(len + 1, GFP_KERNEL);
>>> +     if (!buf)
>>> +             return -ENOMEM;
>>> +
>>> +     if (copy_from_user(buf, src, len)) {
>>> +             kvfree(buf);
>>> +             return -EFAULT;
>>> +     }
>>> +
>>> +     if (!set_mm_walk(NULL)) {
>>
>> The current->reclaim_state will be dereferenced in set_mm_walk(), so
>> calling set_mm_walk() before set_task_reclaim_state(current,
>> &sc.reclaim_state) will cause panic:
>>
>> [ 1861.154916] BUG: kernel NULL pointer dereference, address:
>> 0000000000000008
> 
> Thanks.
> 
> Apparently I shot myself in the foot by one of the nits between v11 and v12.
> 
>>> +             kvfree(buf);
>>> +             return -ENOMEM;
>>> +     }
>>> +
>>> +     set_task_reclaim_state(current, &sc.reclaim_state);
>>> +     flags = memalloc_noreclaim_save();
>>> +     blk_start_plug(&plug);
>>> +
>>> +     next = buf;
>>> +     next[len] = '\0';
>>> +
>>> +     while ((cur = strsep(&next, ",;\n"))) {
>>> +             int n;
>>> +             int end;
>>> +             char cmd;
>>> +             unsigned int memcg_id;
>>> +             unsigned int nid;
>>> +             unsigned long seq;
>>> +             unsigned int swappiness = -1;
>>> +             unsigned long opt = -1;
>>> +
>>> +             cur = skip_spaces(cur);
>>> +             if (!*cur)
>>> +                     continue;
>>> +
>>> +             n = sscanf(cur, "%c %u %u %lu %n %u %n %lu %n", &cmd, &memcg_id, &nid,
>>> +                        &seq, &end, &swappiness, &end, &opt, &end);
>>> +             if (n < 4 || cur[end]) {
>>> +                     err = -EINVAL;
>>> +                     break;
>>> +             }
>>> +
>>> +             err = run_cmd(cmd, memcg_id, nid, seq, &sc, swappiness, opt);
>>> +             if (err)
>>> +                     break;
>>> +     }
>>> +
>>> +     blk_finish_plug(&plug);
>>> +     memalloc_noreclaim_restore(flags);
>>> +     set_task_reclaim_state(current, NULL);
>>> +
>>> +     clear_mm_walk();
>>
>> Ditto, we can't call clear_mm_walk() after
>> set_task_reclaim_state(current, NULL).
>>
>> Maybe it can be modified as follows:
>>
>> diff --git a/mm/vmscan.c b/mm/vmscan.c
>> index 2422edc786eb..552e6ae5243e 100644
>> --- a/mm/vmscan.c
>> +++ b/mm/vmscan.c
>> @@ -5569,12 +5569,12 @@ static ssize_t lru_gen_seq_write(struct file
>> *file, const char __user *src,
>>                   return -EFAULT;
>>           }
>>
>> +       set_task_reclaim_state(current, &sc.reclaim_state);
>>           if (!set_mm_walk(NULL)) {
>>                   kvfree(buf);
>>                   return -ENOMEM;
>>           }
>>
>> -       set_task_reclaim_state(current, &sc.reclaim_state);
> 
> We need a `goto` because otherwise we leave a dangling

Yes, right. With this:

Reviewed-by: Qi Zheng <zhengqi.arch@bytedance.com>

> `current->reclaim_state`. (I swear I had one.)

(I believe :))

-- 
Thanks,
Qi