Date:   Wed, 1 Feb 2023 10:41:48 +0900
From:   Sergey Senozhatsky <senozhatsky@chromium.org>
To:     Nhat Pham <nphamcs@gmail.com>
Cc:     akpm@linux-foundation.org, hannes@cmpxchg.org, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org, minchan@kernel.org,
        ngupta@vflare.org, senozhatsky@chromium.org, sjenning@redhat.com,
        ddstreet@ieee.org, vitaly.wool@konsulko.com, kernel-team@meta.com
Subject: Re: [PATCH] zsmalloc: fix a race with deferred_handles storing
Message-ID: <Y9nDXBt2OR3hg5X7@google.com>
References: <20230110231701.326724-1-nphamcs@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230110231701.326724-1-nphamcs@gmail.com>
Precedence: bulk

On (23/01/10 15:17), Nhat Pham wrote:
[..]
>  #ifdef CONFIG_ZPOOL
> +static void restore_freelist(struct zs_pool *pool, struct size_class *class,
> +		struct zspage *zspage)
> +{
> +	unsigned int obj_idx = 0;
> +	unsigned long handle, off = 0; /* off is within-page offset */
> +	struct page *page = get_first_page(zspage);
> +	struct link_free *prev_free = NULL;
> +	void *prev_page_vaddr = NULL;
> +
> +	/* in case no free object found */
> +	set_freeobj(zspage, (unsigned int)(-1UL));

I'm not following this. I see how -1UL works for link_free, but this
cast of -1UL to 4 bytes looks suspicious.

> +	while (page) {
> +		void *vaddr = kmap_atomic(page);
> +		struct page *next_page;
> +
> +		while (off < PAGE_SIZE) {
> +			void *obj_addr = vaddr + off;
> +
> +			/* skip allocated object */
> +			if (obj_allocated(page, obj_addr, &handle)) {
> +				obj_idx++;
> +				off += class->size;
> +				continue;
> +			}
> +
> +			/* free deferred handle from reclaim attempt */
> +			if (obj_stores_deferred_handle(page, obj_addr, &handle))
> +				cache_free_handle(pool, handle);
> +
> +			if (prev_free)
> +				prev_free->next = obj_idx << OBJ_TAG_BITS;
> +			else /* first free object found */
> +				set_freeobj(zspage, obj_idx);
> +
> +			prev_free = (struct link_free *)vaddr + off / sizeof(*prev_free);
> +			/* if last free object in a previous page, need to unmap */
> +			if (prev_page_vaddr) {
> +				kunmap_atomic(prev_page_vaddr);
> +				prev_page_vaddr = NULL;
> +			}
> +
> +			obj_idx++;
> +			off += class->size;
> +		}
> +
> +		/*
> +		 * Handle the last (full or partial) object on this page.
> +		 */
> +		next_page = get_next_page(page);
> +		if (next_page) {
> +			if (!prev_free || prev_page_vaddr) {
> +				/*
> +				 * There is no free object in this page, so we can safely
> +				 * unmap it.
> +				 */
> +				kunmap_atomic(vaddr);
> +			} else {
> +				/* update prev_page_vaddr since prev_free is on this page */
> +				prev_page_vaddr = vaddr;
> +			}

A polite and gentle nit: I'd appreciate it if we honored kernel coding
styles in zsmalloc a little bit more. Comments, function declarations, etc.
I'm personally very happy with https://github.com/vivien/vim-linux-coding-style