Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 9 Jun 2023 13:02:59 -0700 (PDT)
From:   Hugh Dickins <hughd@google.com>
To:     David Stevens <stevensd@chromium.org>
cc:     linux-mm@kvack.org, Andrew Morton <akpm@linux-foundation.org>,
        Peter Xu <peterx@redhat.com>,
        Matthew Wilcox <willy@infradead.org>,
        "Kirill A . Shutemov" <kirill@shutemov.name>,
        Yang Shi <shy828301@gmail.com>,
        David Hildenbrand <david@redhat.com>,
        Hugh Dickins <hughd@google.com>,
        Jiaqi Yan <jiaqiyan@google.com>, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] mm/khugepaged: fix iteration in collapse_file
In-Reply-To: <20230607053135.2087354-1-stevensd@google.com>
Message-ID: <f18e4b64-3f88-a8ab-56cc-d1f5f9c58d4@google.com>
References: <20230607053135.2087354-1-stevensd@google.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Precedence: bulk

On Wed, 7 Jun 2023, David Stevens wrote:
> 
> Remove an unnecessary call to xas_set(index) when iterating over the
> target range in collapse_file. The extra call to xas_set reset the xas
> cursor to the top of the tree, causing the xas_next call on the next
> iteration to walk the tree to index instead of advancing to index+1.
> This returned the same page again, which would cause collapse_file to
> fail because the page is already locked.
> 
> This bug was hidden when CONFIG_DEBUG_VM was set. When that config was
> used, the xas_load in a subsequent VM_BUG_ON assert would walk xas from
> the top of the tree to index, causing the xas_next call on the next loop
> iteration to advance the cursor as expected.
> 
> Fixes: a2e17cc2efc7 ("mm/khugepaged: maintain page cache uptodate flag")
> Signed-off-by: David Stevens <stevensd@chromium.org>

This patch seems to be wrong, but I have not investigated why.

It's certainly an interesting and worrying observation,
if a CONFIG_DEBUG_VM=y kernel goes a significantly different way.

I almost always do have CONFIG_DEBUG_VM=y, so you won't be surprised that
I never saw the issue.  But once I ran an mm-everything with this patch in,
I hit that VM_BUG_ON_PAGE(page != xas_load(&xas), page) for the first time
(after about 2 hours of huge tmpfs swapping load).

As if you have just transferred the problem from DEBUG_VM=n to DEBUG_VM=y.
But I then tried a CONFIG_DEBUG_VM off 6.4-rc1 kernel (including the fixee
but not this fixer) under similar load, and saw no problem in 14 hours.
So I can't even reproduce the bug that is being fixed here: only hit a
bug that it introduces.

Hugh

> ---
>  mm/khugepaged.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/mm/khugepaged.c b/mm/khugepaged.c
> index 6b9d39d65b73..2d0d58fb4e7f 100644
> --- a/mm/khugepaged.c
> +++ b/mm/khugepaged.c
> @@ -2070,7 +2070,6 @@ static int collapse_file(struct mm_struct *mm, unsigned long addr,
>  					TTU_IGNORE_MLOCK | TTU_BATCH_FLUSH);
>  
>  		xas_lock_irq(&xas);
> -		xas_set(&xas, index);
>  
>  		VM_BUG_ON_PAGE(page != xas_load(&xas), page);
>  
> -- 
> 2.41.0.rc2.161.g9c6817b8e7-goog