Received-SPF: pass (google.com: domain of linux-kernel+bounces-109781-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Precedence: bulk
MIME-Version: 1.0
References: <be75859d7e4245939d825da5e881902c@BJMBX01.spreadtrum.com>
 <Zfg0WLrcOmCtdn_M@casper.infradead.org> <CAGWkznGhiuzkqfeewNq-ykKehvFTBjH2v_==xAS2_7iFqsFk5A@mail.gmail.com>
 <Zfj_-LbiIsAVWcPX@casper.infradead.org>
In-Reply-To: <Zfj_-LbiIsAVWcPX@casper.infradead.org>
From: Zhaoyang Huang <huangzhaoyang@gmail.com>
Date: Thu, 21 Mar 2024 16:25:07 +0800
Message-ID: <CAGWkznHOWVPpKHOuvvDF2zppkTT0_x4WyJ5S75j+EghhZmEDdg@mail.gmail.com>
Subject: Re: summarize all information again at bottom//reply: reply: [PATCH]
 mm: fix a race scenario in folio_isolate_lru
To: Matthew Wilcox <willy@infradead.org>
Cc: =?UTF-8?B?6buE5pyd6ZizIChaaGFveWFuZyBIdWFuZyk=?= <zhaoyang.huang@unisoc.com>, 
	Andrew Morton <akpm@linux-foundation.org>, "linux-mm@kvack.org" <linux-mm@kvack.org>, 
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, 
	=?UTF-8?B?5bq357qq5ruoIChTdGV2ZSBLYW5nKQ==?= <Steve.Kang@unisoc.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, Mar 19, 2024 at 11:01=E2=80=AFAM Matthew Wilcox <willy@infradead.or=
g> wrote:
>
> On Tue, Mar 19, 2024 at 08:48:42AM +0800, Zhaoyang Huang wrote:
> > BTW, damon_pa_pageout is a potential risk over this race
>
> No it isn't.
>
>                struct folio *folio =3D damon_get_folio(PHYS_PFN(addr));
>
>                 if (!folio)
>                         continue;
>
>                 if (damos_pa_filter_out(s, folio))
>                         goto put_folio;
>
>                 folio_clear_referenced(folio);
>                 folio_test_clear_young(folio);
>                 if (!folio_isolate_lru(folio))
>                         goto put_folio;
>                 if (folio_test_unevictable(folio))
>                         folio_putback_lru(folio);
>                 else
>                         list_add(&folio->lru, &folio_list);
> put_folio:
>                 folio_put(folio);
>
> It clearly has a folio reference when it calls folio_isolate_lru().

ok. Could the scenario below be suspicious on leaving an orphan folio
in step 7 and introduce the bug in step 8. In the scenario,
Thread_filemap behaves as a backdoor for Thread_madv by creating the
pte after Thread_truncate finishes cleaning all page tables.

0. Thread_bad gets the folio by folio_get_entry and stores it in its
local fbatch_bad and go to sleep

1. Thread_filemap get the folio via
filemap_map_pages->next_uptodate_folio->xas_next_entry and gets
preempted
    refcnt =3D=3D 1(page_cache), PG_lru =3D=3D true

2. Thread_truncate get the folio via
truncate_inode_pages_range->find_lock_entries
    refcnt =3D=3D 2(fbatch_trunc, page_cache), PG_lru =3D=3D true

3. Thread_truncate proceed to truncate_cleanup_folio
    refcnt =3D=3D 2(fbatch_trunc, page_cache), PG_lru =3D=3D true

4. Thread_truncate proceed to delete_from_page_cache_batch
    refcnt =3D=3D 1(fbatch_trunc), PG_lru =3D=3D true

5. Thread_filemap schedule back and proceed to setup a pte and have
folio->_mapcnt =3D 0 & folio->refcnt +=3D 1
    refcnt =3D=3D 2(pte, fbatch_temp), PG_lru =3D=3D true

6. Thread_madv clear folio's PG_lru by
madvise_xxx_pte_range->folio_isolate_lru->folio_test_clear_lru
    refcnt =3D=3D 2(pte,fbatch_temp), PG_lru =3D=3D false

7. Thread_truncate call folio_fbatch_release and failed in freeing
folio as refcnt not reach 0
    refcnt =3D=3D 1(pte), PG_lru =3D=3D false
********folio becomes an orphan here which is not on the page cache
but on the task's VM**********

8. Thread_xxx scheduled back from 0 to do release_pages(fbatch_bad)
and have the folio introduce the bug.