Received-SPF: pass (google.com: domain of linux-kernel+bounces-110039-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Thu, 21 Mar 2024 12:36:09 +0000
From: Matthew Wilcox <willy@infradead.org>
To: Zhaoyang Huang <huangzhaoyang@gmail.com>
Cc: =?utf-8?B?6buE5pyd6ZizIChaaGFveWFuZyBIdWFuZyk=?= <zhaoyang.huang@unisoc.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	"linux-mm@kvack.org" <linux-mm@kvack.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	=?utf-8?B?5bq357qq5ruoIChTdGV2ZSBLYW5nKQ==?= <Steve.Kang@unisoc.com>
Subject: Re: summarize all information again at bottom//reply: reply: [PATCH]
 mm: fix a race scenario in folio_isolate_lru
Message-ID: <ZfwpuRjAZV07_lc3@casper.infradead.org>
References: <be75859d7e4245939d825da5e881902c@BJMBX01.spreadtrum.com>
 <Zfg0WLrcOmCtdn_M@casper.infradead.org>
 <CAGWkznGhiuzkqfeewNq-ykKehvFTBjH2v_==xAS2_7iFqsFk5A@mail.gmail.com>
 <Zfj_-LbiIsAVWcPX@casper.infradead.org>
 <CAGWkznHOWVPpKHOuvvDF2zppkTT0_x4WyJ5S75j+EghhZmEDdg@mail.gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAGWkznHOWVPpKHOuvvDF2zppkTT0_x4WyJ5S75j+EghhZmEDdg@mail.gmail.com>

On Thu, Mar 21, 2024 at 04:25:07PM +0800, Zhaoyang Huang wrote:
> ok. Could the scenario below be suspicious on leaving an orphan folio
> in step 7 and introduce the bug in step 8. In the scenario,
> Thread_filemap behaves as a backdoor for Thread_madv by creating the
> pte after Thread_truncate finishes cleaning all page tables.
> 
> 0. Thread_bad gets the folio by folio_get_entry and stores it in its
> local fbatch_bad and go to sleep

There's no function called folio_get_entry(), but clearly thread_bad
should have a refcount on it at this point.

> 1. Thread_filemap get the folio via
> filemap_map_pages->next_uptodate_folio->xas_next_entry and gets
> preempted
>     refcnt == 1(page_cache), PG_lru == true

so the refcount should be 2 here.

> 2. Thread_truncate get the folio via
> truncate_inode_pages_range->find_lock_entries
>     refcnt == 2(fbatch_trunc, page_cache), PG_lru == true
> 
> 3. Thread_truncate proceed to truncate_cleanup_folio
>     refcnt == 2(fbatch_trunc, page_cache), PG_lru == true
> 
> 4. Thread_truncate proceed to delete_from_page_cache_batch
>     refcnt == 1(fbatch_trunc), PG_lru == true
> 
> 5. Thread_filemap schedule back and proceed to setup a pte and have
> folio->_mapcnt = 0 & folio->refcnt += 1
>     refcnt == 2(pte, fbatch_temp), PG_lru == true
> 
> 6. Thread_madv clear folio's PG_lru by
> madvise_xxx_pte_range->folio_isolate_lru->folio_test_clear_lru
>     refcnt == 2(pte,fbatch_temp), PG_lru == false
> 
> 7. Thread_truncate call folio_fbatch_release and failed in freeing
> folio as refcnt not reach 0
>     refcnt == 1(pte), PG_lru == false
> ********folio becomes an orphan here which is not on the page cache
> but on the task's VM**********
> 
> 8. Thread_xxx scheduled back from 0 to do release_pages(fbatch_bad)
> and have the folio introduce the bug.

.. because if these steps happen as 7, 8, 6, you hit the BUG in
folio_isolate_lru().