Received-SPF: pass (google.com: domain of linux-kernel+bounces-110898-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Date: Fri, 22 Mar 2024 03:20:28 +0000
From: Matthew Wilcox <willy@infradead.org>
To: Zhaoyang Huang <huangzhaoyang@gmail.com>
Cc: =?utf-8?B?6buE5pyd6ZizIChaaGFveWFuZyBIdWFuZyk=?= <zhaoyang.huang@unisoc.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	"linux-mm@kvack.org" <linux-mm@kvack.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	=?utf-8?B?5bq357qq5ruoIChTdGV2ZSBLYW5nKQ==?= <Steve.Kang@unisoc.com>
Subject: Re: summarize all information again at bottom//reply: reply: [PATCH]
 mm: fix a race scenario in folio_isolate_lru
Message-ID: <Zfz4_GJAHRInB8ul@casper.infradead.org>
References: <be75859d7e4245939d825da5e881902c@BJMBX01.spreadtrum.com>
 <Zfg0WLrcOmCtdn_M@casper.infradead.org>
 <CAGWkznGhiuzkqfeewNq-ykKehvFTBjH2v_==xAS2_7iFqsFk5A@mail.gmail.com>
 <Zfj_-LbiIsAVWcPX@casper.infradead.org>
 <CAGWkznHOWVPpKHOuvvDF2zppkTT0_x4WyJ5S75j+EghhZmEDdg@mail.gmail.com>
 <ZfwpuRjAZV07_lc3@casper.infradead.org>
 <CAGWkznFtez1fj2L2CtFnA5k-Tn4WtxmDOw=fjOWPg-ZGJX=VWw@mail.gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAGWkznFtez1fj2L2CtFnA5k-Tn4WtxmDOw=fjOWPg-ZGJX=VWw@mail.gmail.com>

On Fri, Mar 22, 2024 at 09:52:36AM +0800, Zhaoyang Huang wrote:
> Thanks for the comments. fix the typo and update the timing sequence
> by amending possible preempt points to have the refcnt make sense.
> 
> 0. Thread_bad gets the folio by find_get_entry and preempted before
> take refcnt(could be the second round scan of
> truncate_inode_pages_range)
>     refcnt == 1(page_cache), PG_lru == true, PG_lock == false
>     find_get_entry
>         folio = xas_find
>         <preempted>
>         folio_try_get_rcu
> 
> 1. Thread_filemap get the folio via
> filemap_map_pages->next_uptodate_folio->xas_next_entry and gets preempted
>     refcnt == 1(page_cache), PG_lru == true, PG_lock == false
>     filemap_map_pages
>         next_uptodate_folio
>            xas_next_entry
>            <preempted>
>            folio_try_get_rcu
> 
> 2. Thread_truncate get the folio via
> truncate_inode_pages_range->find_lock_entries
>     refcnt == 2(page_cache, fbatch_truncate), PG_lru == true, PG_lock == true
> 
> 3. Thread_truncate proceed to truncate_cleanup_folio
>     refcnt == 2(page_cache, fbatch_truncate), PG_lru == true, PG_lock == true
> 
> 4. Thread_truncate proceed to delete_from_page_cache_batch
>     refcnt == 1(fbatch_truncate), PG_lru == true, PG_lock == true
> 
> 4.1 folio_unlock
>     refcnt == 1(fbatch_truncate), PG_lru == true, PG_lock == false

OK, so by the time we get to folio_unlock(), the folio has been removed
from the i_pages xarray.

> 5. Thread_filemap schedule back from '1' and proceed to setup a pte
> and have folio->_mapcnt = 0 & folio->refcnt += 1
>     refcnt == 1->2(+fbatch_filemap)->3->2(pte, fbatch_truncate),
> PG_lru == true, PG_lock == true->false

This line succeeds (in next_uptodate_folio):
                if (!folio_try_get_rcu(folio))
                        continue;
but then this fails:

                if (unlikely(folio != xas_reload(xas)))
                        goto skip;
skip:
                folio_put(folio);

because xas_reload() will return NULL due to the folio being deleted
in step 4.  So we never get to the point where we set up a PTE.

There should be no way to create a new PTE for a folio which has been
removed from the page cache.  Bugs happen, of course, but I don't see
one yet.

> 6. Thread_madv clear folio's PG_lru by
> madvise_xxx_pte_range->folio_isolate_lru->folio_test_clear_lru
>     refcnt == 2(pte,fbatch_truncate), PG_lru == false, PG_lock == false
> 
> 7. Thread_truncate call folio_fbatch_release and failed in freeing
> folio as refcnt not reach 0
>     refcnt == 1(pte), PG_lru == false, PG_lock == false
> ********folio becomes an orphan here which is not on the page cache
> but on the task's VM**********
> 
> 8. Thread_bad scheduled back from '0' to be collected in fbatch_bad
>     refcnt == 2(pte, fbatch_bad), PG_lru == false, PG_lock == true
> 
> 9. Thread_bad clear one refcnt wrongly when doing filemap_remove_folio
> as it take this refcnt as the page cache one
>     refcnt == 1(fbatch_bad), PG_lru == false, PG_lock == true->false
>     truncate_inode_folio
>         filemap_remove_folio
>              filemap_free_folio
> ******refcnt decreased wrongly here by being taken as the page cache one ******
> 
> 10. Thread_bad calls release_pages(fbatch_bad) and has the folio
> introduce the bug.
>     release_pages
>         folio_put_testzero == true
>         folio_test_lru == false
>         list_add(folio->lru, pages_to_free)