Received-SPF: pass (google.com: domain of linux-kernel+bounces-124472-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Date: Fri, 29 Mar 2024 12:19:40 +0000
From: Matthew Wilcox <willy@infradead.org>
To: Zhaoyang Huang <huangzhaoyang@gmail.com>
Cc: =?utf-8?B?6buE5pyd6ZizIChaaGFveWFuZyBIdWFuZyk=?= <zhaoyang.huang@unisoc.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	"linux-mm@kvack.org" <linux-mm@kvack.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	=?utf-8?B?5bq357qq5ruoIChTdGV2ZSBLYW5nKQ==?= <Steve.Kang@unisoc.com>
Subject: Re: summarize all information again at bottom//reply: reply: [PATCH]
 mm: fix a race scenario in folio_isolate_lru
Message-ID: <Zgax3EQUiWx4DpC7@casper.infradead.org>
References: <ZgDt9mwN-Py5Y-xr@casper.infradead.org>
 <CAGWkznHO27EpVVpFyKnv-SX-JTYCXQxb0MG+EW07gaupocR4RQ@mail.gmail.com>
 <ZgK91II_eSYY6D2F@casper.infradead.org>
 <CAGWkznGLySzLE17+rCe=UoA26vx=iM375o2zkruKM9ssG05QzA@mail.gmail.com>
 <ZgQRtQ60mrvOUKXo@casper.infradead.org>
 <CAGWkznF3GfCs8odhR-Hue5H8MZ=eXb82V20ZoCCjeoSjAPQ9cw@mail.gmail.com>
 <ZgThg-pzQzRl3ckF@casper.infradead.org>
 <CAGWkznEMCXQSe10E-pbdxk2uFgQO038wH6g=iojtSU6-N+GJdg@mail.gmail.com>
 <ZgV65ercduTnVWCA@casper.infradead.org>
 <CAGWkznG7oyh9D-ozN7zQrpJz3s+N_ra1P=Yw3Nd3B0X=thCAxg@mail.gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <CAGWkznG7oyh9D-ozN7zQrpJz3s+N_ra1P=Yw3Nd3B0X=thCAxg@mail.gmail.com>

On Fri, Mar 29, 2024 at 01:49:05PM +0800, Zhaoyang Huang wrote:
> On Thu, Mar 28, 2024 at 10:12 PM Matthew Wilcox <willy@infradead.org> wrote:
> key steps in brief:
> Thread_truncate get folio to its local fbatch by find_get_entry in step 2
> The refcnt is deducted to 1 which is not as expect as from alloc_pages
> but from thread_truncate's local fbatch in step 7
> Thread_reclaim succeed to isolate the folio by the wrong refcnt(not
> the value but meaning) in step 8
> Thread_truncate hit the VM_BUG_ON in step 9
> 
> all steps:
> Thread_readahead:
> 0. folio = filemap_alloc_folio(gfp_mask, 0);
>        (folio has refcount 1)
> 1. ret = filemap_add_folio(mapping, folio, index + i, gfp_mask);
>        (folio has refcount 2)
> 2. thread_truncate hold one refcnt and add this folio to fbatch_truncate
>        (folio has refcount 3(alloc, page cache, fbatch_truncate), PG_lru)
> 3. Then we call read_pages()
>        First we call ->readahead() which for some reason stops early.
> 4. Then we call readahead_folio() which calls folio_put()
>        (folio has refcount 2)
> 5. Then we call folio_get()
>        (folio has refcount 3)
> 6. Then we call filemap_remove_folio()
>        (folio has refcount 2)
> 7. Then we call folio_unlock()
>        Then we call folio_put()
>        (folio has refcount 1(fbatch_truncate))
> 8. thread_reclaim call shrink_inactive_list->isolate_lru_folios
>         shrink_inactive_list
>             isolate_lru_folios
>                if (!folio_test_lru(folio))
>                if (!folio_try_get(folio))
>                if (!folio_test_clear_lru(folio))
>                list_move(folio, dst)
>        (folio has refcount 2)
> 
> 8.1. thread_reclaim call shrink_folio_list->__remove_mapping
>     shrink_folio_list()
>         __remove_mapping()
>              (refcount = 2)
>             if (!folio_ref_freeze(2)) //true
>          list_add(folio, free_folios);
>        (folio has refcount 0)
> 
> 9. thread_truncate will hit the refcnt VM_BUG_ON(refcnt == 0) in
> folio_put_testzero

But now you're talking about something _entirely different_ that isn't
the bug you hit.  isolate_lru_folios is not isolate_lru_folio.

I am disinclined to pick through this example to find out why you're
wrong again.  I'm also disinclined to continue this correspondance.
We're not making any progress here.