Received-SPF: pass (google.com: domain of linux-kernel+bounces-195852-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Thu, 30 May 2024 13:05:41 -0700
From: Andrew Morton <akpm@linux-foundation.org>
To: <hailong.liu@oppo.com>
Cc: <urezki@gmail.com>, <hch@infradead.org>, <lstoakes@gmail.com>,
 <21cnbao@gmail.com>, <linux-mm@kvack.org>, <linux-kernel@vger.kernel.org>,
 <xiang@kernel.org>, <guangye.yang@mediatek.com>,
 <zhaoyang.huang@unisoc.com>, "Hailong . Liu" <liuhailong@oppo.com>
Subject: Re: [RFC PATCH] mm/vmalloc: fix vbq->free breakage
Message-Id: <20240530130541.c615fcfc1e6f211199315e13@linux-foundation.org>
In-Reply-To: <20240530093108.4512-1-hailong.liu@oppo.com>
References: <20240530093108.4512-1-hailong.liu@oppo.com>
Precedence: bulk
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Thu, 30 May 2024 17:31:08 +0800 <hailong.liu@oppo.com> wrote:

> From: "hailong.liu" <hailong.liu@oppo.com>
> 
> The function xa_for_each() in _vm_unmap_aliases() loops through all
> vbs. However, since commit 062eacf57ad9 ("mm: vmalloc: remove a global
> vmap_blocks xarray") the vb from xarray may not be on the corresponding
> CPU vmap_block_queue. Consequently, purge_fragmented_block() might
> use the wrong vbq->lock to protect the free list, leading to vbq->free
> breakage.
> 
> ...
>
> --- a/mm/vmalloc.c
> +++ b/mm/vmalloc.c
> @@ -2269,10 +2269,9 @@ static void _vm_unmap_aliases(unsigned long start, unsigned long end, int flush)
>  	for_each_possible_cpu(cpu) {
>  		struct vmap_block_queue *vbq = &per_cpu(vmap_block_queue, cpu);
>  		struct vmap_block *vb;
> -		unsigned long idx;
> 
>  		rcu_read_lock();
> -		xa_for_each(&vbq->vmap_blocks, idx, vb) {
> +		list_for_each_entry_rcu(vb, &vbq->free, free_list) {
>  			spin_lock(&vb->lock);
> 
>  			/*
> ---
> https://lore.kernel.org/all/20240530025144.1570865-1-zhaoyang.huang@unisoc.com/
> BTW, zhangyang also encounter the same issue, maybe revert commit not a
> better solution. we need a map to get vbq from vb.

I borrowed the Fixes: from that patch and added cc:stable, pending
confirmation that the runtime effects are significant.