Received-SPF: pass (google.com: domain of linux-kernel+bounces-196202-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Received-SPF: Pass (protection.outlook.com: domain of oppo.com designates
 58.252.5.68 as permitted sender) receiver=protection.outlook.com;
 client-ip=58.252.5.68; helo=mail.oppo.com; pr=C
Message-ID: <6de9688d-00e4-49f6-9a6b-c53f447bed20@oppo.com>
Date: Fri, 31 May 2024 10:53:16 +0800
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [RFC PATCH] mm/vmalloc: fix vbq->free breakage
To: Andrew Morton <akpm@linux-foundation.org>
CC: <urezki@gmail.com>, <hch@infradead.org>, <lstoakes@gmail.com>,
	<21cnbao@gmail.com>, <linux-mm@kvack.org>, <linux-kernel@vger.kernel.org>,
	<xiang@kernel.org>, <guangye.yang@mediatek.com>, <zhaoyang.huang@unisoc.com>,
	"Hailong . Liu" <liuhailong@oppo.com>
References: <20240530093108.4512-1-hailong.liu@oppo.com>
 <20240530130318.2a78c0797c352a4d38cfb2c1@linux-foundation.org>
Content-Language: en-US
From: Hailong Liu <hailong.liu@oppo.com>
In-Reply-To: <20240530130318.2a78c0797c352a4d38cfb2c1@linux-foundation.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 May 2024 02:53:51.6819
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 1e01115e-e8b4-4cb2-2e5b-08dc811ce73d
X-MS-Exchange-CrossTenant-Id: f1905eb1-c353-41c5-9516-62b4a54b5ee6
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f1905eb1-c353-41c5-9516-62b4a54b5ee6;Ip=[58.252.5.68];Helo=[mail.oppo.com]
X-MS-Exchange-CrossTenant-AuthSource:
	HK3PEPF0000021C.apcprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2PR02MB5903

On 5/31/2024 4:03 AM, Andrew Morton wrote:
> On Thu, 30 May 2024 17:31:08 +0800 <hailong.liu@oppo.com> wrote:
> 
>> From: "hailong.liu" <hailong.liu@oppo.com>
>>
>> The function xa_for_each() in _vm_unmap_aliases() loops through all
>> vbs. However, since commit 062eacf57ad9 ("mm: vmalloc: remove a global
>> vmap_blocks xarray") the vb from xarray may not be on the corresponding
>> CPU vmap_block_queue. Consequently, purge_fragmented_block() might
>> use the wrong vbq->lock to protect the free list, leading to vbq->free
>> breakage.
> 
> What are the userspace-visible runtime effects of this change?
> 
>>
>> diff --git a/mm/vmalloc.c b/mm/vmalloc.c
>> index d12a17fc0c17..869e7788a7d5 100644
>> --- a/mm/vmalloc.c
>> +++ b/mm/vmalloc.c
>> @@ -2269,10 +2269,9 @@ static void _vm_unmap_aliases(unsigned long start, unsigned long end, int flush)
>>  	for_each_possible_cpu(cpu) {
>>  		struct vmap_block_queue *vbq = &per_cpu(vmap_block_queue, cpu);
>>  		struct vmap_block *vb;
>> -		unsigned long idx;
>>
>>  		rcu_read_lock();
>> -		xa_for_each(&vbq->vmap_blocks, idx, vb) {
>> +		list_for_each_entry_rcu(vb, &vbq->free, free_list) {
>>  			spin_lock(&vb->lock);
>>
>>  			/*
>> ---
>> https://lore.kernel.org/all/20240530025144.1570865-1-zhaoyang.huang@unisoc.com/
>> BTW, zhangyang also encounter the same issue, maybe revert commit not a
>> better solution. we need a map to get vbq from vb.
> 
> That patch didn't describe the runtime effects either.
> 
> Folks, please always do this.  So that others can decide whether their
> kernel needs the fix, and so that others can decide whether this fix
> might address an issue which their users are reporting.

Thanks for suggestion. I send v2 in 
https://lore.kernel.org/lkml/20240531024820.5507-1-hailong.liu@oppo.com/T/#u

I promise to make my future commit messages comprehensive, in order to help others.

Brs,
Hailong.