On Wed, Dec 22, 2021 at 09:49:18AM +0800, Liu Shixin wrote:

On 2021/12/22 8:37, Naoya Horiguchi wrote:

quoted

On Tue, Dec 21, 2021 at 03:49:08PM +0800, Liu Shixin wrote:

quoted

Hulk Robot reported a panic in put_page_testzero() when testing madvise()
with MADV_SOFT_OFFLINE. The BUG() is triggered when retrying get_any_page().
This is because we keep MF_COUNT_INCREASED flag in second try but the refcnt
is not increased.

Hi Shixin, 

Thanks you for the report.

I'm not still sure about the logic behind the bug.
madvise(MADV_SOFT_OFFLINE) should not work on free pages because
madvise_inject_error() pins the target page with get_user_pages_fast()
(MF_COUNT_INCREASED means refcount is incremented by the caller).
The retry logic can be called when soft_offline_free_page() fails, so
the logic assumes that the target page is a free page.  So why does
clearing MF_COUNT_INCREASED affect and solve the issue?

It seems to me that if soft_offline_page() is called on a free page
with MF_COUNT_INCREASED set, then it's problematic itself.

Thanks,
Naoya Horiguchi

The page is not free when soft_offline_page() is called. In get_any_page(),
if MF_COUNT_INCREASED is set and !HWPoisonHandlable(page), put_page()
will be called firstly and then goto try_again. The page is freed in this period.

Okay, the logic is clear to me now.

quoted

quoted

Fixes: b94e02822deb ("mm,hwpoison: try to narrow window race for free pages")
Reported-by: Hulk Robot <redacted>
Signed-off-by: Liu Shixin <redacted>

Thank you very much.

Acked-by: Naoya Horiguchi <redacted>

quoted

quoted

---
 mm/memory-failure.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 68d9a35f8908..160526f83bcb 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c

@@ -2288,6 +2288,7 @@ int soft_offline_page(unsigned long pfn, int flags)
 	} else if (ret == 0) {
 		if (soft_offline_free_page(page) && try_again) {
 			try_again = false;
+			flags &= ~MF_COUNT_INCREASED;
 			goto retry;
 		}
 	}

-- 
2.25.1

.