From 5cecdaebbfd029f827e8032f723d34fe2d0a1c1b Mon Sep 17 00:00:00 2001 From: Minchan Kim Date: Mon, 9 May 2022 10:18:31 -0700 Subject: [PATCH] FROMLIST: BACKPORT: mm: fix is_pinnable_page against on cma page Pages on CMA area could have MIGRATE_ISOLATE as well as MIGRATE_CMA so current is_pinnable_page could miss CMA pages which has MIGRATE_ ISOLATE. It ends up pinning CMA pages as longterm at pin_user_pages APIs so CMA allocation keep failed until the pin is released. CPU 0 CPU 1 - Task B cma_alloc alloc_contig_range pin_user_pages_fast(FOLL_LONGTERM) change pageblock as MIGRATE_ISOLATE internal_get_user_pages_fast lockless_pages_from_mm gup_pte_range try_grab_folio is_pinnable_page return true; So, pinned the page successfully. page migration failure with pinned page .. .. After 30 sec unpin_user_page(page) CMA allocation succeeded after 30 sec. The CMA allocation path protects the migration type change race using zone->lock but what GUP path need to know is just whether the page is on CMA area or not rather than exact migration type. Thus, we don't need zone->lock but just checks migration type in either of (MIGRATE_ISOLATE and MIGRATE_CMA). Adding the MIGRATE_ISOLATE check in is_pinnable_page could cause rejecting of pinning pages on MIGRATE_ISOLATE pageblocks even though it's neither CMA nor movable zone if the page is temporarily unmovable. However, such a migration failure by unexpected temporal refcount holding is general issue, not only come from MIGRATE_ISOLATE and the MIGRATE_ISOLATE is also transient state like other temporal elevated refcount problem. Cc: "Paul E . McKenney" Cc: David Hildenbrand Reviewed-by: John Hubbard Signed-off-by: Minchan Kim Conflicts: include/linux/mm.h 1. There is no is_pinnable_page in 5.10 Link: https://lore.kernel.org/all/20220524171525.976723-1-minchan@kernel.org/ Bug: 231227007 Signed-off-by: Minchan Kim Change-Id: I5cdd2b8eefdd7e89658abd21c32aa84876ad7782 Signed-off-by: Richard Chang (cherry picked from commit e9dd78ebe1c8e9fcc4067e0795326495a16a9c9b) --- include/linux/mmzone.h | 6 +++++- mm/page_alloc.c | 8 ++++++-- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h index a2e8a6df7baa..4563cf0626a1 100644 --- a/include/linux/mmzone.h +++ b/include/linux/mmzone.h @@ -75,7 +75,11 @@ extern const char * const migratetype_names[MIGRATE_TYPES]; #ifdef CONFIG_CMA # define is_migrate_cma(migratetype) unlikely((migratetype) == MIGRATE_CMA) -# define is_migrate_cma_page(_page) (get_pageblock_migratetype(_page) == MIGRATE_CMA) +# define is_migrate_cma_page(_page) ({ \ + int mt = get_pageblock_migratetype(_page); \ + bool ret = (mt == MIGRATE_ISOLATE || mt == MIGRATE_CMA) ? true : false; \ + ret; \ +}) # define get_cma_migrate_type() MIGRATE_CMA #else # define is_migrate_cma(migratetype) false diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 644cf26c38aa..0a9bc8437aa7 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -480,8 +480,12 @@ unsigned long __get_pfnblock_flags_mask(const struct page *page, bitidx = pfn_to_bitidx(page, pfn); word_bitidx = bitidx / BITS_PER_LONG; bitidx &= (BITS_PER_LONG-1); - - word = bitmap[word_bitidx]; + /* + * This races, without locks, with set_pfnblock_flags_mask(). Ensure + * a consistent read of the memory array, so that results, even though + * racy, are not corrupted. + */ + word = READ_ONCE(bitmap[word_bitidx]); return (word >> bitidx) & mask; }