[PATCHv2] mm: check high-order page when free it to pcp

Commit Message

zhaoyang.huang Sept. 20, 2022, 12:49 a.m. UTC

From: Zhaoyang Huang <[e-mail]>

High-order pcp page escaped from checking when both of DEBUG_VM and debug_pagealloc
are all disabled if it allocated again from pcp_list without going to global
free list, which should be introduced by 44042b4498.

fix:44042b4498

Signed-off-by: Zhaoyang Huang <[e-mail]>
---
changes of v2: update comments
---
---
 mm/page_alloc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Comments

Mel Gorman Sept. 20, 2022, 8:55 a.m. UTC | #1

On Tue, Sep 20, 2022 at 08:49:00AM +0800, zhaoyang.huang wrote:
> From: Zhaoyang Huang <[e-mail]>
> 
> High-order pcp page escaped from checking when both of DEBUG_VM and debug_pagealloc
> are all disabled if it allocated again from pcp_list without going to global
> free list, which should be introduced by 44042b4498.
> 
> fix:44042b4498
> 
> Signed-off-by: Zhaoyang Huang <[e-mail]>

Why is the order check needed? In this case, I think the comment itself was
wrong and should be corrected. free_pcp_prepare is called when dealing with
a PCP page being freed and these days that may order-0 or high-order pages.
Wieh DEBUG_VM disabled, the pages are checked in by bulkfree_pcp_prepare
when freeing pages from PCP to the core allocator. Why would just
high-order pages be checked in free_pcp_prepare and checked again in
bulkfree_pcp_prepare?

Zhaoyang Huang Sept. 20, 2022, 9:07 a.m. UTC | #2

On Tue, Sep 20, 2022 at 4:55 PM Mel Gorman <[e-mail]> wrote:
>
> On Tue, Sep 20, 2022 at 08:49:00AM +0800, zhaoyang.huang wrote:
> > From: Zhaoyang Huang <[e-mail]>
> >
> > High-order pcp page escaped from checking when both of DEBUG_VM and debug_pagealloc
> > are all disabled if it allocated again from pcp_list without going to global
> > free list, which should be introduced by 44042b4498.
> >
> > fix:44042b4498
> >
> > Signed-off-by: Zhaoyang Huang <[e-mail]>
>
> Why is the order check needed? In this case, I think the comment itself was
> wrong and should be corrected. free_pcp_prepare is called when dealing with
> a PCP page being freed and these days that may order-0 or high-order pages.
> Wieh DEBUG_VM disabled, the pages are checked in by bulkfree_pcp_prepare
> when freeing pages from PCP to the core allocator. Why would just
> high-order pages be checked in free_pcp_prepare and checked again in
> bulkfree_pcp_prepare?
for high-order pcp pages(head page in fact), they might escape from
bulkfree_pcp_prepare if they were allocated from pcp-list
again(pcp->count < high) prior to going to core allocator.
for order-0 pcp pages, they will not be checked at all for the purpose
of reducing overhead.
>
> --
> Mel Gorman
> SUSE Labs

Mel Gorman Sept. 20, 2022, 10:55 a.m. UTC | #3

On Tue, Sep 20, 2022 at 05:07:33PM +0800, Zhaoyang Huang wrote:
> On Tue, Sep 20, 2022 at 4:55 PM Mel Gorman <[e-mail]> wrote:
> >
> > On Tue, Sep 20, 2022 at 08:49:00AM +0800, zhaoyang.huang wrote:
> > > From: Zhaoyang Huang <[e-mail]>
> > >
> > > High-order pcp page escaped from checking when both of DEBUG_VM and debug_pagealloc
> > > are all disabled if it allocated again from pcp_list without going to global
> > > free list, which should be introduced by 44042b4498.
> > >
> > > fix:44042b4498
> > >
> > > Signed-off-by: Zhaoyang Huang <[e-mail]>
> >
> > Why is the order check needed? In this case, I think the comment itself was
> > wrong and should be corrected. free_pcp_prepare is called when dealing with
> > a PCP page being freed and these days that may order-0 or high-order pages.
> > Wieh DEBUG_VM disabled, the pages are checked in by bulkfree_pcp_prepare
> > when freeing pages from PCP to the core allocator. Why would just
> > high-order pages be checked in free_pcp_prepare and checked again in
> > bulkfree_pcp_prepare?
>
> for high-order pcp pages(head page in fact), they might escape from
> bulkfree_pcp_prepare if they were allocated from pcp-list
> again(pcp->count < high) prior to going to core allocator.

This is expected. The DEBUG_VM checks when enabled are more paranoid and are
more likely to catch corruption or a use-after-free issue. For !DEBUG_VM,
there is partial checking which is faster but leaves the possibility that
a corruption of struct page will be missed.

Patch

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index e008a3d..b54976d 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1412,7 +1412,7 @@  static __always_inline bool free_pages_prepare(struct page *page,
 
 #ifdef CONFIG_DEBUG_VM
 /*
- * With DEBUG_VM enabled, order-0 pages are checked immediately when being freed
+ * With DEBUG_VM enabled, pages are checked immediately when being freed
  * to pcp lists. With debug_pagealloc also enabled, they are also rechecked when
  * moved from pcp lists to free lists.
  */
@@ -1430,14 +1430,14 @@  static bool bulkfree_pcp_prepare(struct page *page)
 }
 #else
 /*
- * With DEBUG_VM disabled, order-0 pages being freed are checked only when
+ * With DEBUG_VM disabled, pages being freed are checked only when
  * moving from pcp lists to free list in order to reduce overhead. With
  * debug_pagealloc enabled, they are checked also immediately when being freed
  * to the pcp lists.
  */
 static bool free_pcp_prepare(struct page *page, unsigned int order)
 {
-	if (debug_pagealloc_enabled_static())
+	if (debug_pagealloc_enabled_static() || order)
 		return free_pages_prepare(page, order, true, FPI_NONE);
 	else
 		return free_pages_prepare(page, order, false, FPI_NONE);