On Tue, Mar 23, 2021 at 03:02:32PM -0400, Johannes Weiner wrote: > >From f6f062a3ec46f4fb083dcf6792fde9723f18cfc5 Mon Sep 17 00:00:00 2001 > From: Johannes Weiner <hannes@xxxxxxxxxxx> > Date: Fri, 19 Mar 2021 02:17:00 -0400 > Subject: [PATCH] mm: page_alloc: fix allocation imbalances from speculative > cache lookup > > When the freeing of a higher-order page block (non-compound) races > with a speculative page cache lookup, __free_pages() needs to leave > the first order-0 page in the chunk to the lookup but free the buddy > pages that the lookup doesn't know about separately. > > There are currently two problems with it: > > 1. It checks PageHead() to see whether we're dealing with a compound > page after put_page_testzero(). But the speculative lookup could > have freed the page after our put and cleared PageHead, in which > case we would double free the tail pages. > > To fix this, test PageHead before the put and cache the result for > afterwards. > > 2. If such a higher-order page is charged to a memcg (e.g. !vmap > kernel stack)), only the first page of the block has page->memcg > set. That means we'll uncharge only one order-0 page from the > entire block, and leak the remainder. > > To fix this, add a split_page_memcg() before it starts freeing tail > pages, to ensure they all have page->memcg set up. > > While at it, also update the comments a bit to clarify what exactly is > happening to the page during that race. > > Fixes: e320d3012d25 mm/page_alloc.c: fix freeing non-compound pages > Reported-by: Hugh Dickins <hughd@xxxxxxxxxx> > Reported-by: Matthew Wilcox <willy@xxxxxxxxxxxxx> > Signed-off-by: Johannes Weiner <hannes@xxxxxxxxxxx> > Cc: <stable@xxxxxxxxxxxxxxx> # 5.10+ This version makes me happy. Reviewed-by: Matthew Wilcox (Oracle) <willy@xxxxxxxxxxxxx> Thanks for fixing my buggy fix.
