On Thu, Aug 29, 2024 at 06:12:26PM -0400, Zi Yan wrote: > The issue is that the change to split_huge_page() makes split_huge_page_to_list_to_order() > unlocks the wrong subpage. split_huge_page() used to pass the “page” pointer > to split_huge_page_to_list_to_order(), which keeps that “page” still locked. > But this patch changes the “page” passed into split_huge_page_to_list_to_order() > always to the head page. > > This fixes the crash on my x86 VM, but it can be improved: > > diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h > index 7c50aeed0522..eff5d2fb5d4e 100644 > --- a/include/linux/huge_mm.h > +++ b/include/linux/huge_mm.h > @@ -320,10 +320,7 @@ bool can_split_folio(struct folio *folio, int *pextra_pins); > int split_huge_page_to_list_to_order(struct page *page, struct list_head *list, > unsigned int new_order); > int split_folio_to_list(struct folio *folio, struct list_head *list); > -static inline int split_huge_page(struct page *page) > -{ > - return split_folio(page_folio(page)); > -} > +int split_huge_page(struct page *page); > void deferred_split_folio(struct folio *folio); > > void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, > diff --git a/mm/huge_memory.c b/mm/huge_memory.c > index c29af9451d92..4d723dab4336 100644 > --- a/mm/huge_memory.c > +++ b/mm/huge_memory.c > @@ -3297,6 +3297,25 @@ int split_huge_page_to_list_to_order(struct page *page, struct list_head *list, > return ret; > } > > +int split_huge_page(struct page *page) > +{ > + unsigned int min_order = 0; > + struct folio *folio = page_folio(page); > + > + if (folio_test_anon(folio)) > + goto out; > + > + if (!folio->mapping) { > + if (folio_test_pmd_mappable(folio)) > + count_vm_event(THP_SPLIT_PAGE_FAILED); > + return -EBUSY; > + } > + > + min_order = mapping_min_folio_order(folio->mapping); > +out: > + return split_huge_page_to_list_to_order(page, NULL, min_order); > +} > + > int split_folio_to_list(struct folio *folio, struct list_head *list) > { > unsigned int min_order = 0; Confirmed, and also although you suggest it can be improved, I thought that we could do that by sharing more code and putting things in the headers, the below also fixes this but tries to share more code, but I think it is perhaps less easier to understand than your patch. So I think your patch is cleaner and easier as a fix. diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index c275aa9cc105..99cd9c7bf55b 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -97,6 +97,7 @@ extern struct kobj_attribute thpsize_shmem_enabled_attr; (!!thp_vma_allowable_orders(vma, vm_flags, tva_flags, BIT(order))) #define split_folio(f) split_folio_to_list(f, NULL) +#define split_folio_to_list(f, list) split_page_folio_to_list(&f->page, f, list) #ifdef CONFIG_PGTABLE_HAS_HUGE_LEAVES #define HPAGE_PMD_SHIFT PMD_SHIFT @@ -331,10 +332,11 @@ unsigned long thp_get_unmapped_area_vmflags(struct file *filp, unsigned long add bool can_split_folio(struct folio *folio, int caller_pins, int *pextra_pins); int split_huge_page_to_list_to_order(struct page *page, struct list_head *list, unsigned int new_order); -int split_folio_to_list(struct folio *folio, struct list_head *list); +int split_page_folio_to_list(struct page *page, struct folio *folio, + struct list_head *list); static inline int split_huge_page(struct page *page) { - return split_folio(page_folio(page)); + return split_page_folio_to_list(page, page_folio(page), NULL); } void deferred_split_folio(struct folio *folio); @@ -511,7 +513,9 @@ static inline int split_huge_page(struct page *page) return 0; } -static inline int split_folio_to_list(struct folio *folio, struct list_head *list) +static inline int split_page_folio_to_list(struct page *page, + struct folio *folio, + struct list_head *list) { return 0; } diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 169f1a71c95d..b115bfe63b52 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -3529,7 +3529,8 @@ int split_huge_page_to_list_to_order(struct page *page, struct list_head *list, return ret; } -int split_folio_to_list(struct folio *folio, struct list_head *list) +int split_page_folio_to_list(struct page *page, struct folio *folio, + struct list_head *list) { unsigned int min_order = 0; @@ -3544,8 +3545,7 @@ int split_folio_to_list(struct folio *folio, struct list_head *list) min_order = mapping_min_folio_order(folio->mapping); out: - return split_huge_page_to_list_to_order(&folio->page, list, - min_order); + return split_huge_page_to_list_to_order(page, list, min_order); } void __folio_undo_large_rmappable(struct folio *folio)