On Tue, Feb 23, 2021 at 06:27:07PM +0800, Muchun Song wrote:
> > > > +
> > > > + if (alloc_huge_page_vmemmap(h, page)) {
> > > > + int zeroed;
> > > > +
> > > > + spin_lock(&hugetlb_lock);
> > > > + INIT_LIST_HEAD(&page->lru);
> > > > + set_compound_page_dtor(page, HUGETLB_PAGE_DTOR);
> > > > + h->nr_huge_pages++;
> > > > + h->nr_huge_pages_node[nid]++;
> >
> > I think prep_new_huge_page() does this for us?
>
> Actually, there are some differences. e.g. prep_new_huge_page()
> will reset hugetlb cgroup and ClearHPageFreed, but we do not need
> them here. And prep_new_huge_page will acquire and release
> the hugetlb_lock. But here we also need hold the lock to update
> the surplus counter and enqueue the page to the free list.
> So I do not think reuse prep_new_huge_page is a good idea.
I see, I missed that.
> > Can this actually happen? AFAIK, page landed in update_and_free_page should be
> > zero refcounted, then we increase the reference, and I cannot see how the
> > reference might have changed in the meantime.
>
> I am not sure whether other modules get the page and then put the
> page. I see gather_surplus_pages does the same thing. So I copied
> from there. I try to look at the memory_failure routine.
>
>
> CPU0: CPU1:
> set_compound_page_dtor(HUGETLB_PAGE_DTOR);
> memory_failure_hugetlb
> get_hwpoison_page
> __get_hwpoison_page
> get_page_unless_zero
> put_page_testzero()
>
> Maybe this can happen. But it is a very corner case. If we want to
> deal with this. We can put_page_testzero() first and then
> set_compound_page_dtor(HUGETLB_PAGE_DTOR).
I have to check further, but it looks like this could actually happen.
Handling this with VM_BUG_ON is wrong, because memory_failure/soft_offline are
entitled to increase the refcount of the page.
AFAICS,
CPU0: CPU1:
set_compound_page_dtor(HUGETLB_PAGE_DTOR);
memory_failure_hugetlb
get_hwpoison_page
__get_hwpoison_page
get_page_unless_zero
put_page_testzero()
identify_page_state
me_huge_page
I think we can reach me_huge_page with either refcount = 1 or refcount =2,
depending whether put_page_testzero has been issued.
For now, I would not re-enqueue the page if put_page_testzero == false.
I have to see how this can be handled gracefully.
--
Oscar Salvador
SUSE L3
