On Wed, 8 Dec 2021, Andrey Ryabinin wrote:
> alloc_pages_vma() may try to allocate THP page on the local
> NUMA node first:
> page = __alloc_pages_node(hpage_node,
> gfp | __GFP_THISNODE | __GFP_NORETRY, order);
>
> And if the allocation fails it retries allowing remote memory:
>
> if (!page && (gfp & __GFP_DIRECT_RECLAIM))
> page = __alloc_pages_node(hpage_node,
> gfp, order);
>
> However, this retry allocation completely ignores memory policy
> nodemask allowing allocation to escape restrictions.
>
> The first appearance of this bug seems to be the commit ac5b2c18911f
> ("mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings")
> The bug disappeared later in the commit 89c83fb539f9
> ("mm, thp: consolidate THP gfp handling into alloc_hugepage_direct_gfpmask")
> and reappeared again in slightly different form in the commit 76e654cc91bb
> ("mm, page_alloc: allow hugepage fallback to remote nodes when madvised")
>
> Fix this by passing correct nodemask to the __alloc_pages() call.
>
> The demonstration/reproducer of the problem:
> $ mount -oremount,size=4G,huge=always /dev/shm/
> $ echo always > /sys/kernel/mm/transparent_hugepage/defrag
> $ cat mbind_thp.c
> #include <unistd.h>
> #include <sys/mman.h>
> #include <sys/stat.h>
> #include <fcntl.h>
> #include <assert.h>
> #include <stdlib.h>
> #include <stdio.h>
> #include <numaif.h>
>
> #define SIZE 2ULL << 30
> int main(int argc, char **argv)
> {
> int fd;
> unsigned long long i;
> char *addr;
> pid_t pid;
> char buf[100];
> unsigned long nodemask = 1;
>
> fd = open("/dev/shm/test", O_RDWR|O_CREAT);
> assert(fd > 0);
> assert(ftruncate(fd, SIZE) == 0);
>
> addr = mmap(NULL, SIZE, PROT_READ|PROT_WRITE,
> MAP_SHARED, fd, 0);
>
> assert(mbind(addr, SIZE, MPOL_BIND, &nodemask, 2, MPOL_MF_STRICT|MPOL_MF_MOVE)==0);
> for (i = 0; i < SIZE; i+=4096) {
> addr[i] = 1;
> }
> pid = getpid();
> snprintf(buf, sizeof(buf), "grep shm /proc/%d/numa_maps", pid);
> system(buf);
> sleep(10000);
>
> return 0;
> }
> $ gcc mbind_thp.c -o mbind_thp -lnuma
> $ numactl -H
> available: 2 nodes (0-1)
> node 0 cpus: 0 2
> node 0 size: 1918 MB
> node 0 free: 1595 MB
> node 1 cpus: 1 3
> node 1 size: 2014 MB
> node 1 free: 1731 MB
> node distances:
> node 0 1
> 0: 10 20
> 1: 20 10
> $ rm -f /dev/shm/test; taskset -c 0 ./mbind_thp
> 7fd970a00000 bind:0 file=/dev/shm/test dirty=524288 active=0 N0=396800 N1=127488 kernelpagesize_kB=4
>
> Fixes: ac5b2c18911f ("mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings")
> Signed-off-by: Andrey Ryabinin <arbn@xxxxxxxxxxxxxxx>
> Cc: <stable@xxxxxxxxxxxxxxx>
> Cc: Andrea Arcangeli <aarcange@xxxxxxxxxx>
> Cc: Michal Hocko <mhocko@xxxxxxxx>
> Cc: Mel Gorman <mgorman@xxxxxxxxxxxxxxxxxxx>
> Cc: David Rientjes <rientjes@xxxxxxxxxx>
Acked-by: David Rientjes <rientjes@xxxxxxxxxx>
