On Thu, Mar 21, 2024 at 04:25:07PM +0800, Zhaoyang Huang wrote: > ok. Could the scenario below be suspicious on leaving an orphan folio > in step 7 and introduce the bug in step 8. In the scenario, > Thread_filemap behaves as a backdoor for Thread_madv by creating the > pte after Thread_truncate finishes cleaning all page tables. > > 0. Thread_bad gets the folio by folio_get_entry and stores it in its > local fbatch_bad and go to sleep There's no function called folio_get_entry(), but clearly thread_bad should have a refcount on it at this point. > 1. Thread_filemap get the folio via > filemap_map_pages->next_uptodate_folio->xas_next_entry and gets > preempted > refcnt == 1(page_cache), PG_lru == true so the refcount should be 2 here. > 2. Thread_truncate get the folio via > truncate_inode_pages_range->find_lock_entries > refcnt == 2(fbatch_trunc, page_cache), PG_lru == true > > 3. Thread_truncate proceed to truncate_cleanup_folio > refcnt == 2(fbatch_trunc, page_cache), PG_lru == true > > 4. Thread_truncate proceed to delete_from_page_cache_batch > refcnt == 1(fbatch_trunc), PG_lru == true > > 5. Thread_filemap schedule back and proceed to setup a pte and have > folio->_mapcnt = 0 & folio->refcnt += 1 > refcnt == 2(pte, fbatch_temp), PG_lru == true > > 6. Thread_madv clear folio's PG_lru by > madvise_xxx_pte_range->folio_isolate_lru->folio_test_clear_lru > refcnt == 2(pte,fbatch_temp), PG_lru == false > > 7. Thread_truncate call folio_fbatch_release and failed in freeing > folio as refcnt not reach 0 > refcnt == 1(pte), PG_lru == false > ********folio becomes an orphan here which is not on the page cache > but on the task's VM********** > > 8. Thread_xxx scheduled back from 0 to do release_pages(fbatch_bad) > and have the folio introduce the bug. ... because if these steps happen as 7, 8, 6, you hit the BUG in folio_isolate_lru().
