Re: [f2fs-dev] [PATCH] f2fs: initialize page->private when using for our internal use

[Chao Yu]

On 2021/7/12 14:53, Michal Hocko wrote:
> On Sat 10-07-21 16:11:38, Chao Yu wrote:
> > On 2021/7/7 17:57, Mel Gorman wrote:
> > > I think it would work but it would be preferable to find out why the
> > > tail page has an order set in the first place. I've looked over
> >
> > Agreed.
> >
> > > mm/page_alloc.c and mm/compaction.c a few times and did not spot where
> > > set_private_page(page, 0) is missed when it should be covered by
> > > clear_page_guard or del_page_from_free_list :(
> >
> > I didn't enable CONFIG_DEBUG_PAGEALLOC, so we will expect page private
> > should be cleared by del_page_from_free_list(), but I guess it only clears
> > the buddy's private field rather than original page's, so I added below
> > diff and check the dmesg, it looks stall private value in original page
> > will be left commonly... Let me know if I missed something?
>
> Page private should be cleared when the page is freed to the allocator.
> Have a look at PAGE_FLAGS_CHECK_AT_FREE.

Quoted from Jaegeuk's comments in [1]

"Hmm, I can see it in 4.14 and 5.10 kernel.

The trace is on:

 30875 [ 1065.118750] c3     87  f2fs_migrate_page+0x354/0x45c
 30876 [ 1065.123872] c3     87  move_to_new_page+0x70/0x30c
 30877 [ 1065.128813] c3     87  migrate_pages+0x3a0/0x964
 30878 [ 1065.133583] c3     87  compact_zone+0x608/0xb04
 30879 [ 1065.138257] c3     87  kcompactd+0x378/0x4ec
 30880 [ 1065.142664] c3     87  kthread+0x11c/0x12c
 30881 [ 1065.146897] c3     87  ret_from_fork+0x10/0x18

 It seems compaction_alloc() gets a free page which doesn't reset the fields?"

https://lore.kernel.org/linux-f2fs-devel/YOvm2faBUjKmZI7Q@xxxxxxxxxxxxxx/T/#m98a4a5e777f5b0e7366b367463efafd2133dd681

So problem here we met is: in f2fs_migrate_page(), newpage may has stall .private
value rather than PG_private flag, which may cause f2fs will treat the page with
wrong private status.

> > ---
> >   mm/page_alloc.c | 5 +++++
> >   1 file changed, 5 insertions(+)
> >
> > diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> > index a06bcfe6f786..1e7031ff548e 100644
> > --- a/mm/page_alloc.c
> > +++ b/mm/page_alloc.c
> > @@ -1029,6 +1029,7 @@ static inline void __free_one_page(struct page *page,
> >   	unsigned long combined_pfn;
> >   	unsigned int max_order;
> >   	struct page *buddy;
> > +	struct page *orig_page = page;
> >   	bool to_tail;
> >
> >   	max_order = min_t(unsigned int, MAX_ORDER - 1, pageblock_order);
> > @@ -1097,6 +1098,10 @@ static inline void __free_one_page(struct page *page,
> >
> >   done_merging:
> >   	set_buddy_order(page, order);
> > +	if (orig_page != page) {
> > +		if (WARN_ON_ONCE(orig_page->private))
> > +			pr_info("2order:%x, origpage.private:%x", order, orig_page->private);
> > +	}
>
> Why is this expected? Buddy allocator uses page private to store order.
> Whether we are merging to the freed page or coalesce it to a different

The order was only set in head page, right? Since it looks __free_one_page() tries
to clear page.private for every buddy with del_page_from_free_list().

If that is true, after done_merging label in __free_one_page, if original page is
a tail page, we may missed to clear its page.private field?

Thanks,

> page is not all that important.