Re: [PATCH RESEND v2 4/4] mm/hwpoison: fix unpoison_memory()

[Naoya Horiguchi]

On Wed, Oct 27, 2021 at 09:26:08AM +0800, Ding Hui wrote:
> On 2021/10/26 7:27, Naoya Horiguchi wrote:
> > (Please ignore previous patch 4/4 which leaves the replied message at
> > the end of body, this was due to my wrong manual edit, sorry about noise.
> > I resend 4/4.)
> > 
> > From: Naoya Horiguchi <naoya.horiguchi@xxxxxxx>
> > 
> > After recent soft-offline rework, error pages can be taken off from
> > buddy allocator, but the existing unpoison_memory() does not properly
> > undo the operation.  Moreover, due to the recent change on
> > __get_hwpoison_page(), get_page_unless_zero() is hardly called for
> > hwpoisoned pages.  So __get_hwpoison_page() highly likely returns zero
> 
> Sorry, can you explain that __get_hwpoison_page() likely go which branch to
> return zero for hwpoisoned pages ?
> 
> not returns -EBUSY because HWPoisonHandlable() is false ?

Sorry, you're right, the return value mentioned here was changed since v1,
so I should have updated the description.

...
> > @@ -1958,9 +2023,7 @@ int unpoison_memory(unsigned long pfn)
> >   {
> >   	struct page *page;
> >   	struct page *p;
> > -	int freeit = 0;
> > -	int ret = 0;
> > -	unsigned long flags = 0;
> > +	int ret = -EBUSY;
> >   	static DEFINE_RATELIMIT_STATE(unpoison_rs, DEFAULT_RATELIMIT_INTERVAL,
> >   					DEFAULT_RATELIMIT_BURST);
> > @@ -1996,24 +2059,27 @@ int unpoison_memory(unsigned long pfn)
> >   		goto unlock_mutex;
> >   	}
> > -	if (!get_hwpoison_page(p, flags)) {
> > -		if (TestClearPageHWPoison(p))
> > -			num_poisoned_pages_dec();
> > -		unpoison_pr_info("Unpoison: Software-unpoisoned free page %#lx\n",
> > -				 pfn, &unpoison_rs);
> > +	if (PageSlab(page))
> 
> As I reported before [1], get refcount to a PageTable(page) is not safe,
> maybe let huge_pmd_unshare() go to wrong branch, so can you also avoid
> PageTable(page) here ?
> 
> [1]: https://lore.kernel.org/linux-mm/271d0f41-0599-9d5d-0555-47189f476243@xxxxxxxxxxxxxx/

Sure, I'll add it.

> 
> >   		goto unlock_mutex;
> > -	}
> > -	if (TestClearPageHWPoison(page)) {
> > -		unpoison_pr_info("Unpoison: Software-unpoisoned page %#lx\n",
> > -				 pfn, &unpoison_rs);
> > -		num_poisoned_pages_dec();
> > -		freeit = 1;
> > -	}
> > +	ret = get_hwpoison_page(p, MF_UNPOISON);
> > +	if (!ret) {
> > +		ret = clear_page_hwpoison(&unpoison_rs, p);
> 
> in this case, the page p has zero refcount, with HWPoison flag, but without
> MAGIC_HWPOISON, where it come from ? race condition or normal case ? Is
> there any examples please ?

memory_failure() could set HWPoison flag at any time, so if a memory error happens
on a page which a just being freed, that could be linked to buddy freelist with
HWPoison flag.

Another example is hugetlb's case, if memory_failrue() is called for a free hugetlb
page and somehow dissolve_free_huge_page() fails in handling path, the hugepage
remains with HWPoison flag set and refcount 0.
BTW, considering this case, I found that clear_page_hwpoison() should be called
for "page" instead of "p", which will be fixed in the next version.

Thanks,
Naoya Horiguchi