From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta1.migadu.com (out-139.mta1.migadu.com [95.215.58.139]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3269E2836F for ; Fri, 14 Aug 2026 10:48:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.139 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786704516; cv=none; b=Fh9R+anh0+HXKA1gyiIIq1g9agU1hnQ5I84Z9RDjCvC1UUKKrdEW0EN7pnBS5bcm7QD1t7uFRwqcJk93iPpq3efyV/i1WZ9ALKI8Av2Ddb9ds9rCKDwIYx8Q1T3Sf7fAWc53qF+7j6GJBtM92JLJWMTrWnnw83FDPALQ2vb0r/c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786704516; c=relaxed/simple; bh=1HqmXyGIYCOs3rLYM6mQfaT9V9V/gD99mJ6fGYBQcYY=; h=Mime-Version:Content-Type:Date:Message-Id:To:Cc:Subject:From: References:In-Reply-To; b=nvWKxELvB0c64wXk4EqZ5wFZWUMrPJ3Q/7BHHn8He0tTSyFmUsjblbnWdwqGYygiWcWvyLpl6rwk11p41Zq7RhDzbokza25HIS94aZ6e9QY8WYaYDv1VHJOZPlix1gcMT8UKmumlSztV9+1xEPJF7wu9XjKh/69O6b+ovJ1TWMQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=a2xK+vrl; arc=none smtp.client-ip=95.215.58.139 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="a2xK+vrl" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=1HqmXyGIYCOs3rLYM6mQfaT9V9V/gD99mJ6fGYBQcYY=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1786704508; v=1; x=1787309308; b=a2xK+vrliUD3IQLW6W0fAhb/OGvaRiQe4OHYb6qyig0CniH6D9ltEZ4JH1/BkutctC8zSzje Ig4CvKuoGPvB/nLTqxwmyioC/imY5QZlc4haDOtrMGYfwzpPwXfOoBXnRKxNvOQ+Grohyfz23LW MrzBYOvMkkY6//nYzIaikEts= X-Envelope-To: linux-kernel@vger.kernel.org Received: from localhost (77.97.51.77) by smtp.migadu.com with ESMTPS id a74bc2444d3c3b30; Fri, 14 Aug 2026 10:48:28 +0000 X-Migadu-Flow: FLOW_OUT Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Fri, 14 Aug 2026 11:48:26 +0100 Message-Id: To: "Yosry Ahmed" , "Brendan Jackman" Cc: "Borislav Petkov" , "Dave Hansen" , "Peter Zijlstra" , "Andrew Morton" , "David Hildenbrand" , "Vlastimil Babka" , "Mike Rapoport" , "Wei Xu" , "Johannes Weiner" , "Zi Yan" , "Lorenzo Stoakes" , , , , "Sumit Garg" , "Will Deacon" , , , "Itazuri, Takahiro" , "Andy Lutomirski" , "David Kaplan" , "Thomas Gleixner" , "Patrick Bellasi" , "Reiji Watanabe" , "Sean Christopherson" Subject: Re: [PATCH v3 13/26] mm: introduce freetype_t From: "Brendan Jackman" X-Mailer: aerc 0.21.0 References: <20260726-page_alloc-unmapped-v3-0-6f5729aa9832@google.com> <20260726-page_alloc-unmapped-v3-13-6f5729aa9832@google.com> In-Reply-To: On Wed Aug 5, 2026 at 12:02 AM BST, Yosry Ahmed wrote: >> @@ -3190,9 +3272,9 @@ EXPORT_SYMBOL_GPL(split_page); >> int __isolate_free_page(struct page *page, unsigned int order) >> { >> struct zone *zone =3D page_zone(page); >> - int mt =3D get_pageblock_migratetype(page); >> + freetype_t ft =3D get_pageblock_freetype(page); >> =20 >> - if (!is_migrate_isolate(mt)) { >> + if (!is_migrate_isolate(free_to_migratetype(ft))) { >> unsigned long watermark; >> /* >> * Obey watermarks as if the page was being allocated. We can >> @@ -3205,7 +3287,7 @@ int __isolate_free_page(struct page *page, unsigne= d int order) >> return 0; >> } >> =20 >> - del_page_from_free_list(page, zone, order, mt); >> + del_page_from_free_list(page, zone, order, ft); >> =20 >> /* >> * Set the pageblock if the isolated page is at least half of a >> @@ -3214,14 +3296,16 @@ int __isolate_free_page(struct page *page, unsig= ned int order) >> if (order >=3D pageblock_order - 1) { >> struct page *endpage =3D page + (1 << order) - 1; >> for (; page < endpage; page +=3D pageblock_nr_pages) { >> - int mt =3D get_pageblock_migratetype(page); >> + freetype_t old_ft =3D get_pageblock_freetype(page); >> + freetype_t new_ft =3D freetype_with_migrate(old_ft, >> + MIGRATE_MOVABLE); >> + >> /* >> * Only change normal pageblocks (i.e., they can merge >> * with others) >> */ >> - if (migratetype_is_mergeable(mt)) >> - move_freepages_block(zone, page, mt, >> - MIGRATE_MOVABLE); >> + if (migratetype_is_mergeable(free_to_migratetype(ft))) >> + move_freepages_block(zone, page, old_ft, new_ft); > > While poking at the code with AI, it pointed out that new_ft here may be > an invalid freetype (e.g. unmapped movable). I don't think anything in > move_freepages_block() or its callees checks against this. There may not > be an actual code path that would lead to this,=20 Yeah I think the bug is impossible in practice because of the freetype-flags(a) =3D=3D freetype_flags(b) in can_merge_freetypes()... > but it's very subtle. ... but yeah. Also there will be other bugs in this form (failure to handle a no-freelist freetype), I have had several of them already while developing these patches. I have specifically asked AI to look for them and it didn't find this one. (Well, it's actually also quite likely it did but I didn't read it properly or something). > We can add a check to can_merge_freetypes() (introduced in later > patches) to check for invalid types. > > But I think we may actually want a check in prep_move_freepages_block(), > which is called by move_freepages_block() and others before moving a > pageblock. WDYT? Yeah I think that's the answer, we just have to put those checks in the right places.=20 FWIW my original nerd instinct here was to create some freelist abstraction that makes the problem go away by making "no freelist of that type" look just like an empty freelist. But aside from being more galaxy-brained code to review, that doesn't work here at all: move_to_free_list() targeting a nonexistent freetype is inherently a bug.