From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 23BED372685 for ; Fri, 12 Jun 2026 03:45:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=90.155.50.34 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781235909; cv=none; b=ELpCAYwK2kOXz6Qd8pcrZ/MNfCwBg0vDg+HQOZSpgleDKAVgUvPO6UfUzgFxlMexaQTQG//cMMY/jI+wJbc8ukAYvbNwFL+/+hqnA5ZjmE8vFCIO0xsRealTVGy3AA31dYBFA1EUzRmVlO7h157AXxwXDbwuSYGt7AmmzoIU5to= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781235909; c=relaxed/simple; bh=CNk3H/IoPTJlt4JjaKuJ+atZHYrZgVLthCZmxSvfz6A=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=d9+KaDV4iOmSod9Z14gCmp8G/D8isV3jP6SixwAMrsw6CEUvA3YcfYFuR7QnzVTEFyI6YsHFsvgp2GPY87WCSsY5pEGmoeRDUB++4RV7Hw3djV9mSgp7OisUJKxLReDeeVZmpYsMh0ZPVd971dUSJBCFBcF4Gdr0Byg1gX5tCmg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org; spf=pass smtp.mailfrom=infradead.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b=Omfx/M+u; arc=none smtp.client-ip=90.155.50.34 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=infradead.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="Omfx/M+u" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Transfer-Encoding: Content-Type:MIME-Version:References:Message-ID:Subject:Cc:To:From:Date: Sender:Reply-To:Content-ID:Content-Description; bh=8wuNTTt8Nkmf44XvMl/+1kApdnUIs1lQ+xGFMDCtpqk=; b=Omfx/M+uj8H4iUlLYnVIlSoA0f 83mqDu1TOrrhlbKmtTjrtxG37j/CPmGVYlIdrf/ix6BxCHIi1LPlAFeg1e2YMZPBPRHUgf3S4LN5x PSGpxCML5T8HDnCKR0r6w/1fIUNw6HJzmnXr108sYmRS+Ll/s4fumypdB39yxuKiCUJDDVMet7fOz lkafYWbLoqw0lofci3jc7FN/eU9xasCTmwg1LLKB/UkkMA4F7dzYre2Z9xK9kLUClCmePnztc11Qg 0OGM9nbOeSZ8TM00KEsuAl8ZGFE5YJjtAVOl/DmoHZSSpYU1Fn1Urxg8nahiBFdfhW9BspxdlnoLe dH6wy6cw==; Received: from willy by casper.infradead.org with local (Exim 4.99.1 #2 (Red Hat Linux)) id 1wXsp5-000000033X5-0vpy; Fri, 12 Jun 2026 03:44:47 +0000 Date: Fri, 12 Jun 2026 04:44:47 +0100 From: Matthew Wilcox To: Zhaoyang Huang Cc: Zi Yan , jaegeuk@kernel.org, Chao Yu , "jyescas@google.com" , "David Hildenbrand (Arm)" , "zhaoyang.huang" , Andrew Morton , Lorenzo Stoakes , Barry Song , Baolin Wang , Lance Yang , "Liam R . Howlett" , Nico Pache , Ryan Roberts , Dev Jain , linux-mm@kvack.org, linux-kernel@vger.kernel.org, steve.kang@unisoc.com, xiuhong.wang@unisoc.com, hao_hao.wang@unisoc.com Subject: Re: [RFC PATCH] mm/huge_memory: do not add dropped split tail folios to LRU Message-ID: References: <20260610120535.2370844-1-zhaoyang.huang@unisoc.com> <4348A64F-30F9-4497-A839-A80BCFFCFFE0@nvidia.com> <2F9A72CC-772C-4691-9F18-77306EADC6CB@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: On Thu, Jun 11, 2026 at 03:45:19PM +0800, Zhaoyang Huang wrote: > > > pin_user_pages*(..., FOLL_LONGTERM) > > > └─ __gup_longterm_locked() [gup.c:2465] > > > │ ├─ follow_page_pte() [gup.c:802] > > > │ │ └─ try_grab_folio() [gup.c:858] > > > if (WARN_ON_ONCE(folio_ref_count(folio) <= 0)) > > > return -ENOMEM; > > > > > > // Could __folio_split->folio_put could > > > race here ? > > > if (flags & FOLL_GET) > > > folio_ref_add(folio, refs); > > > └─ check_and_migrate_movable_pages() [gup.c:2490] > > > └─ collect_longterm_unpinnable_folios() [gup.c:2391] > > > └─ └─if (!folio_isolate_lru(folio)) > > > > > > Could the __folio_split race in the above scenario? It looks like > > > try_grab_folio set the refcount without using atomic operation. > > > > folio_ref_add() used by try_grab_folio() is an atomic op. > > Which refcount change is not atomic here? > The atomic I mean is folio_try_get is implemented by > atomic_add_unless, while try_grab_folio does this by the below > sequence which leaves a window to have __folio_split race with it. > right? > > if (WARN_ON_ONCE(folio_ref_count(folio) <= 0)) > .... > > if (flags & FOLL_GET) > folio_ref_add(folio, refs); No. try_grab_folio() is only called when we already have a reference to the folio. It says so right in the comment: * It is called when we have a stable reference for the folio, typically in * GUP slow path. You may not be able to see it; in the GUP slow path, we have a lock preventing unmapping, and the folio is mapped, therefore there's a reference count on the folio already. This isn't true for try_grab_folio_fast(), which is why it uses try_get instead of ref_add.