From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej2-f42.google.com (mail-ej2-f42.google.com [74.125.228.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6C5AF46F4AB for ; Mon, 28 Sep 2026 09:53:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.228.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790589237; cv=none; b=et4g+U8w42sWUP+flDUS/HfBy/Ds6YBxQ8GNJxvpuaTWNrJWr3MksriKiypYXRL9de2i9+p/VoOAL9twefdf8K4s8EbfxkILJjxSsPt5EfX1r4ShReSsyjxp7ZaxLovRxk9xdG+KJacl9XtRPRXTLHljBVmq1acOvS+9d/tpNVc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790589237; c=relaxed/simple; bh=mXlMxmlL0FCNrGyBpcyx+dWJuiW6H8zzigvVTYrhlCM=; h=From:Date:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=n/57n5+3f9ox02pGe5Y2cu90jPJDoRrWygFS4rvQEBUX6d0iCiMzjt19rATVjDB6QXWgSaOo+6Uf0jwolIeERvogOyg0qO17z9w/SEjNAepFe6wKpGS6/Y1F/V+sg4OVKmnQNJ7kCs9sm+tVauiu9N+8CUjp2/DUO5618eE8eGY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Io3Jzd7m; arc=none smtp.client-ip=74.125.228.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Io3Jzd7m" Received: by mail-ej2-f42.google.com with SMTP id a640c23a62f3a-c2c570a3030so200432666b.0 for ; Mon, 28 Sep 2026 02:53:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790589233; x=1791194033; darn=vger.kernel.org; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:date :from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=mJTLKL9T8vepgzmrMMl9hUBXjorXrkUQap53+72PCy8=; b=Io3Jzd7mvaFarYjW7U9ipoUHvYm1LRy/ccwrHinacxEgYa/Xksk+57zZ7yYH0AtB9F GyHwI/VMuiEFdTFmFr3TJZvovaPS4o9rAzlikv8Bl23dGV4/Zw0TjKxshaHc7WAhNvE0 nt6+lCyyjplPFh4ix30GD9ZjlCOv1ZIi7XJI8aH/2n0tCfJ5OuCidSBidd12q7EV5+2U cJ+dO4pxxW21NEXrKcte93rgeX1Pm2QX1KX5WN45QhA+z6uqpNPXvBe2Ip0DYmPWf7+X 3+8pqphySp8b2oCSGCRaORkgkz2TVZxGW3xWWy17h1YyhZqmXI/Ip5ykVP4iRMp9W5Nd Xh5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790589233; x=1791194033; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:date :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=mJTLKL9T8vepgzmrMMl9hUBXjorXrkUQap53+72PCy8=; b=VuwlGlyWlaZwQ5aE9QrO5+qO5qUKWxRppYRl4i5ZvwXUpsOtjkiVTTXFM8/p4pGuHV mtiNTAKYgCB2pJWeC6oiGpp0gSg9aXj0qF+0/KsWa6R9QqzODJPnERmXyVhc42VIsegD /2IOzNhS/UbB126bOg/0X5XzBOuHdIkFjC8UHgc1ovtFUMa11x1w9xl5tJyz6ssJaYje CghY59fO/gRxrmszfeiTB0u64xzRwccx/BgaikP15GXkoZOeqIfIvjVpBltFxDmej9+X xlDbUTWOZjv4O4b1GZKP6g+MjMsTzK+PIP2hk8LUklR6Vhu6HKcp7tJMxa1HNRSw1wOn PmmA== X-Forwarded-Encrypted: i=1; AKwUvBz1Gxq/pclP4hyD+DSNi28o27DkPTPMWArIzuolupt+Grqi4FhdqTweT0k98lg/+71hw1wr1M88f8sZLLs=@vger.kernel.org X-Gm-Message-State: AFq9FYKo3M3j0GzRZ1HgUNFaqbrHar90uYz2Wv3SUXpw6g67f/JjjWcY 8onCFHT80IfNvLmMdUWih4lTjYNJCNDK1mgFMQgdYDVfssLBBU37y2Xw X-Gm-Gg: AYBFou2WxMoaKIznbK6bTPkcTN64R6XOSL8u27C4vw7KKCi3Z6xrYbMzGwVdQEAtAxE 3gNv4FWiKRBXcNNLKYFE6ctQT9HNrMZG/tPKvXKnMY3r9bzpdUKRXRPIUpFGfIkkgjGccDjRkjF uf7caCY1K4iR5L0Y4bkuHjoEomaJzqHMwDHGUsVOIwztuOv6Mcs6ysctCHlWOuRnk2/NeHNXtPk k6/B21/6cTKIYiYO4onf7iZ6T347hETHhAS1wkLVT3UWpvFeRIpeNDeqCEx9iRZD+BJiCn5y/73 VMMz5g73Up3pui8jBH7IK/fnKmc/+2evylTGEbJrdMeaNeSAy5i7d0RRTSjD9jrLUjogFTLNcJK Iu9b5dD5Eeo4NB88pwT5BWEsh85tbDcdkSxclAq3gCaNGHB4ifT5S+Cry4c7cs38E9eW/jFGv3/ S8PYwbx58UW48WoYhqIVnblZB+7fhWUI1jwU8= X-Received: by 2002:a17:906:2083:b0:c2d:5ce0:1061 with SMTP id a640c23a62f3a-c2d5ce01e9cmr243001866b.21.1790589233412; Mon, 28 Sep 2026 02:53:53 -0700 (PDT) Received: from milan ([2001:9b1:d5a0:a500::24b]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c2ae678c90csm466121166b.6.2026.09.28.02.53.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 28 Sep 2026 02:53:53 -0700 (PDT) From: Uladzislau Rezki X-Google-Original-From: Uladzislau Rezki Date: Mon, 28 Sep 2026 11:53:51 +0200 To: "Lorenzo Stoakes (ARM)" Cc: Uladzislau Rezki , Suren Baghdasaryan , Hao Ge , "David Hildenbrand (Arm)" , Luis Chamberlain , Petr Pavlu , Daniel Gomez , Sami Tolvanen , Aaron Tomlin , Andrew Morton , linux-modules@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v10 2/6] alloc_tag: clean up the populate failure path Message-ID: References: <20260915070001.113559-1-hao.ge@linux.dev> <20260915070001.113559-3-hao.ge@linux.dev> <60642a7f-2949-428a-8290-40d69c989a77@linux.dev> <1dff448c-9cbe-4276-bca1-d91283b0c7b4@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: On Fri, Sep 18, 2026 at 05:35:02PM +0100, Lorenzo Stoakes (ARM) wrote: > Looping in Ulad who is best placed to respond on this. > > Ulad could you look at the below? Thanks! :) > > On Thu, Sep 17, 2026 at 10:32:48AM +0800, Hao Ge wrote: > > Hi Suren、David、Lorenzo > > > > On 2026/9/17 09:12, Hao Ge wrote: > > > Hi Suren > > > > > > On 2026/9/17 03:07, Suren Baghdasaryan wrote: > > >> On Wed, Sep 16, 2026 at 9:31 AM Suren Baghdasaryan wrote: > > >>> > > >>> On Tue, Sep 15, 2026 at 11:00 PM Hao Ge wrote: > > >>>> > > >>>> Hi Suren > > >>>> > > >>>> Thanks for you review. > > >>>> > > >>>> On 2026/9/16 05:09, Suren Baghdasaryan wrote: > > >>>>> On Mon, Sep 14, 2026 at 11:59 PM Hao Ge wrote: > > >>>>>> > > >>>>>> The reservation is already stored in the maple tree when > > >>>>>> vm_module_tags_populate() fails. A failed load never unloads the > > >>>>>> module, so nothing releases the entry. Release it and roll > > >>>>>> module_tags.size back. Without the rollback a concurrent load that > > >>>>>> already passed needs_section_mem() can reuse the freed gap, skip > > >>>>>> vm_module_tags_populate() and write to unmapped memory. > > >>>>>> > > >>>>>> vmap_pages_range() may have installed some PTEs before failing. A > > >>>>>> retry to populate the same range would BUG on them, so undo them, > > >>>>>> but only if vmap actually ran. > > >>>>>> > > >>>>>> Fixes: 4835f747d3ed ("alloc_tag: support for page allocation tag compression") > > >>>>>> Fixes: 0f9b685626da ("alloc_tag: populate memory for module tags as needed") > > >>>>> > > >>>>> If a patch fixes two other patches, it likely needs to be split so > > >>>>> that each part fixes one patch only. But read on please. I'm not sure > > >>>>> if one of the fixes is correct. > > >>>>> > > >>>> > > >>>> Kept them in one patch because they only make sense together. > > >>>> > > >>>> After a failed populate the reservation is released and the > > >>>> size rolled back, so the next load takes the same gap and calls > > >>>> vm_module_tags_populate() again, and that retry would trip over > > >>>> the PTEs the failed vmap left behind. > > >>>> > > >>>> Without the rollback a load that already passed needs_section_mem() > > >>>> just reuses the gap, skips populate and writes to unmapped memory. > > >>>> So splitting them leaves each half broken. > > >>> > > >>> Yeah, that's why I think vmap_pages_range() cleanup should be a > > >>> completely separate patch with vmap_pages_range() doing cleanup > > >>> itself. > > >>> > > > > > > I think I get where you're coming from now. > > > Thanks for taking the time to explain. > > > > > >>>> > > >>>>>> Reported-by: Sashiko > > >>>>>> Cc: stable@vger.kernel.org > > >>>>>> Signed-off-by: Hao Ge > > >>>>>> --- > > >>>>>> mm/alloc_tag.c | 10 ++++++++++ > > >>>>>> 1 file changed, 10 insertions(+) > > >>>>>> > > >>>>>> diff --git a/mm/alloc_tag.c b/mm/alloc_tag.c > > >>>>>> index 2070e682fe10..95ddf5b743d0 100644 > > >>>>>> --- a/mm/alloc_tag.c > > >>>>>> +++ b/mm/alloc_tag.c > > >>>>>> @@ -804,6 +804,13 @@ static int vm_module_tags_populate(void) > > >>>>>> next_page, PAGE_SHIFT) < 0) { > > >>>>>> release_pages_arg arg = { .pages = next_page }; > > >>>>>> > > >>>>>> + /* > > >>>>>> + * vmap_pages_range() only runs once all pages were > > >>>>>> + * allocated, and it may have installed some mappings > > >>>>>> + * before failing. Undo them. > > >>>>> > > >>>>> If vmap_pages_range() failed to map the range, why should we need to > > >>>>> undo it? If it indeed leaves some partial mapping when failing then I > > >>>>> would argue that vmap_pages_range() should be undoing these partial > > >>>>> mappings itself before returning the error. > > >>>>> > > >>>> Yeah it does - none of the paths under vmap_pages_range() undo themselves on error. > > >>> > > >>> Hmm. I wonder if this behavior is intentional or requires a fix. The > > >>> only possible reason I can think of is performance but I can't imagine > > >>> a failure to map is a performance-critical case. > > >>> > > >>> +David Hildenbrand (Red Hat), +Lorenzo Stoakes (Oracle) what do you > > >> > > >> Huh, my gmail thinks you are still at your previous companies :) > > >> > > > > > > I manually fixed it on the mailing list for this thread. > > > > > >>> guys think? Shouldn't vmap_pages_range() undo its possible partial > > >>> mapping when it fails? > > >>> > > >>> > > >>>> pcpu_map_pages does perform cleanup on its own as well. There may be other similar sites. > > >>>> https://elixir.bootlin.com/linux/v7.3-rc3/source/mm/percpu-vm.c#L255 > > >>>> so I did the same here. > > >>>> > > >>>> If we really want vmap_pages_range() to handle this cleanup internally, I believe that would > > >>>> be a relatively large change, and we would need to consider many more cases. So I think we keep > > >>>> the current behaviour for now. > > >>> > > >>> Yeah, I understand it would require a deeper cut but if that's the > > >>> right way to handle this we might as well do that. Let's see what MM > > >>> folks think. > > >>> > > > > > > Sounds good to me. Let's wait and hear what the MM folks say. > > > > > > > I just looked into the call sites for __vmap_pages_range. > > And I found there's a bug in one vmalloc caller [1]. > > When gfp_mask has __GFP_NOFAIL, the code keeps retrying > > __vmap_pages_range. If there are leftover PTE mappings, > > this can trigger a BUG(); [2] > > https://elixir.bootlin.com/linux/v7.3-rc3/source/mm/vmalloc.c#L3946 [1] > > https://elixir.bootlin.com/linux/v7.3-rc3/source/mm/vmalloc.c#L121 [2] > > I think best person to look at this is Ulad as vmalloc is his baby :) > > Ulad, what do you think? > > Thread is at > https://lore.kernel.org/all/20260915070001.113559-3-hao.ge@linux.dev/ for > context. > Uh.. I missed this. Let me check! -- Uladzislau Rezki