Re: [BUG] mm/memory_hotplug: panic due to race between compaction and memory hot-unplug

["David Hildenbrand (Arm)" <david@kernel.org>]

On 9/12/26 04:06, Wei Yang wrote:
> On Thu, Sep 10, 2026 at 09:40:32AM +0200, David Hildenbrand (Arm) wrote:
>> On 9/10/26 05:16, Wei Yang wrote:
>>>
>>> Does it mean, the combination of pfn_to_online_page() / PageBuddy(page) is not
>>> safe, when there is hot-remove, even for other users. Not only compaction.
>>
>> There is an inherent race between any
>>
>> pfn_to_online_page() user that then takes a look at the memmap (PageBuddy,
>> whatever).
>>
>> Usually, that's not really relevant, because for things to go terrible wrong
>> (instead of only being slightly suboptimal :) )
>>
>> You have to run both, memory offlining *and* memory removal.
>>
>> For things like
>>
>> page = pfn_to_online_page()
>> if (PageBuddy(page))
>>
>> That's unlikely to hit (no reports), and we could likely easily fix it with the
>> help of RCU.
>>
>> It gets more problematic when we do things like
>>
>> page = pfn_to_online_page()
>> ... do all other kind of stuff
>> if (PageBuddy(page))
>>
>> (what we have here)
>>
> 
> Thanks for the explanation. I still have one confusion.
> 
> What we have here is:
> 
> isolate_freepages(cc)
>     page = pageblock_pfn_to_page()
>         if (zone->contiguous)
> 	    return pfn_to_page(pfn)
>         return __pageblock_pfn_to_page()
>             start_page = pfn_to_online_page()                       (1)
>             ... check page_zone(start_page) and page_zone_id()
>             return start_page
>     suitable_migration_target(cc, page)
>         if (PageBuddy(page))                                        (2)
> 
> It looks the extra stuff between (1) and (2) is trivial and they still rely on
> page struct. 

Right, on that path there is indeed not a lot happening.

> 
> Do you think it could be caused by the data synchronization between CPUs?
> 
> Two possible points:
> 
>   a) zone->contiguous
>   b) section_mem_map's SECTION_IS_ONLINE bit

Hm, not sure. Given that we run in a VM, we might just be pausing one VCPU for a
bit longer and be able to trigger this :(

On the bright side, *maybe* RCU could be used to sync here. Well, we really have
to isolate the page to stop offlining to just make progress by taking the free
page ...


-- 
Cheers,

David