From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 62871C47DD9 for ; Sat, 23 Mar 2024 01:35:17 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A26C56B0082; Fri, 22 Mar 2024 21:35:16 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 9D6A36B0085; Fri, 22 Mar 2024 21:35:16 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 89DD66B0088; Fri, 22 Mar 2024 21:35:16 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 7B6546B0082 for ; Fri, 22 Mar 2024 21:35:16 -0400 (EDT) Received: from smtpin18.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 2D0AE8115B for ; Sat, 23 Mar 2024 01:35:16 +0000 (UTC) X-FDA: 81926585832.18.7EB8515 Received: from mail-lf1-f54.google.com (mail-lf1-f54.google.com [209.85.167.54]) by imf15.hostedemail.com (Postfix) with ESMTP id 5984BA000D for ; Sat, 23 Mar 2024 01:35:13 +0000 (UTC) Authentication-Results: imf15.hostedemail.com; dkim=pass header.d=bytedance.com header.s=google header.b=WB+DZImd; spf=pass (imf15.hostedemail.com: domain of hezhongkun.hzk@bytedance.com designates 209.85.167.54 as permitted sender) smtp.mailfrom=hezhongkun.hzk@bytedance.com; dmarc=pass (policy=quarantine) header.from=bytedance.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1711157714; a=rsa-sha256; cv=none; b=UeDM4tQo7GwESRJ6W/R01CD6fnntV+vk2CKFPsHFtLm7evY/vM9vx6Qg+DTaK1MilFRzB1 3sjoAoFwoukAqIEAzUfUqzL0HgRFwhMAs0RHtAWxiWGqeLxyc0R3G0+pF2Opl/TSEWrCmR bIBy73CEcjggZHbO9yFLRitjVcrfgb8= ARC-Authentication-Results: i=1; imf15.hostedemail.com; dkim=pass header.d=bytedance.com header.s=google header.b=WB+DZImd; spf=pass (imf15.hostedemail.com: domain of hezhongkun.hzk@bytedance.com designates 209.85.167.54 as permitted sender) smtp.mailfrom=hezhongkun.hzk@bytedance.com; dmarc=pass (policy=quarantine) header.from=bytedance.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1711157714; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=E8rGJ77CyUT8+MHRH+mInykEeO9TGVUm5d5iB+wH4Qk=; b=anDa0WIoRz23EzBO/XHaI7M6XZXwVxVSO9sGv8/BAOVJ78PHGFy2tm5cQbkhShDVDH4UzH mpfoKxVdE0TUVjHyoE7J4lF6NcmNJAdGWCDrUtnrcZZNxkQe3yJM7Zj4tDR+UDOUXGzYhw 6sna2d+0R2mG1+504X8OeqYy60PvkQo= Received: by mail-lf1-f54.google.com with SMTP id 2adb3069b0e04-513e89d0816so3397812e87.0 for ; Fri, 22 Mar 2024 18:35:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance.com; s=google; t=1711157711; x=1711762511; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=E8rGJ77CyUT8+MHRH+mInykEeO9TGVUm5d5iB+wH4Qk=; b=WB+DZImdd/2CljOFZoN/a1uFveOyGzztor2p0MjFdn2lvxw7M2ucJR+BVc8f/Yz73W g0kf8MCZED2lWiEtOwSN7MyqvM4aG11ZYpEp9b5boSuQlXVPlqOy6wlIYslc4h0wonn7 Xs/QI2fNsiwMadYq6MzVaUZJAZyFWVbzicNxuYw4n63e5EuzzBoaP/CbGG+Mc+KVksdI 69t7xtmd+fUsLS09cujleSG70/EDnP12EQYKOmcIiLNwnzOZVwlttpgGi1scXs7KAd72 O/ag3ON3vvopn91BZqsz7y76zW2c7Jh1+ByZlCCjm68nl+fhAQnhKBe4VUCnh3bbQyLr WpVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1711157711; x=1711762511; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=E8rGJ77CyUT8+MHRH+mInykEeO9TGVUm5d5iB+wH4Qk=; b=G+b/dBtg9Y4YCJhWJjoWJgdXP0pINow/oCgO9J8wHxeLf0YYGol1BOclmhLJh/qcqh dmG/1Mm2XCpWNlrqXRzTad/otLreAwdfnZPCJu1smMyK7Iao0eTDWBpiNq9TINlB2A6k i5cBTWnWVWPisWmQ7iNwQUg19eVIlWjvKCJZmuL/WJtlZ8q60QAIgXZfYQkjgImwoz6o v0bXmzR21RMPVPVWV9B74H4MUdiThsUp8b/QPhQYX08V+BLQ0SbSgZrTsQj+z4izi21+ hRw9gDyIJcwUEFh4aepPzhSqh2W0SWvKzCMBneAg3KrM0oasb3Jk664ZDn8wzs3t1t+8 je5Q== X-Forwarded-Encrypted: i=1; AJvYcCXW5xq1UisvU8rnyfYeQdQ+siimizJrpV3eCZRuZYfie8nctbzakKD6ffxubHMWwUYN7jwUG3ReT9vdDaC9ilnEHKM= X-Gm-Message-State: AOJu0Yx07MNEvIjFDgRWEcvmJnwLHcAAv7bAVRI8/YVW5wNGL6bOcG+H aGxyr73mu7XolfjyhWBg9ixrqJ5z8q8nrmNWWz/5QpGfs7wytve8IwM/cEJ/4VLi6PWsk29jJGe Jc5U7m0W84hSvNG9D3dDJ1OrbM95OMajW0Kd/oA== X-Google-Smtp-Source: AGHT+IGIQ7SEkXAS+WPkTox4UjnJTus13ep8rdQJA5sQNkf2B2w8pnbBzVU4Odjky2iwuiREK5NsdggTmOsSjery2EY= X-Received: by 2002:a19:9105:0:b0:515:a087:5d4f with SMTP id t5-20020a199105000000b00515a0875d4fmr422772lfd.31.1711157711207; Fri, 22 Mar 2024 18:35:11 -0700 (PDT) MIME-Version: 1.0 References: <01b0b8e8-af1d-4fbe-951e-278e882283fd@linux.dev> In-Reply-To: From: Zhongkun He Date: Sat, 23 Mar 2024 09:34:58 +0800 Message-ID: Subject: Re: [External] Re: [bug report] mm/zswap :memory corruption after zswap_load(). To: Yosry Ahmed Cc: Chengming Zhou , Johannes Weiner , Andrew Morton , linux-mm , wuyun.abel@bytedance.com, zhouchengming@bytedance.com, Nhat Pham , Kairui Song , Minchan Kim , David Hildenbrand , Barry Song <21cnbao@gmail.com>, Chris Li , Ying Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: 5984BA000D X-Stat-Signature: dd4jyuc9mmec58qcf5mw7i84beopwj84 X-Rspam-User: X-HE-Tag: 1711157713-133073 X-HE-Meta: U2FsdGVkX18RjIq6pO0a3NOWq/A1NWPMWJe3ojE56y9apdw0LicTtIc/x8opEfIYFkWAdqUqikEntTcIJKGXpzhO7FA9mlLHqpe/+Vau2DH6Mgmv1G7PkyF2NZ5ePsKiVP4PRYyaIc1A2KPhoijCJxl06ZxvfVgtISZI5Zfa+mCnpOSdCCCVVvkpMlCkE42739d7yrzQuQnobkh+5TlpYNjMlbr6BhBkJy8HTDy2zdzApbPGSMWMY9EOLQ84oUTTC4W3tOx3Xe81Ly0YsZtFN6EYnMxiOUo5j0ClPJAgPg1bax3QQGenR/w6z/+YYzvsddTvFFiWIiG/sJ7rslBJIDKAMOd1RbCmRbVDs6iBMmQJtcfIidweqS/3Mu6uO6C2Fyw5e87SXP+izkOAQsCgEx+Hk7bs1VA+tV5N4e6n+49TXeLYOnVRgAJgLuM7OlJa3zBsMopnej/92BDKFNDfhKXOgFGAcI2sX5racxMNhutZ8kT7iveNYv7wmMRs247Irp0/O9y0inNmiYUubBGXKfPT7t4lxM0zq+rp21TaAI4M/lP573rnMmVD4nL24u9UDSlx6OyiA3T/a/cfNbyV3peN6h3/qK+ULPSJvbKWZ36y5dJB3/hKbqnUjuhCbXvLNS7wzIstMWjd4VbVgaQXOGKYMtaH2ejlWHe5lHnDLpPKd8GIGjYvH9Ms7dd6pMRmXcPnmJVXd7+xD4t0kh3/paLn6XoIuZoe4qit7vU7NpoYfQTlO1s0Dt3DWfbq6N7zyaTnvhXpXRMXS3g3VWz4PsLLcs2tjln/QFL3iP9au4qAVSv/HKduXHBW1o6fHzZLbHojrd9SsaEEpAedj7fVuZXOsHWxFro6oT3iJIAPh37DH6pJp9lrbQ4K5wn042MAegiCJLfX+A+2DE8i8GPVL9a9zU2T3jyzx5xXjpmoOlFSifv9NAOdCkIhpCFuGxIXCH+yYc6KFqBD8+3WRlS hnHgxv5x CLZTu6XiYE8NOMDBy25FawX/hEmA2ACYzid9Wpuh+aU1RgF2NbBmQWEK6z9JK4Fm683rYrvZQOXiPvwMX+uBDwM52n30bGifcIh2XkSU11o0b6G+MS7ATByVBgXwa7NYIUY2AFXVjgSbiRFt7EJtfPsWud4e+AcaI+Xb7G4G/v7c8+NwWUUin2smjW7A2bVozu/elUKV+B2BdrrfFpiyNr9TWMv8RwqeVQN42to2ue+oKGoSlPLtM5qjjLbcqyV4jW6xwiRnGvozvQmWZpK5T2d58R/iGHAbc/IhGZSMG1gD3MPZ0IvGneWbWyJOXxFq/0TeUZCowsHdTKtf0MfDjsNBD4D/Ji6Fo6IhJfI/bsLwm0T7ivrzBmo64xw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Sat, Mar 23, 2024 at 3:35=E2=80=AFAM Yosry Ahmed = wrote: > > On Thu, Mar 21, 2024 at 8:04=E2=80=AFPM Zhongkun He > wrote: > > > > On Thu, Mar 21, 2024 at 5:29=E2=80=AFPM Chengming Zhou wrote: > > > > > > On 2024/3/21 14:36, Zhongkun He wrote: > > > > On Thu, Mar 21, 2024 at 1:24=E2=80=AFPM Chengming Zhou wrote: > > > >> > > > >> On 2024/3/21 13:09, Zhongkun He wrote: > > > >>> On Thu, Mar 21, 2024 at 12:42=E2=80=AFPM Chengming Zhou > > > >>> wrote: > > > >>>> > > > >>>> On 2024/3/21 12:34, Zhongkun He wrote: > > > >>>>> Hey folks, > > > >>>>> > > > >>>>> Recently, I tested the zswap with memory reclaiming in the main= line > > > >>>>> (6.8) and found a memory corruption issue related to exclusive = loads. > > > >>>> > > > >>>> Is this fix included? 13ddaf26be32 ("mm/swap: fix race when skip= ping swapcache") > > > >>>> This fix avoids concurrent swapin using the same swap entry. > > > >>>> > > > >>> > > > >>> Yes, This fix avoids concurrent swapin from different cpu, but th= e > > > >>> reported issue occurs > > > >>> on the same cpu. > > > >> > > > >> I think you may misunderstand the race description in this fix cha= ngelog, > > > >> the CPU0 and CPU1 just mean two concurrent threads, not real two C= PUs. > > > >> > > > >> Could you verify if the problem still exists with this fix? > > > > > > > > Yes=EF=BC=8CI'm sure the problem still exists with this patch. > > > > There is some debug info, not mainline. > > > > > > > > bpftrace -e'k:swap_readpage {printf("%lld, %lld,%ld,%ld,%ld\n%s", > > > > ((struct page *)arg0)->private,nsecs,tid,pid,cpu,kstack)}' --includ= e > > > > linux/mm_types.h > > > > > > Ok, this problem seems only happen on SWP_SYNCHRONOUS_IO swap backend= s, > > > which now include zram, ramdisk, pmem, nvdimm. > > > > Yes. > > > > > > > > It maybe not good to use zswap on these swap backends? > > > > > > The problem here is the page fault handler tries to skip swapcache to > > > swapin the folio (swap entry count =3D=3D 1), but then it can't insta= ll folio > > > to pte entry since some changes happened such as concurrent fork of e= ntry. > > > > > > > The first page fault returned VM_FAULT_RETRY because > > folio_lock_or_retry() failed. > Hi Yosry, > How so? The folio is newly allocated and not visible to any other > threads or CPUs. swap_read_folio() unlocks it and then returns and we > immediately try to lock it again with folio_lock_or_retry(). How does > this fail? Haha, it makes me very confused. Based on the steps to reproduce the proble= m, I think the page is locked by shrink_folio_list(). Please see the following situation. do_swap_page __folio_set_locked(folio); swap_readpage(page, true, NULL); zswap_load(folio) folio_unlock(folio); shrink_folio_list if (!folio_trylock(folio)) ret |=3D folio_lock_or_retry(folio, vmf); if (ret & VM_FAULT_RETRY) goto out_release; Thanks. > > Let's go over what happens after swap_read_folio(): > - The 'if (!folio)' code block will be skipped. > - folio_lock_or_retry() should succeed as I mentioned earlier. > - The 'if (swapcache)' code block will be skipped. > - The pte_same() check should succeed on first look because other > concurrent faulting threads should be held off by the newly introduced > swapcache_prepare() logic. But looking deeper I think this one may > fail due to a concurrent MADV_WILLNEED. > - The 'if (unlikely(!folio_test_uptodate(folio)))` part will be > skipped because swap_read_folio() marks the folio up-to-date. > - After that point there is no possible failure until we install the > pte, at which point concurrent faults will fail on !pte_same() and > retry. > > So the only failure I think is possible is the pte_same() check. I see > how a concurrent MADV_WILLNEED could cause that check to fail. A > concurrent MADV_WILLNEED will block on swapcache_prepare(), but once > the fault resolves it will go ahead and read the folio again into the > swapcache. It seems like we will end up with two copies of the same > folio? Maybe this is harmless because the folio in the swacache will > never be used, but it is essentially leaked at that point, right? > > I feel like I am missing something. Adding other folks that were > involved in the recent swapcache_prepare() synchronization thread. > > Anyway, I agree that at least in theory the data corruption could > happen because of exclusive loads when skipping the swapcache, and we > should fix that. > > Perhaps the right thing to do may be to write the folio again to zswap > before unlocking it and before calling swapcache_clear(). The need for > the write can be detected by checking if the folio is dirty, I think > this will only be true if the folio was loaded from zswap.