linux-kernel - Re: [RFC PATCH] mm/page_alloc: fix counting of free pages after take off from buddy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 6 May 2021 02:49:44 +0000
From:   HORIGUCHI NAOYA(堀口　直也) 
        <naoya.horiguchi@....com>
To:     David Hildenbrand <david@...hat.com>,
        Ding Hui <dinghui@...gfor.com.cn>
CC:     "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
        "osalvador@...e.de" <osalvador@...e.de>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [RFC PATCH] mm/page_alloc: fix counting of free pages after take
 off from buddy

On Wed, Apr 28, 2021 at 04:54:59PM +0200, David Hildenbrand wrote:
> On 21.04.21 04:04, Ding Hui wrote:
> > Recently we found there is a lot MemFree left in /proc/meminfo after
> > do a lot of pages soft offline.
> > 
> > I think it's incorrect since NR_FREE_PAGES should not contain HWPoison pages.
> > After take_page_off_buddy, the page is no longer belong to buddy
> > allocator, and will not be used any more, but we maybe missed accounting
> > NR_FREE_PAGES in this situation.
> > 
> > Signed-off-by: Ding Hui <dinghui@...gfor.com.cn>
> > ---
> >   mm/page_alloc.c | 1 +
> >   1 file changed, 1 insertion(+)
> > 
> > diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> > index cfc72873961d..8d65b62784d8 100644
> > --- a/mm/page_alloc.c
> > +++ b/mm/page_alloc.c
> > @@ -8947,6 +8947,7 @@ bool take_page_off_buddy(struct page *page)
> >   			del_page_from_free_list(page_head, zone, page_order);
> >   			break_down_buddy_pages(zone, page_head, page, 0,
> >   						page_order, migratetype);
> > +			__mod_zone_page_state(zone, NR_FREE_PAGES, -1);
> >   			ret = true;
> >   			break;
> >   		}
> > 
> 
> Should this use __mod_zone_freepage_state() instead?

Yes, __mod_zone_freepage_state() looks better to me.

And I think that maybe an additional __mod_zone_freepage_state() in
unpoison_memory() is necessary to cancel the decrement.  I thought of the
following, but it doesn't build because get_pfnblock_migratetype() is
available only in mm/page_alloc.c, so you might want to add a small exported
routine in mm/page_alloc.c and let it called from unpoison_memory().

  @@ -1899,8 +1899,12 @@ int unpoison_memory(unsigned long pfn)
          }
  
          if (!get_hwpoison_page(p, flags, 0)) {
  -               if (TestClearPageHWPoison(p))
  +               if (TestClearPageHWPoison(p)) {
  +                       int migratetype = get_pfnblock_migratetype(p, pfn);
  +
                          num_poisoned_pages_dec();
  +                       __mod_zone_freepage_state(page_zone(p), 1, migratetype);
  +               }
                  unpoison_pr_info("Unpoison: Software-unpoisoned free page %#lx\n",
                                   pfn, &unpoison_rs);
                  return 0;

Thanks,
Naoya Horiguchi