Re: [PATCH] mm/codetag: sub in advance when free non-compound high order pages

["David Wang" <00107082@163.com>]

At 2025-05-05 21:12:55, "Vlastimil Babka" <vbabka@suse.cz> wrote:
>On 5/4/25 08:19, David Wang wrote:
>> When page is non-compound, page[0] could be released by other
>> thread right after put_page_testzero failed in current thread,
>> pgalloc_tag_sub_pages afterwards would manipulate an invalid
>> page for accounting remaining pages:
>> 
>> [timeline]   [thread1]                     [thread2]
>>   |          alloc_page non-compound
>>   V
>>   |                                        get_page, rf counter inc
>>   V
>>   |          in ___free_pages
>>   |          put_page_testzero fails
>>   V
>>   |                                        put_page, page released
>>   V
>>   |          in ___free_pages,
>>   |          pgalloc_tag_sub_pages
>>   |          manipulate an invalid page
>>   V
>>   V
>> 
>> Move the tag page accounting ahead, and only account remaining pages
>> for non-compound pages with non-zero order.
>> 
>> Signed-off-by: David Wang <00107082@163.com>
>
>Hmm, I think the problem was introduced by 51ff4d7486f0 ("mm: avoid extra
>mem_alloc_profiling_enabled() checks"). Previously we'd get the tag pointer
>upfront and avoid the page use-after-free.


Oh, you're right. I forgot to check history......


>
>It would likely be nicer to fix it by going back to that approach for
>___free_pages(), while hopefully keeping the optimisations of 51ff4d7486f0
>for the other call sites where it applies?

After checking that commit, I kind of feels the changes in __free_pages are
 the major optimization of the commit....
What about revert that commit and make optimization by condition checks,
similar to what this patch did?
 


David