From: Bernhard Kaindl <bernhard.kaindl@citrix.com>
To: xen-devel@lists.xenproject.org
Cc: "Bernhard Kaindl" <bernhard.kaindl@citrix.com>,
"Andrew Cooper" <andrew.cooper3@citrix.com>,
"Anthony PERARD" <anthony.perard@vates.tech>,
"Michal Orzel" <michal.orzel@amd.com>,
"Jan Beulich" <jbeulich@suse.com>,
"Julien Grall" <julien@xen.org>,
"Roger Pau Monné" <roger.pau@citrix.com>,
"Stefano Stabellini" <sstabellini@kernel.org>
Subject: [PATCH v2 0/2] xen/mm: Fix off-by-one for tail merge in reserve_offlined_page()
Date: Wed, 3 Jun 2026 15:27:20 +0100 [thread overview]
Message-ID: <cover.1780496798.git.bernhard.kaindl@citrix.com> (raw)
After offlining pages, reserve_offlined_page() attempts to grow larger
buddies between the offlined pages, but due to an off-by-one, this
fails at the tail end of the span of pages of the containing buddy.
As requested for backporting the fix, the first patch fixes the
issue while the second patch adds the regression test for it.
Consider an order-2 buddy (4 pages) with the following layout:
+---------------+---------------+---------------+---------------+
| head page tail page 1, tail page 2 tail page 3 |
| PFN_ORDER(pg) marked as to |
| == 2 be offlined |
+---------------+---------------+---------------+---------------+
The expected result after removing tail page 1 and returning the
remaining healthy pages to the free list would be:
+---------------+ +---------------+---------------+
| single page | offlined page | head page tail page |
| PFN_ORDER(pg) | not returned | PFN_ORDER(pg) |
| == 0 | to the heap | == 1 |
+---------------+ +---------------+---------------+
A trivial off-by-one error in the growth loop stops the growth loop
early before the tail end of the original buddy and we end up with:
+---------------+ +---------------+---------------+
| single page | offlined page | single page | single page |
| PFN_ORDER(pg) | not returned | PFN_ORDER(pg) | PFN_ORDER(pg) |
| == 0 | to the heap | == 0 | == 0 |
+---------------+ +---------------+---------------+
You can pull this series with the regression test environment to run it:
$ git pull git@gitlab.com:bernhardkaindl/xen.git offline-merge-tail-v2
$ make -C tools/tests/native TARGETS=offline-merge-tail test
Fixes: e4865c2315 ('Page offline support in Xen side')
Signed-off-by: Bernhard Kaindl <bernhard.kaindl@citrix.com>
Bernhard Kaindl (2):
xen/mm: Fix off-by-one preventing tail merge in
reserve_offlined_page()
tools/tests: Add regression test for tail buddy growth
tools/tests/native/offline-merge-tail.c | 81 +++++++++++++++++++++++++
xen/common/page_alloc.c | 4 +-
2 files changed, 84 insertions(+), 1 deletion(-)
create mode 100644 tools/tests/native/offline-merge-tail.c
--
2.39.5
next reply other threads:[~2026-06-03 14:30 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-03 14:27 Bernhard Kaindl [this message]
2026-06-03 14:27 ` [PATCH v2 1/2] xen/mm: Fix off-by-one preventing tail merge in reserve_offlined_page() Bernhard Kaindl
2026-06-03 14:33 ` Jan Beulich
2026-06-04 9:43 ` Oleksii Kurochko
2026-06-04 9:55 ` Oleksii Kurochko
2026-06-03 14:27 ` [PATCH v2 2/2] tools/tests: Add regression test for tail buddy growth Bernhard Kaindl
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1780496798.git.bernhard.kaindl@citrix.com \
--to=bernhard.kaindl@citrix.com \
--cc=andrew.cooper3@citrix.com \
--cc=anthony.perard@vates.tech \
--cc=jbeulich@suse.com \
--cc=julien@xen.org \
--cc=michal.orzel@amd.com \
--cc=roger.pau@citrix.com \
--cc=sstabellini@kernel.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.