Re: [PATCH] Revert "mm: introduce a new page type for page pool in page type"

[Byungchul Park <byungchul@sk.com>]

On Mon, May 18, 2026 at 12:00:11PM +0100, Lorenzo Stoakes wrote:
> Maybe worth putting [PATCH mm-hotfixes] just to make it clear this should be an
> urgent hotfix?

Thanks.  I will do it for similar issues in the future.

	Byungchul

> On Fri, May 15, 2026 at 12:47:01PM +0900, Byungchul Park wrote:
> > This reverts commit db359fccf212e7fa3136e6edbed6228475646fd7.
> 
> Maybe 'this reverts commit db359fccf212 ("...") and partially reverts commit
> 735a309b4bfb9e ("...") <details>'?
> 
> >
> > Netpp page_type'ed pages might be used in mapping so as to use
> > @_mapcount.  However, since @page_type and @_mapcount are union'ed in
> > struct page, these two can't be used at the same time.  Revert the
> > commit introducing page_type for Netpp for now.
> 
> Yikes!
> 
> >
> > The patch will be retried once @page_type and @_mapcount get allowed to
> > be used at the same time.
> >
> > The revert also includes removal of @page_type initialization part
> > introduced by commit 735a309b4bfb9e ("net: add net_iov_init() and use it
> > to initialize ->page_type"), which will be restored on the retry.
> 
> As above maybe mentioning at top of commit msg, as right now this reads as a
> pure revert of db359fccf212.
> 
> >
> > Reported-by: Dragos Tatulea <dtatulea@nvidia.com>
> > Closes: https://lore.kernel.org/all/982b9bc1-0a0a-4fc5-8e3a-3672db2b29a1@nvidia.com
> 
> Fixes tag?
> 
> > Signed-off-by: Byungchul Park <byungchul@sk.com>
> 
> This LGTM, but see above for nits. So:
> 
> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
> 
> Cheers, Lorenzo
> 
> > ---
> >  .../net/ethernet/mellanox/mlx5/core/en/xdp.c  |  2 +-
> >  include/linux/mm.h                            | 27 ++++++++++++++++---
> >  include/linux/page-flags.h                    |  6 -----
> >  include/net/netmem.h                          | 19 ++-----------
> >  mm/page_alloc.c                               | 13 +++------
> >  net/core/netmem_priv.h                        | 23 +++++++++-------
> >  net/core/page_pool.c                          | 24 ++---------------
> >  7 files changed, 46 insertions(+), 68 deletions(-)
> >
> > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> > index 190b8b66b3ce1..d3bab198c99c0 100644
> > --- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
> > @@ -708,7 +708,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,
> >                               xdpi = mlx5e_xdpi_fifo_pop(xdpi_fifo);
> >                               page = xdpi.page.page;
> >
> > -                             /* No need to check PageNetpp() as we
> > +                             /* No need to check page_pool_page_is_pp() as we
> >                                * know this is a page_pool page.
> >                                */
> >                               page_pool_recycle_direct(pp_page_to_nmdesc(page)->pp,
> > diff --git a/include/linux/mm.h b/include/linux/mm.h
> > index 31e27ff6a35fa..9cedc5e75aa93 100644
> > --- a/include/linux/mm.h
> > +++ b/include/linux/mm.h
> > @@ -5156,9 +5156,10 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
> >   * DMA mapping IDs for page_pool
> >   *
> >   * When DMA-mapping a page, page_pool allocates an ID (from an xarray) and
> > - * stashes it in the upper bits of page->pp_magic. Non-PP pages can have
> > - * arbitrary kernel pointers stored in the same field as pp_magic (since
> > - * it overlaps with page->lru.next), so we must ensure that we cannot
> > + * stashes it in the upper bits of page->pp_magic. We always want to be able to
> > + * unambiguously identify page pool pages (using page_pool_page_is_pp()). Non-PP
> > + * pages can have arbitrary kernel pointers stored in the same field as pp_magic
> > + * (since it overlaps with page->lru.next), so we must ensure that we cannot
> >   * mistake a valid kernel pointer with any of the values we write into this
> >   * field.
> >   *
> > @@ -5193,6 +5194,26 @@ int arch_lock_shadow_stack_status(struct task_struct *t, unsigned long status);
> >  #define PP_DMA_INDEX_MASK GENMASK(PP_DMA_INDEX_BITS + PP_DMA_INDEX_SHIFT - 1, \
> >                                 PP_DMA_INDEX_SHIFT)
> >
> > +/* Mask used for checking in page_pool_page_is_pp() below. page->pp_magic is
> > + * OR'ed with PP_SIGNATURE after the allocation in order to preserve bit 0 for
> > + * the head page of compound page and bit 1 for pfmemalloc page, as well as the
> > + * bits used for the DMA index. page_is_pfmemalloc() is checked in
> > + * __page_pool_put_page() to avoid recycling the pfmemalloc page.
> > + */
> > +#define PP_MAGIC_MASK ~(PP_DMA_INDEX_MASK | 0x3UL)
> > +
> > +#ifdef CONFIG_PAGE_POOL
> > +static inline bool page_pool_page_is_pp(const struct page *page)
> > +{
> > +     return (page->pp_magic & PP_MAGIC_MASK) == PP_SIGNATURE;
> > +}
> > +#else
> > +static inline bool page_pool_page_is_pp(const struct page *page)
> > +{
> > +     return false;
> > +}
> > +#endif
> > +
> >  #define PAGE_SNAPSHOT_FAITHFUL (1 << 0)
> >  #define PAGE_SNAPSHOT_PG_BUDDY (1 << 1)
> >  #define PAGE_SNAPSHOT_PG_IDLE  (1 << 2)
> > diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
> > index 0e03d816e8b9d..7223f6f4e2b40 100644
> > --- a/include/linux/page-flags.h
> > +++ b/include/linux/page-flags.h
> > @@ -923,7 +923,6 @@ enum pagetype {
> >       PGTY_zsmalloc           = 0xf6,
> >       PGTY_unaccepted         = 0xf7,
> >       PGTY_large_kmalloc      = 0xf8,
> > -     PGTY_netpp              = 0xf9,
> >
> >       PGTY_mapcount_underflow = 0xff
> >  };
> > @@ -1056,11 +1055,6 @@ PAGE_TYPE_OPS(Zsmalloc, zsmalloc, zsmalloc)
> >  PAGE_TYPE_OPS(Unaccepted, unaccepted, unaccepted)
> >  PAGE_TYPE_OPS(LargeKmalloc, large_kmalloc, large_kmalloc)
> >
> > -/*
> > - * Marks page_pool allocated pages.
> > - */
> > -PAGE_TYPE_OPS(Netpp, netpp, netpp)
> > -
> >  /**
> >   * PageHuge - Determine if the page belongs to hugetlbfs
> >   * @page: The page to test.
> > diff --git a/include/net/netmem.h b/include/net/netmem.h
> > index 78fe51e5756b1..bccacd21b6c37 100644
> > --- a/include/net/netmem.h
> > +++ b/include/net/netmem.h
> > @@ -94,20 +94,10 @@ enum net_iov_type {
> >   */
> >  struct net_iov {
> >       struct netmem_desc desc;
> > -     unsigned int page_type;
> >       enum net_iov_type type;
> >       struct net_iov_area *owner;
> 
> Nit, but this isn't a straight revert, as in the original code owner came before
> type :P
> 
> I'm not sure this really matters though (the size should remain the same also
> either way).
> 
> 
> >  };
> >
> > -/* Make sure 'the offset of page_type in struct page == the offset of
> > - * type in struct net_iov'.
> > - */
> > -#define NET_IOV_ASSERT_OFFSET(pg, iov)                       \
> > -     static_assert(offsetof(struct page, pg) ==      \
> > -                   offsetof(struct net_iov, iov))
> > -NET_IOV_ASSERT_OFFSET(page_type, page_type);
> > -#undef NET_IOV_ASSERT_OFFSET
> > -
> >  struct net_iov_area {
> >       /* Array of net_iovs for this area. */
> >       struct net_iov *niovs;
> > @@ -127,11 +117,7 @@ static inline unsigned int net_iov_idx(const struct net_iov *niov)
> >       return niov - net_iov_owner(niov)->niovs;
> >  }
> >
> > -/* Initialize a niov: stamp the owning area, the memory provider type,
> > - * and the page_type "no type" sentinel expected by the page-type API
> > - * (see PAGE_TYPE_OPS in <linux/page-flags.h>) so that
> > - * page_pool_set_pp_info() can later call __SetPageNetpp() on a niov
> > - * cast to struct page.
> > +/* Initialize a niov: stamp the owning area, the memory provider type.
> >   */
> >  static inline void net_iov_init(struct net_iov *niov,
> >                               struct net_iov_area *owner,
> > @@ -139,7 +125,6 @@ static inline void net_iov_init(struct net_iov *niov,
> >  {
> >       niov->owner = owner;
> >       niov->type = type;
> > -     niov->page_type = UINT_MAX;
> >  }
> 
> Ah OK this must be the part of the revert from 735a309b4bfb9e.
> 
> >
> >  /* netmem */
> > @@ -245,7 +230,7 @@ static inline unsigned long netmem_pfn_trace(netmem_ref netmem)
> >   */
> >  #define pp_page_to_nmdesc(p)                                         \
> >  ({                                                                   \
> > -     DEBUG_NET_WARN_ON_ONCE(!PageNetpp(p));                          \
> > +     DEBUG_NET_WARN_ON_ONCE(!page_pool_page_is_pp(p));               \
> >       __pp_page_to_nmdesc(p);                                         \
> >  })
> >
> > diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> > index e262d1316259d..91e7075918ada 100644
> > --- a/mm/page_alloc.c
> > +++ b/mm/page_alloc.c
> > @@ -1046,6 +1046,7 @@ static inline bool page_expected_state(struct page *page,
> >  #ifdef CONFIG_MEMCG
> >                       page->memcg_data |
> >  #endif
> > +                     page_pool_page_is_pp(page) |
> >                       (page->flags.f & check_flags)))
> >               return false;
> >
> > @@ -1072,6 +1073,8 @@ static const char *page_bad_reason(struct page *page, unsigned long flags)
> >       if (unlikely(page->memcg_data))
> >               bad_reason = "page still charged to cgroup";
> >  #endif
> > +     if (unlikely(page_pool_page_is_pp(page)))
> > +             bad_reason = "page_pool leak";
> >       return bad_reason;
> >  }
> >
> > @@ -1395,17 +1398,9 @@ static __always_inline bool __free_pages_prepare(struct page *page,
> >               mod_mthp_stat(order, MTHP_STAT_NR_ANON, -1);
> >               folio->mapping = NULL;
> >       }
> > -     if (unlikely(page_has_type(page))) {
> > -             /* networking expects to clear its page type before releasing */
> > -             if (is_check_pages_enabled()) {
> > -                     if (unlikely(PageNetpp(page))) {
> > -                             bad_page(page, "page_pool leak");
> > -                             return false;
> > -                     }
> > -             }
> > +     if (unlikely(page_has_type(page)))
> >               /* Reset the page_type (which overlays _mapcount) */
> >               page->page_type = UINT_MAX;
> > -     }
> >
> >       if (is_check_pages_enabled()) {
> >               if (free_page_is_bad(page))
> > diff --git a/net/core/netmem_priv.h b/net/core/netmem_priv.h
> > index 3e6fde8f1726f..23175cb2bd866 100644
> > --- a/net/core/netmem_priv.h
> > +++ b/net/core/netmem_priv.h
> > @@ -8,18 +8,21 @@ static inline unsigned long netmem_get_pp_magic(netmem_ref netmem)
> >       return netmem_to_nmdesc(netmem)->pp_magic & ~PP_DMA_INDEX_MASK;
> >  }
> >
> > -static inline bool netmem_is_pp(netmem_ref netmem)
> > +static inline void netmem_or_pp_magic(netmem_ref netmem, unsigned long pp_magic)
> > +{
> > +     netmem_to_nmdesc(netmem)->pp_magic |= pp_magic;
> > +}
> > +
> > +static inline void netmem_clear_pp_magic(netmem_ref netmem)
> >  {
> > -     struct page *page;
> > +     WARN_ON_ONCE(netmem_to_nmdesc(netmem)->pp_magic & PP_DMA_INDEX_MASK);
> >
> > -     /* XXX: Now that the offset of page_type is shared between
> > -      * struct page and net_iov, just cast the netmem to struct page
> > -      * unconditionally by clearing NET_IOV if any, no matter whether
> > -      * it comes from struct net_iov or struct page.  This should be
> > -      * adjusted once the offset is no longer shared.
> > -      */
> > -     page = (struct page *)((__force unsigned long)netmem & ~NET_IOV);
> > -     return PageNetpp(page);
> > +     netmem_to_nmdesc(netmem)->pp_magic = 0;
> > +}
> > +
> > +static inline bool netmem_is_pp(netmem_ref netmem)
> > +{
> > +     return (netmem_get_pp_magic(netmem) & PP_MAGIC_MASK) == PP_SIGNATURE;
> >  }
> >
> >  static inline void netmem_set_pp(netmem_ref netmem, struct page_pool *pool)
> > diff --git a/net/core/page_pool.c b/net/core/page_pool.c
> > index 6e576dec80db4..8171d1173221b 100644
> > --- a/net/core/page_pool.c
> > +++ b/net/core/page_pool.c
> > @@ -707,18 +707,8 @@ s32 page_pool_inflight(const struct page_pool *pool, bool strict)
> >
> >  void page_pool_set_pp_info(struct page_pool *pool, netmem_ref netmem)
> >  {
> > -     struct page *page;
> > -
> >       netmem_set_pp(netmem, pool);
> > -
> > -     /* XXX: Now that the offset of page_type is shared between
> > -      * struct page and net_iov, just cast the netmem to struct page
> > -      * unconditionally by clearing NET_IOV if any, no matter whether
> > -      * it comes from struct net_iov or struct page.  This should be
> > -      * adjusted once the offset is no longer shared.
> > -      */
> > -     page = (struct page *)((__force unsigned long)netmem & ~NET_IOV);
> > -     __SetPageNetpp(page);
> > +     netmem_or_pp_magic(netmem, PP_SIGNATURE);
> >
> >       /* Ensuring all pages have been split into one fragment initially:
> >        * page_pool_set_pp_info() is only called once for every page when it
> > @@ -733,17 +723,7 @@ void page_pool_set_pp_info(struct page_pool *pool, netmem_ref netmem)
> >
> >  void page_pool_clear_pp_info(netmem_ref netmem)
> >  {
> > -     struct page *page;
> > -
> > -     /* XXX: Now that the offset of page_type is shared between
> > -      * struct page and net_iov, just cast the netmem to struct page
> > -      * unconditionally by clearing NET_IOV if any, no matter whether
> > -      * it comes from struct net_iov or struct page.  This should be
> > -      * adjusted once the offset is no longer shared.
> > -      */
> > -     page = (struct page *)((__force unsigned long)netmem & ~NET_IOV);
> > -     __ClearPageNetpp(page);
> > -
> > +     netmem_clear_pp_magic(netmem);
> >       netmem_set_pp(netmem, NULL);
> >  }
> >
> >
> > base-commit: 0cec77cfd5314c0b3b03530abe1a4b32e991f639
> > --
> > 2.17.1
> >