From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.2 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 610F2C2B9F4 for ; Mon, 28 Jun 2021 11:53:52 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id F396D61C70 for ; Mon, 28 Jun 2021 11:53:51 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org F396D61C70 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id EB9C28D002D; Mon, 28 Jun 2021 07:53:50 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E69868D002C; Mon, 28 Jun 2021 07:53:50 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CE37C8D002D; Mon, 28 Jun 2021 07:53:50 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0161.hostedemail.com [216.40.44.161]) by kanga.kvack.org (Postfix) with ESMTP id 9C4C98D002C for ; Mon, 28 Jun 2021 07:53:50 -0400 (EDT) Received: from smtpin28.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 88E49180ACEE4 for ; Mon, 28 Jun 2021 11:53:50 +0000 (UTC) X-FDA: 78302973420.28.28BB28E Received: from outbound-smtp24.blacknight.com (outbound-smtp24.blacknight.com [81.17.249.192]) by imf20.hostedemail.com (Postfix) with ESMTP id B775D37E for ; Mon, 28 Jun 2021 11:53:49 +0000 (UTC) Received: from mail.blacknight.com (pemlinmail03.blacknight.ie [81.17.254.16]) by outbound-smtp24.blacknight.com (Postfix) with ESMTPS id EA9AEC0B99 for ; Mon, 28 Jun 2021 12:53:47 +0100 (IST) Received: (qmail 18831 invoked from network); 28 Jun 2021 11:53:47 -0000 Received: from unknown (HELO techsingularity.net) (mgorman@techsingularity.net@[84.203.17.255]) by 81.17.254.9 with ESMTPSA (AES256-SHA encrypted, authenticated); 28 Jun 2021 11:53:47 -0000 Date: Mon, 28 Jun 2021 12:53:23 +0100 From: Mel Gorman To: Dave Jones , Andrew Morton , Dan Carpenter , Jesper Dangaard Brouer , Vlastimil Babka , Linux-MM , LKML , Linus Torvalds Subject: Re: [PATCH] mm/page_alloc: do bulk array bounds check after checking populated elements Message-ID: <20210628115322.GA3840@techsingularity.net> References: <20210618125102.GU30378@techsingularity.net> <20210628042759.GA19686@codemonkey.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-15 Content-Disposition: inline In-Reply-To: <20210628042759.GA19686@codemonkey.org.uk> User-Agent: Mutt/1.10.1 (2018-07-13) X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: B775D37E Authentication-Results: imf20.hostedemail.com; dkim=none; dmarc=none; spf=pass (imf20.hostedemail.com: domain of mgorman@techsingularity.net designates 81.17.249.192 as permitted sender) smtp.mailfrom=mgorman@techsingularity.net X-Stat-Signature: sfiuxehtmcacfywyfpdthe3gki436xpi X-HE-Tag: 1624881229-542057 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Jun 28, 2021 at 12:27:59AM -0400, Dave Jones wrote: > On Fri, Jun 18, 2021 at 01:51:02PM +0100, Mel Gorman wrote: > > Dan Carpenter reported the following > > > > The patch 0f87d9d30f21: "mm/page_alloc: add an array-based interface > > to the bulk page allocator" from Apr 29, 2021, leads to the following > > static checker warning: > > > > mm/page_alloc.c:5338 __alloc_pages_bulk() > > warn: potentially one past the end of array 'page_array[nr_populated]' > > > > The problem can occur if an array is passed in that is fully populated. That > > potentially ends up allocating a single page and storing it past the end of > > the array. This patch returns 0 if the array is fully populated. > > > > Fixes: 0f87d9d30f21 ("mm/page_alloc: add an array-based interface to the bulk page allocator") > > Reported-by: Dan Carpenter > > Signed-off-by: Mel Gorman > > --- > > mm/page_alloc.c | 4 ++++ > > 1 file changed, 4 insertions(+) > > > > diff --git a/mm/page_alloc.c b/mm/page_alloc.c > > index 7124bb00219d..ef2265f86b91 100644 > > --- a/mm/page_alloc.c > > +++ b/mm/page_alloc.c > > @@ -5056,6 +5056,10 @@ unsigned long __alloc_pages_bulk(gfp_t gfp, int preferred_nid, > > while (page_array && nr_populated < nr_pages && page_array[nr_populated]) > > nr_populated++; > > > > + /* Already populated array? */ > > + if (unlikely(page_array && nr_pages - nr_populated == 0)) > > + return 0; > > + > > /* Use the single page allocator for one page. */ > > if (nr_pages - nr_populated == 1) > > goto failed; > > > This made it into 5.13 final, and completely breaks NFSD for me (Serving tcp v3 mounts). > Existing mounts on clients hang, as do new mounts from new clients. > Rebooting the server back to rc7 everything recovers. Bisect lands on > this commit. > Thanks Dave, can you try this? diff --git a/mm/page_alloc.c b/mm/page_alloc.c index ef2265f86b91..04220581579c 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -5058,7 +5058,7 @@ unsigned long __alloc_pages_bulk(gfp_t gfp, int preferred_nid, /* Already populated array? */ if (unlikely(page_array && nr_pages - nr_populated == 0)) - return 0; + return nr_populated; /* Use the single page allocator for one page. */ if (nr_pages - nr_populated == 1)