VM_BUG_ON_PAGE(PageAnonNotKsm(page)) defconfig riscv64

VM_BUG_ON_PAGE(PageAnonNotKsm(page)) defconfig riscv64

[Miguel Ojeda]

Hi Matthew,

I noticed riscv64 defconfig seems to reproducibly hit
`VM_BUG_ON_PAGE(PageAnonNotKsm(page))` in today's next-20241004 --
please see below.

I hope that helps!

Cheers,
Miguel

[ 0.676534] Freeing unused kernel image (initmem) memory: 2260K
[ 0.677337] Run /init as init process
[ 0.680562] page: refcount:1 mapcount:1 mapping:0000000000000000
index:0xfffffffffff pfn:0x81034
[ 0.680882] memcg:ff60000001893000
[ 0.680993] anon flags: 0x20008(uptodate|swapbacked|zone=0)
[ 0.681620] raw: 0000000000020008 0000000000000000 dead000000000122
ff60000002751001
[ 0.681846] raw: 00000fffffffffff 0000000000000000 0000000100000000
ff60000001893000
[ 0.682098] page dumped because: VM_BUG_ON_PAGE(PageAnonNotKsm(page))
[ 0.682588] ------------[ cut here ]------------
[ 0.682691] kernel BUG at include/linux/page-flags.h:1134!
[ 0.682876] Kernel BUG [#1]
[ 0.682905] Modules linked in:
[ 0.683094] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted
6.12.0-rc1-next-20241004 #1
[ 0.683183] Hardware name: riscv-virtio,qemu (DT)
[ 0.683261] epc : folio_add_new_anon_rmap+0x330/0x518
[ 0.683623] ra : folio_add_new_anon_rmap+0x330/0x518
[ 0.683640] epc : ffffffff801ca72a ra : ffffffff801ca72a sp : ff200000000139d0
[ 0.683654] gp : ffffffff815223f8 tp : ff600000018a8000 t0 : 00000000000000bf
[ 0.683667] t1 : ff20000000013768 t2 : 0000000000000018 s0 : ff20000000013a10
[ 0.683679] s1 : ff1c000000040d00 a0 : 0000000000000039 a1 : f635137454d54500
[ 0.683691] a2 : f635137454d54500 a3 : 00000000ffffefff a4 : ffffffff8142e8b0
[ 0.683704] a5 : ffffffff8142e898 a6 : ffffffff8142e8b0 a7 : 0000000000000000
[ 0.683716] s2 : 0000000000000001 s3 : ff6000000274a000 s4 : 00fffffffffff000
[ 0.683728] s5 : 0000000000000fff s6 : 0000000000000001 s7 : 0000000000000001
[ 0.683741] s8 : ffffffff81526090 s9 : 0000000000000000 s10: ffffffff812c13c0
[ 0.683754] s11: ff6000000274a000 t3 : 0000000000000003 t4 : ff60000001870f00
[ 0.683766] t5 : ff60000001870000 t6 : ff60000001870f00
[ 0.683777] status: 0000000000000120 badaddr: 0000000000000000 cause:
0000000000000003
[ 0.683855] [<ffffffff801ca72a>] folio_add_new_anon_rmap+0x330/0x518
[ 0.683924] [<ffffffff801b9f20>] do_anonymous_page+0x2fc/0x4d6
[ 0.683936] [<ffffffff801bbcdc>] handle_pte_fault+0xe4/0x250
[ 0.683948] [<ffffffff801b47da>] handle_mm_fault+0x1c4/0x28e
[ 0.683958] [<ffffffff801aa322>] __get_user_pages+0x33c/0x78e
[ 0.683968] [<ffffffff801aaee0>] get_user_pages_remote+0x102/0x2da
[ 0.683977] [<ffffffff80228c7e>] get_arg_page+0xa8/0x14c
[ 0.683987] [<ffffffff80228a9a>] copy_string_kernel+0xe6/0x222
[ 0.683997] [<ffffffff8022a136>] kernel_execve+0x198/0x2c6

Re: VM_BUG_ON_PAGE(PageAnonNotKsm(page)) defconfig riscv64

[Nam Cao]

On Fri, Oct 04, 2024 at 03:09:22PM +0200, Miguel Ojeda wrote:
> Hi Matthew,
> 
> I noticed riscv64 defconfig seems to reproducibly hit
> `VM_BUG_ON_PAGE(PageAnonNotKsm(page))` in today's next-20241004 --
> please see below.
> 
> I hope that helps!

I can also reproduce this on arm64 with CONFIG_DEBUG_VM_PGFLAGS=y.

Looks like an invert logic bug from:
https://lore.kernel.org/linux-mm/20241002152533.1350629-5-willy@infradead.org/

I made the below changes and the problem goes away.

Best regards,
Nam

diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index fe9abdf26ab0..ccf3c78faefc 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -1131,14 +1131,14 @@ static __always_inline int PageAnonExclusive(const struct page *page)
 
 static __always_inline void SetPageAnonExclusive(struct page *page)
 {
-	VM_BUG_ON_PGFLAGS(PageAnonNotKsm(page), page);
+	VM_BUG_ON_PGFLAGS(!PageAnonNotKsm(page), page);
 	VM_BUG_ON_PGFLAGS(PageHuge(page) && !PageHead(page), page);
 	set_bit(PG_anon_exclusive, &PF_ANY(page, 1)->flags);
 }
 
 static __always_inline void ClearPageAnonExclusive(struct page *page)
 {
-	VM_BUG_ON_PGFLAGS(PageAnonNotKsm(page), page);
+	VM_BUG_ON_PGFLAGS(!PageAnonNotKsm(page), page);
 	VM_BUG_ON_PGFLAGS(PageHuge(page) && !PageHead(page), page);
 	clear_bit(PG_anon_exclusive, &PF_ANY(page, 1)->flags);
 }