Re: [PATCH] mm/codetag: sub in advance when free non-compound high order pages

David Wang
2025-05-05T14:31:27Z

At 2025-05-05 21:12:55, "Vlastimil Babka" <vbabka@suse.cz> wrote:
>On 5/4/25 08:19, David Wang wrote:
>> When page is non-compound, page[0] could be released by other
>> thread right after put_page_testzero failed in current thread,
>> pgalloc_tag_sub_pages afterwards would manipulate an invalid
>> page for accounting remaining pages:
>>
>> [timeline] [thread1] [thread2]
>> | alloc_page non-compound
>> V
>> | get_page, rf counter inc
>> V
>> | in ___free_pages
>> | put_page_testzero fails
>> V
>> | put_page, page released
>> V
>> | in ___free_pages,
>> | pgalloc_tag_sub_pages
>> | manipulate an invalid page
>> V
>> V
>>
>> Move the tag page accounting ahead, and only account remaining pages
>> for non-compound pages with non-zero order.
>>
>> Signed-off-by: David Wang <00107082@163.com>
>
>Hmm, I think the problem was introduced by 51ff4d7486f0 ("mm: avoid extra
>mem_alloc_profiling_enabled() checks"). Previously we'd get the tag pointer
>upfront and avoid the page use-after-free.

Oh, you're right. I forgot to check history......

>
>It would likely be nicer to fix it by going back to that approach for
>___free_pages(), while hopefully keeping the optimisations of 51ff4d7486f0
>for the other call sites where it applies?

After checking that commit, I kind of feels the changes in __free_pages are
the major optimization of the commit....
What about revert that commit and make optimization by condition checks,
similar to what this patch did?

David