From: Ye Liu <ye.liu@linux.dev>
To: Andrew Morton <akpm@linux-foundation.org>, Zi Yan <ziy@nvidia.com>
Cc: Ye Liu <ye.liu@linux.dev>, Vlastimil Babka <vbabka@kernel.org>,
Suren Baghdasaryan <surenb@google.com>,
Michal Hocko <mhocko@suse.com>,
Brendan Jackman <jackmanb@google.com>,
Johannes Weiner <hannes@cmpxchg.org>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org
Subject: [PATCH v5 0/9] mm/page_owner: misc cleanups
Date: Wed, 1 Jul 2026 14:10:43 +0800 [thread overview]
Message-ID: <20260701061101.344679-1-ye.liu@linux.dev> (raw)
v5:
- Place the two patches corresponding to the Close connection, patch8
and patch9, together in this part.
- Close: https://lore.kernel.org/all/20260625014708.87386-1-ye.liu@linux.dev/
- Link: https://lore.kernel.org/all/20260701012239.315262-1-ye.liu@linux.dev/
v4:
- Patch 2: also update scripts/gdb/linux/page_owner.py to use MR_NEVER
instead of the hardcoded -1.
- https://lore.kernel.org/all/20260630015331.147174-1-ye.liu@linux.dev/
v3:
- Patch 2: add MR_NEVER directly to enum migrate_reason instead of
using a local MIGRATE_REASON_NONE define (Zi Yan and Vlastimil Babka).
- Patch 3 (new): convert all 'int reason' parameters in the migration
callchain to 'enum migrate_reason' so the type system reflects the
actual semantics.
- Patch 7: make threshold_fops a single line.
- Link: https://lore.kernel.org/all/20260626020522.28619-1-ye.liu@linux.dev/
v2:
- Add cover letter (no code changes).
- Link: https://lore.kernel.org/all/20260623065234.31866-2-ye.liu@linux.dev/
This series collects a few cleanups for mm/page_owner.c that have been
accumulated while reading through the file. There is no functional
change -- the goal is to make the code easier to read and maintain.
Patch 1 consolidates three identical PageBuddy skip blocks into a
single skip_buddy_pages() helper, eliminating the duplication and
keeping the lockless-read comment in one place.
Patch 2 replaces the -1 magic number used for "never migrated" with a
proper MR_NEVER member in enum migrate_reason, adds the corresponding
"never_migrated" string in the MIGRATE_REASON trace macro, and updates
the GDB page_owner script to use MR_NEVER so that lx-dump-page-owner
correctly detects unmigrated pages.
Patch 3 follows up by converting the remaining 'int reason' parameters
throughout the migration and hugetlb callchains to 'enum migrate_reason',
making the type explicit and gaining compiler checking. The 'short
last_migrate_reason' struct field in page_owner is intentionally left
as 'short' since it is per-page metadata where size matters.
Patch 4 hoists the CONFIG_MEMCG guard out of print_page_owner_memcg()'s
body so that the real implementation and the empty stub are two clearly
separate definitions, the common kernel idiom.
Patch 5 adds a missing \n to the count_threshold debugfs attribute
format string so that cat(1) output is properly terminated.
Patch 6 moves free_ts_nsec from the allocation summary line to the
free section in __dump_page_owner(), grouping it with free_pid and
free_tgid where it logically belongs. This also makes the dump
output consistent with print_page_owner().
Patch 7 drops the redundant page_owner_ prefix from file-scoped static
symbols (stack_fops, threshold_fops, etc.). Since they cannot collide
across translation units, the prefix carries no information.
Patch 8 clamps the PFN advance in skip_buddy_pages() at the next
MAX_ORDER_NR_PAGES boundary. The lockless buddy_order_unsafe() read
can return a garbage order value if the page is concurrently allocated
between the PageBuddy check and the private read, potentially causing
the PFN to advance past the next bounadry whose pfn_valid() check
would have caught an offline memory section. In read_page_owner(),
which relies solely on boundary-aligned pfn_valid() to guard
pfn_to_page(), this could lead to an unmapped mem_section access.
Patch 9 avoids a TOCTOU VM_BUG_ON in print_page_owner_memcg() by
reusing the page->memcg_data snapshot already taken via READ_ONCE at
the top of the function, instead of calling PageMemcgKmem() which
re-reads folio->memcg_data and page->compound_head locklessly with
VM_BUG_ON assertions. If the page is concurrently freed and
reallocated as a THP tail or slab page between the initial guards and
this final call, those assertions can fire on CONFIG_DEBUG_VM=y builds.
Ye Liu (9):
mm/page_owner: extract skip_buddy_pages() helper to unify buddy page
skipping
mm/page_owner: add MR_NEVER to enum migrate_reason and use it for
last_migrate_reason
mm: use enum migrate_reason instead of int for migration reason
parameters
mm/page_owner: hoist CONFIG_MEMCG to function level for
print_page_owner_memcg()
mm/page_owner: add missing newline to count_threshold format string
mm/page_owner: move free_ts_nsec output to free section in
__dump_page_owner()
mm/page_owner: drop redundant page_owner prefix from static symbols
mm/page_owner: clamp skip_buddy_pages() PFN advance at
MAX_ORDER_NR_PAGES boundary
mm/page_owner: use memcg_data snapshot instead of PageMemcgKmem() to
avoid TOCTOU VM_BUG_ON
include/linux/hugetlb.h | 9 ++-
include/linux/migrate.h | 6 +-
include/linux/migrate_mode.h | 1 +
include/linux/page_owner.h | 7 +-
include/trace/events/migrate.h | 11 +--
mm/hugetlb.c | 3 +-
mm/migrate.c | 12 +--
mm/page_owner.c | 127 ++++++++++++++++++--------------
scripts/gdb/linux/page_owner.py | 4 +-
9 files changed, 102 insertions(+), 78 deletions(-)
--
2.43.0
next reply other threads:[~2026-07-01 6:11 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-01 6:10 Ye Liu [this message]
2026-07-01 6:10 ` [PATCH v5 1/9] mm/page_owner: extract skip_buddy_pages() helper to unify buddy page skipping Ye Liu
2026-07-01 6:10 ` [PATCH v5 2/9] mm/page_owner: add MR_NEVER to enum migrate_reason and use it for last_migrate_reason Ye Liu
2026-07-01 6:10 ` [PATCH v5 3/9] mm: use enum migrate_reason instead of int for migration reason parameters Ye Liu
2026-07-01 10:23 ` Lorenzo Stoakes
2026-07-01 6:10 ` [PATCH v5 4/9] mm/page_owner: hoist CONFIG_MEMCG to function level for print_page_owner_memcg() Ye Liu
2026-07-01 6:10 ` [PATCH v5 5/9] mm/page_owner: add missing newline to count_threshold format string Ye Liu
2026-07-01 6:10 ` [PATCH v5 6/9] mm/page_owner: move free_ts_nsec output to free section in __dump_page_owner() Ye Liu
2026-07-01 6:10 ` [PATCH v5 7/9] mm/page_owner: drop redundant page_owner prefix from static symbols Ye Liu
2026-07-01 6:10 ` [PATCH v5 8/9] mm/page_owner: clamp skip_buddy_pages() PFN advance at MAX_ORDER_NR_PAGES boundary Ye Liu
2026-07-01 6:34 ` Vlastimil Babka (SUSE)
2026-07-01 6:10 ` [PATCH v5 9/9] mm/page_owner: use memcg_data snapshot instead of PageMemcgKmem() to avoid TOCTOU VM_BUG_ON Ye Liu
2026-07-01 6:49 ` Vlastimil Babka (SUSE)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260701061101.344679-1-ye.liu@linux.dev \
--to=ye.liu@linux.dev \
--cc=akpm@linux-foundation.org \
--cc=hannes@cmpxchg.org \
--cc=jackmanb@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@suse.com \
--cc=surenb@google.com \
--cc=vbabka@kernel.org \
--cc=ziy@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox