Messages in this thread | | | Date | Mon, 28 Sep 2020 18:03:07 -0700 | From | Andrew Morton <> | Subject | Re: [PATCH v2] page_alloc: Fix freeing non-compound pages |
| |
On Sat, 26 Sep 2020 22:39:19 +0100 "Matthew Wilcox (Oracle)" <willy@infradead.org> wrote:
> Here is a very rare race which leaks memory:
Not worth a cc:stable?
> Page P0 is allocated to the page cache. Page P1 is free. > > Thread A Thread B Thread C > find_get_entry(): > xas_load() returns P0 > Removes P0 from page cache > P0 finds its buddy P1 > alloc_pages(GFP_KERNEL, 1) returns P0 > P0 has refcount 1 > page_cache_get_speculative(P0) > P0 has refcount 2 > __free_pages(P0)
__free_pages(P0, 1), I assume.
> P0 has refcount 1 > put_page(P0)
but this is implicitly order 0
> P1 is not freed
huh.
> Fix this by freeing all the pages in __free_pages() that won't be freed > by the call to put_page(). It's usually not a good idea to split a page, > but this is a very unlikely scenario. > > ... > > --- a/mm/page_alloc.c > +++ b/mm/page_alloc.c > @@ -4947,6 +4947,9 @@ void __free_pages(struct page *page, unsigned int order) > { > if (put_page_testzero(page)) > free_the_page(page, order); > + else if (!PageHead(page)) > + while (order-- > 0) > + free_the_page(page + (1 << order), order);
Well that's weird and scary looking. `page' has non-zero refcount yet we go and free random followon pages. Methinks it merits an explanatory comment?
| |