On Wed, Jun 03, 2026 at 10:33:04AM +0800, Miaohe Lin wrote: > On 2026/6/2 17:41, David Hildenbrand (Arm) wrote: > > On 6/2/26 05:08, Miaohe Lin wrote: > >> On 2026/6/1 21:22, David Hildenbrand (Arm) wrote: > >>> On 6/1/26 14:28, Miaohe Lin wrote: > >>>> > >>>> Thanks for your patch. > >>>> > >>>> > >>>> Once shake_page finds a lightweight range-based way to shrink slab, slab > >>>> pages could be freed > >>>> into buddy and above PageSlab test should be removed then. Maybe add a > >>>> TODO or XXX here? > >>>> > >>>> > >>>> I'm not sure but is it safe or a common way to test PageReserved, > >>>> PageSlab, > >>>> PageTable and PageLargeKmalloc without extra page refcnt? > >>> > >>> Checking typed pages in a racy fashion is fine (PageSlab, PageTable, > >>> PageLargeKmalloc). > >> > >> Got it. Thanks. > >> > >>> Checking PageReserved in a racy fashion is fine as well. TESTPAGEFLAG() > >>> will > >>> allow checking it on compound pages. > >> > >> It seems PageReserved is not intended to be set on compound pages. I see > >> there are PF_NO_COMPOUND > >> in its definition: PAGEFLAG(Reserved, reserved, PF_NO_COMPOUND). > >> > >>> > >>> For PageLargeKmalloc, we would want to check the head page, though. The > >>> page > >>> type is only stored for the head page. > >> > >> Maybe we should check the head page for PageSlab and PageTable too? > >> alloc_slab_page only > >> set PageSlab on the head page and __pagetable_ctor uses > >> __folio_set_pgtable to set PageTable > >> on folio. > >> > >>> > >>> So maybe we want to lookup the compound head (if any) and perform the type > >>> checks against that? > >> > >> Maybe we should or we might miss some pages that could have been handled. > >> And > >> if compound head is required, should we hold an extra page refcnt to guard > >> against > >> possible folio split race? > > > > Races are fine. We might miss some pages, but that can happen on races > > either way. > > > > > > I'd just do something like > > > > if (PageReserved(page)) > > return true; > > > > head = compound_head(page); > > If @head is split just after compound_head. And then @head is freed into > buddy and re-allocated as slab > page while @page is still in the buddy. We would panic on this scene as @head > is PageSlab. But we were > supposed to successfully handle @page. Or am I miss something?
You're right that it is racy, but I think it is an acceptable race here. For it to happen, the poisoned @page has to be a tail of a live compound page at the time of the fault, and then -- in the few instructions between compound_head() and the PageSlab(head) test -- that compound page has to be split, the old head freed to buddy, and that head re-allocated as a slab page, all while @page lands back in the buddy. It cannot happen without concurrent split/free/alloc activity in that exact window. It is also worth noting the page in question genuinely took a unrecoverable ECC error, and panic_on_unrecoverable_memory_failure is opt-in -- an operator who enables it has explicitly chosen to crash rather than risk running on corrupted memory. Mis-attributing one such rare, genuinely-poisoned page as unrecoverable is within that contract. Thanks for the review and discussions, --breno
