From patchwork Fri Nov 24 10:16:52 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jesper Dangaard Brouer X-Patchwork-Id: 13467431 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9545FC61D97 for ; Fri, 24 Nov 2023 10:17:01 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 1AC566B0602; Fri, 24 Nov 2023 05:17:01 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 15AEB6B0603; Fri, 24 Nov 2023 05:17:01 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 04A626B0604; Fri, 24 Nov 2023 05:17:01 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id E70F76B0602 for ; Fri, 24 Nov 2023 05:17:00 -0500 (EST) Received: from smtpin24.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id B428DB68EA for ; Fri, 24 Nov 2023 10:17:00 +0000 (UTC) X-FDA: 81492444600.24.B783CB9 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf14.hostedemail.com (Postfix) with ESMTP id 063DD100015 for ; Fri, 24 Nov 2023 10:16:58 +0000 (UTC) Authentication-Results: imf14.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=uJyJbOmO; spf=pass (imf14.hostedemail.com: domain of hawk@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=hawk@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1700821019; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=Xbhyt/rWCJLJ1vJjo8fJKI/oxRSbBBUzaQSEGylY6ZI=; b=wF1MNZShZ2Rja0D8wT3f5ayJn0GC3+47bMbjWwTNBz2goTjw9RiTttToSXm4e4Sx/62h9J D09ucrzLeeLRY2VWw8CmYuNs8bKzUBefceeHBo3fuY6mjJ6TDNxJeTYbazh4qh78d+2AUT CztR45yHPh4/uZ2TgwRj7RRygieCZP0= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1700821019; a=rsa-sha256; cv=none; b=upKIytX2gg/YqfLCcYZP8ZCEVvN3XS8Lpwb+cgNBetnkiFdXKRx+vjsm+0YMsGqvVrQbck imCaJOZXQPRlIzLxaK7pAYh3t/AX5DKTdZCk+D++Gkz47zcHPDZRAopa7zy++rsrH7Q7ax MgW6cosC/VE8rsPBy9YqG8C/1WLyt/U= ARC-Authentication-Results: i=1; imf14.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=uJyJbOmO; spf=pass (imf14.hostedemail.com: domain of hawk@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=hawk@kernel.org; dmarc=pass (policy=none) header.from=kernel.org Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id E9FCD62128; Fri, 24 Nov 2023 10:16:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2F46FC433C8; Fri, 24 Nov 2023 10:16:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1700821017; bh=uKHj27pgxPKnUs9P/LiD5S+Q9YM+KGgU4rETYT0qdng=; h=Subject:From:To:Cc:Date:From; b=uJyJbOmOBAibq3lA951l5hET3O2sE8fzfV75AQYGk3H2bxqGz7Xv2SxHJ/DI4YNm/ wNTq1fggFPjfN2hAdKJnMdsvYY27z5uRUlJbKAB19E9N6t8lc/pgjede+HuFQcGAbi uu04iISyY1d3wEEvV9n5EuHN94Vgv3q08U2fYdJIBuZnbQ7ncb4rrUY/zG0yoggeZ2 9h9s6MFcDBq4EjJ8QRCphmPnrUnSyhKBLfrjL2NExugpifkB3J8oCgeiMSIboO3oh0 j+aPZoaJh86dQC5FJiYPzCzCjhiktBWxW0uCxz0hh4KNQebiN7ROVJrws3+0FwrKBH MHNOug/BVDNDA== Subject: [PATCH net-next] mm/page_pool: catch page_pool memory leaks From: Jesper Dangaard Brouer To: netdev@vger.kernel.org, Jakub Kicinski , vbabka@suse.cz Cc: Jesper Dangaard Brouer , bpf@vger.kernel.org, Eric Dumazet , "David S. Miller" , Paolo Abeni , linux-mm@kvack.org, Andrew Morton , Mel Gorman , Matthew Wilcox , kernel-team@cloudflare.com Date: Fri, 24 Nov 2023 11:16:52 +0100 Message-ID: <170082101266.1085481.12199867179160710331.stgit@firesoul> User-Agent: StGit/1.5 MIME-Version: 1.0 X-Stat-Signature: p16d8rm8uk1t6wytg46k1x1no5jfpd5c X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 063DD100015 X-Rspam-User: X-HE-Tag: 1700821018-672900 X-HE-Meta: U2FsdGVkX1/B/6Ogu9/NZ+HQeoNxP++bx1hDvS+XNwaBcEElc2kSYU03f1iQPbUiaNVdP5wEOvlqJCccdL58kFh0NTaVr30RjzYolPRo8dZuMdtRJXn5dd+7WIJ09uBtZjp+yp3SxSos01gL3LTeROKhErWm6PpY6NP8N9AV0h6ge/w5N1khoCUks0CkD4QHnQMTh2tdNN0JSHdmRzwczgSt0H/PF4fjIYLuTWcvozQrujqNfyuct2leJpuYigjaC45dpGVZeueUiy2xGZTU/LBfZ0/b+A6C9ELtz9zLnoNq69tdgyIttJSePEBlYWDkE4uYR5Ua7jWo6HlcY0478qzg+prciRNU0qvg8rZ19v17N06pcC1QDJ0SNuP04HKSkyCQKP1gh6k9tSO21I38un7YNhDlLaBHisyZAzVCIlAnkQu6wiD/Kxkm6AxWIlbj7Rizb2TqPtDN7DHUdDXfyjE8DJodm39oJphbkJqm5IrEY6xseEFp6ZRt8e0bDfc3TEqpqsicXa8NcP9kHyDk5ionFJY3zSvs26QwvomFCl/PUJBA0rCvenu1S7p9qebxmDcmXbXf/IZLzwjyCgNWCGr27saBesbbELv05IqFkaa8H6WZQNhcGQBio5Q6tVx3ZvpKE3fsK4IUHbBuAdvTsGI3TTOwXh6ugZJX56Qyjw2XZ9dNITi7QWAW04BJ5ad+x79Ad99JAvwB1yACDrKIeqhGUT5v6wKVnXDYtKjxMmhUBVW3g8GI3fvjADUsYr8X8x3+t0+y0XXZorUD4u6hZeC99BEp6x4aNaps5wwYE4QdGndj1QwFTqitva/Mdct08dx938XOzOvBRmDmOooIjN5KBw9iXoiSVspLYKp7XDE8WigzrBze1vc44bcaA9DkcsYNSabKxWm1lgpjqNPei4FfiqprFLoMhmKvvL4Oj1Br32iKoEWcHYymviQPmu69WHT2r3kImfJyYe87r00 oAZdZ/co 8KQRkFojj97iL9zeYnpWykym5cBWbxYIxi5li5ITGfusgVRorK6YhtiHhtuIwjrb4Saflr57nPfJGx6fjfbJhAg2aj6WWr4Km/eIAtmGNAW8KMIds4Zy7WbFy/h5gkaVaq6DyAqpxfHAGcuuEfSpmyT6rKutIr91INAQYBRABzBrJnApe2FHw2vUUttUwhbHGCA76sLCgXSuxpmNhjmBX166WloyGb5c2TnVSc5I3FKO9GVxK2KaxAqdiCvNh8mz8PSMVNWro4dH+plISPIpdDX1UOrRjOvVqbABjtP5QX9FZNtSklABZhlVXbME8mgnb+SVyF6axEQMZwKkREwhsh449oe5Jw060lJ9YIG+vHYroxyg= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Pages belonging to a page_pool (PP) instance must be freed through the PP APIs in-order to correctly release any DMA mappings and release refcnt on the DMA device when freeing PP instance. When PP release a page (page_pool_release_page) the page->pp_magic value is cleared. This patch detect a leaked PP page in free_page_is_bad() via unexpected state of page->pp_magic value being PP_SIGNATURE. We choose to report and treat it as a bad page. It would be possible to release the page via returning it to the PP instance as the page->pp pointer is likely still valid. Notice this code is only activated when either compiled with CONFIG_DEBUG_VM or boot cmdline debug_pagealloc=on, and CONFIG_PAGE_POOL. Reduced example output of leak with PP_SIGNATURE = dead000000000040: BUG: Bad page state in process swapper/4 pfn:141fa6 page:000000006dbf8062 refcount:0 mapcount:0 mapping:0000000000000000 index:0x141fa6000 pfn:0x141fa6 flags: 0x2fffff80000000(node=0|zone=2|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 002fffff80000000 dead000000000040 ffff88814888a000 0000000000000000 raw: 0000000141fa6000 0000000000000001 00000000ffffffff 0000000000000000 page dumped because: page_pool leak [...] Call Trace: dump_stack_lvl+0x32/0x50 bad_page+0x70/0xf0 free_unref_page_prepare+0x263/0x430 free_unref_page+0x34/0x130 mlx5e_free_rx_mpwqe+0x190/0x1c0 [mlx5_core] mlx5e_post_rx_mpwqes+0x1ac/0x280 [mlx5_core] mlx5e_napi_poll+0x12b/0x710 [mlx5_core] ? skb_free_head+0x4f/0x90 __napi_poll+0x2b/0x1c0 net_rx_action+0x27b/0x360 The advantage is the Call Trace directly points to the function leaking the PP page, which in this case is an on purpose bug introduced into the mlx5 driver to test this code change. Currently PP will periodically in page_pool_release_retry() printk warning "stalled pool shutdown" which cannot be directly corrolated to leaking and might as well be a false positive due to SKBs being stuck on a socket for an extended period. After this patch we should be able to remove this printk. Signed-off-by: Jesper Dangaard Brouer --- mm/page_alloc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 733732e7e0ba..37ca4f4b62bf 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -915,6 +915,9 @@ static inline bool page_expected_state(struct page *page, page_ref_count(page) | #ifdef CONFIG_MEMCG page->memcg_data | +#endif +#ifdef CONFIG_PAGE_POOL + ((page->pp_magic & ~0x3UL) == PP_SIGNATURE) | #endif (page->flags & check_flags))) return false; @@ -941,6 +944,10 @@ static const char *page_bad_reason(struct page *page, unsigned long flags) #ifdef CONFIG_MEMCG if (unlikely(page->memcg_data)) bad_reason = "page still charged to cgroup"; +#endif +#ifdef CONFIG_PAGE_POOL + if (unlikely((page->pp_magic & ~0x3UL) == PP_SIGNATURE)) + bad_reason = "page_pool leak"; #endif return bad_reason; }