mm/codetag: clear tags before swap

When CONFIG_MEM_ALLOC_PROFILING_DEBUG is set, kernel WARN would be
triggered when calling __alloc_tag_ref_set() during swap:

	alloc_tag was not cleared (got tag for mm/filemap.c:1951)
	WARNING: CPU: 0 PID: 816 at ./include/linux/alloc_tag.h...

Clear code tags before swap can fix the warning. And this patch also fix
a potential invalid address dereference in alloc_tag_add_check() when
CONFIG_MEM_ALLOC_PROFILING_DEBUG is set and ref->ct is CODETAG_EMPTY,
which is defined as ((void *)1).

Link: https://lkml.kernel.org/r/[email protected]
Fixes: 51f43d5d82ed ("mm/codetag: swap tags when migrate pages")
Signed-off-by: David Wang <[email protected]>
Reported-by: kernel test robot <[email protected]>
Closes: https://lore.kernel.org/oe-lkp/[email protected]
Acked-by: Suren Baghdasaryan <[email protected]>
Cc: Kent Overstreet <[email protected]>
Cc: Yu Zhao <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>

diff --git a/include/linux/alloc_tag.h b/include/linux/alloc_tag.h
index 7c0786bdf9af07ca63bfcbbadc1088f45cb2ac06..cba024bf2db33667d4ec66da836fd119f74fbb34 100644 (file)
--- a/include/linux/alloc_tag.h
+++ b/include/linux/alloc_tag.h
@@ -135,7 +135,7 @@ static inline struct alloc_tag_counters alloc_tag_read(struct alloc_tag *tag)
 #ifdef CONFIG_MEM_ALLOC_PROFILING_DEBUG
 static inline void alloc_tag_add_check(union codetag_ref *ref, struct alloc_tag *tag)
 {
-       WARN_ONCE(ref && ref->ct,
+       WARN_ONCE(ref && ref->ct && !is_codetag_empty(ref),
                  "alloc_tag was not cleared (got tag for %s:%u)\n",
                  ref->ct->filename, ref->ct->lineno);
 

diff --git a/lib/alloc_tag.c b/lib/alloc_tag.c
index 35f7560a309a4737d3efeab3effe72271e8aff54..3a0413462e9fc2d02441608026810d715073903d 100644 (file)
--- a/lib/alloc_tag.c
+++ b/lib/alloc_tag.c
@@ -209,6 +209,13 @@ void pgalloc_tag_swap(struct folio *new, struct folio *old)
                return;
        }
 
+       /*
+        * Clear tag references to avoid debug warning when using
+        * __alloc_tag_ref_set() with non-empty reference.
+        */
+       set_codetag_empty(&ref_old);
+       set_codetag_empty(&ref_new);
+
        /* swap tags */
        __alloc_tag_ref_set(&ref_old, tag_new);
        update_page_tag_ref(handle_old, &ref_old);