After WARN_ONCE is processed, the subsequent page judgment results
in NULL pointer access. It is more reasonable to return from the
function here.

Signed-off-by: Zhou Guanghui <zhouguanghui1@huawei.com>
---
 mm/huge_memory.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 834f288b3769..7f5ccca6792a 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1601,8 +1601,11 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
 			entry = pmd_to_swp_entry(orig_pmd);
 			page = pfn_swap_entry_to_page(entry);
 			flush_needed = 0;
-		} else
+		} else {
+			spin_unlock(ptl);
 			WARN_ONCE(1, "Non present huge pmd without pmd migration enabled!");
+			return 1;
+		}
 
 		if (PageAnon(page)) {
 			zap_deposited_table(tlb->mm, pmd);
-- 
2.17.1

On Fri, Jul 15, 2022 at 09:22:38AM +0000, Zhou Guanghui wrote:
> After WARN_ONCE is processed, the subsequent page judgment results
> in NULL pointer access. It is more reasonable to return from the
> function here.

I'm not sure this is a good idea.  Probably better to crash than
continue.

> Signed-off-by: Zhou Guanghui <zhouguanghui1@huawei.com>
> ---
>  mm/huge_memory.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 834f288b3769..7f5ccca6792a 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -1601,8 +1601,11 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
>  			entry = pmd_to_swp_entry(orig_pmd);
>  			page = pfn_swap_entry_to_page(entry);
>  			flush_needed = 0;
> -		} else
> +		} else {
> +			spin_unlock(ptl);
>  			WARN_ONCE(1, "Non present huge pmd without pmd migration enabled!");
> +			return 1;
> +		}
>  
>  		if (PageAnon(page)) {
>  			zap_deposited_table(tlb->mm, pmd);
> -- 
> 2.17.1
> 
>

On 2022/7/16 1:50, Matthew Wilcox wrote:
> On Fri, Jul 15, 2022 at 09:22:38AM +0000, Zhou Guanghui wrote:
>> After WARN_ONCE is processed, the subsequent page judgment results
>> in NULL pointer access. It is more reasonable to return from the
>> function here.
> 
> I'm not sure this is a good idea.  Probably better to crash than
> continue.

Except present pmd and pmd migration entry, there should be no other possible scenarios. Whether crash or warn is unnecessary. However, the current process that crashes after a warning is reported is not reasonable.

Like this:
if (pmd_present(orig_pmd)) {
	xxx
} else {
	swp_entry_t entry;

	VM_BUG_ON(!is_pmd_migration_entry(orig_pmd));
	entry = pmd_to_swp_entry(orig_pmd);
	page = pfn_to_page(swp_offset(entry));
	flush_needed = 0;
}

Thanks.

> 
>> Signed-off-by: Zhou Guanghui <zhouguanghui1@huawei.com>
>> ---
>>  mm/huge_memory.c | 5 ++++-
>>  1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
>> index 834f288b3769..7f5ccca6792a 100644
>> --- a/mm/huge_memory.c
>> +++ b/mm/huge_memory.c
>> @@ -1601,8 +1601,11 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
>>  			entry = pmd_to_swp_entry(orig_pmd);
>>  			page = pfn_swap_entry_to_page(entry);
>>  			flush_needed = 0;
>> -		} else
>> +		} else {
>> +			spin_unlock(ptl);
>>  			WARN_ONCE(1, "Non present huge pmd without pmd migration enabled!");
>> +			return 1;
>> +		}
>>  
>>  		if (PageAnon(page)) {
>>  			zap_deposited_table(tlb->mm, pmd);
>> -- 
>> 2.17.1
>>
>>
> 
> .