FAILED: patch "[PATCH] mm/mglru: fix and remove redundant unevictable folio handling" failed to apply to 6.12-stable tree
Subsystems (4)
[email protected]
maintainerThe patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x f7e698e326b239a91ea15844817551921209e826
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090303-freezable-flatness-e858@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From f7e698e326b239a91ea15844817551921209e826 Mon Sep 17 00:00:00 2001
From: Kairui Song <[email protected]>
Date: Wed, 12 Aug 2026 20:22:39 +0800
Subject: [PATCH] mm/mglru: fix and remove redundant unevictable folio handling
sort_folio() has a shortcut for moving folios that are no longer evictable but are still sitting on a generation list. However, this shortcut is buggy. It does not follow the PG_lru usage convention, and it has a more serious issue.
Unevictable folios are not threaded on lists[LRU_UNEVICTABLE], so that folio->lru can be reused to hold folio->mlock_count (see the comment in lruvec_init()). Hence lruvec_add_folio() skips the list_add() for them, and every other place that turns a folio unevictable initialises mlock_count explicitly: lru_add() sets it to 0, __mlock_folio() and __mlock_new_folio() set it to !!folio_test_mlocked(folio). sort_folio() sets nothing, and the lru_gen_del_folio() right above it may have already poisoned folio->lru via list_del(), so mlock_count ends up aliasing LIST_POISON2, which reads as 0x122, i.e. 290. The result is user visible. On munlock, __munlock_folio() decrements that bogus count, finds it still non-zero and bails out before clearing PG_mlocked, so the folio remains unevictable and the Mlocked accounting stays inflated until the folio is freed.
The shortcut also touches the LRU flags in the wrong order. It calls lru_gen_del_folio() while PG_lru is still set, so a concurrent folio_test_clear_lru() (e.g. compaction, folio_isolate_lru()) can succeed on a folio that has already been taken off the generation list, which may lead to unexpected behavior.
So fix it by isolating them as common folios and letting the generic shrink path cull them. This matches the classical LRU behavior, and there should be no visible effect on the generic eviction or isolation behavior.
There is no performance concern either, such a folio goes through this once, and then it is off the generation lists for good.
mm/vmscan.c +5 -14
@@ -4649,7 +4649,6 @@ void lru_gen_reparent_memcg(struct mem_cgroup *memcg, struct mem_cgroup *parent,static bool sort_folio (struct lruvec *lruvec,struct folio *folio,struct scan_control *sc,int tier_idx) { -bool success;int gen =folio_lru_gen (folio);int type =folio_is_file_lru (folio);int zone =folio_zonenum (folio);
@@ -4661,15 +4660,9 @@ static bool sort_folio(struct lruvec *lruvec, struct folio *folio, struct scan_cVM_WARN_ON_ONCE_FOLIO (gen >=MAX_NR_GENS , folio); -/* unevictable */ -if (!folio_evictable (folio)) { - success =lru_gen_del_folio (lruvec, folio, true); -VM_WARN_ON_ONCE_FOLIO (!success, folio); -folio_set_unevictable (folio); -lruvec_add_folio (lruvec, folio); -__count_vm_events (UNEVICTABLE_PGCULLED , delta); -return true; - } +/* unevictable: let it through and the generic path will cull it */ +if (!folio_evictable (folio)) +return false;/* promoted */ if (gen !=lru_gen_from_seq (lrugen->min_seq[type])) {
@@ -4922,11 +4915,9 @@ static int evict_folios(unsigned long nr_to_scan, struct lruvec *lruvec,list_for_each_entry_safe_reverse (folio, next, &list, lru) {DEFINE_MIN_SEQ (lruvec); -if (!folio_evictable (folio)) { -list_del (&folio->lru); -folio_putback_lru (folio); +/* move_folios_to_lru() culls unevictable folios via folio_putback_lru() */ +if (!folio_evictable (folio))continue ; - }/* retry folios that may have missed folio_rotate_reclaimable() */ if (!skip_retry && !folio_test_active(folio) && !folio_mapped(folio) &&
Sasha Levin
maintainerPATCH 1/4 mm/mglru: reset page lru tier bits when activating
From: Wei Xu <[email protected]>
[ Upstream commit f1001f3d3b6868998cab73d10fda1a5c99ddf963 ]
When a folio is activated, lru_gen_add_folio() moves the folio to the youngest generation. But unlike folio_update_gen()/folio_inc_gen(), lru_gen_add_folio() doesn't reset the folio lru tier bits (LRU_REFS_MASK | LRU_REFS_FLAGS). This inconsistency can affect how pages are aged via folio_mark_accessed() (e.g. fd accesses), though no user visible impact related to this has been detected yet.
Note that lru_gen_add_folio() cannot clear PG_workingset if the activation is due to workingset refault, otherwise PSI accounting will be skipped. So fix lru_gen_add_folio() to clear the lru tier bits other than PG_workingset when activating a folio, and also clear all the lru tier bits when a folio is activated via folio_activate() in lru_gen_look_around().
Stable-dep-of: f7e698e326b2 ("mm/mglru: fix and remove redundant unevictable folio handling")
--- include/linux/mm_inline.h | 15 ++++++++++++++- include/linux/mmzone.h | 2 ++ mm/vmscan.c | 8 ++++---- 3 files changed, 20 insertions(+), 5 deletions(-)
include/linux/mm_inline.h +14 -1
@@ -155,6 +155,11 @@ static inline int folio_lru_refs(struct folio *folio)return ((flags &LRU_REFS_MASK ) >>LRU_REFS_PGOFF ) + workingset; } +static inline void folio_clear_lru_refs (struct folio *folio) +{ +set_mask_bits (&folio->flags,LRU_REFS_MASK |LRU_REFS_FLAGS ,0 ); +} +static inline int folio_lru_gen (struct folio *folio) {unsigned long flags =READ_ONCE (folio->flags);
@@ -222,6 +227,7 @@ static inline bool lru_gen_add_folio(struct lruvec *lruvec, struct folio *folio, {unsigned long seq;unsigned long flags; +unsigned long mask;int gen =folio_lru_gen (folio);int type =folio_is_file_lru (folio);int zone =folio_zonenum (folio);
@@ -257,7 +263,14 @@ static inline bool lru_gen_add_folio(struct lruvec *lruvec, struct folio *folio, gen =lru_gen_from_seq (seq); flags = (gen +1UL ) <<LRU_GEN_PGOFF ;/* see the comment on MIN_NR_GENS about PG_active */ -set_mask_bits (&folio->flags,LRU_GEN_MASK |BIT (PG_active), flags); + mask =LRU_GEN_MASK ; +/* +* Don't clear PG_workingset here because it can affect PSI accounting +* if the activation is due to workingset refault. +*/ +if (folio_test_active (folio)) + mask |=LRU_REFS_MASK |BIT (PG_referenced) |BIT (PG_active); +set_mask_bits (&folio->flags, mask, flags);lru_gen_update_size (lruvec, folio,-1 , gen);/* for folio_rotate_reclaimable() */
include/linux/mmzone.h +2 -0
@@ -403,6 +403,8 @@ enum { NR_LRU_GEN_CAPS }; +#define LRU_REFS_FLAGS (BIT(PG_referenced) | BIT(PG_workingset)) +#define MIN_LRU_BATCH BITS_PER_LONG#define MAX_LRU_BATCH (MIN_LRU_BATCH * 64)
mm/vmscan.c +4 -4
@@ -2625,8 +2625,6 @@ static bool should_clear_pmd_young(void)* shorthand helpers ******************************************************************************/ -#define LRU_REFS_FLAGS (BIT(PG_referenced) | BIT(PG_workingset)) -#define DEFINE_MAX_SEQ (lruvec) \ unsigned long max_seq = READ_ONCE((lruvec)->lrugen.max_seq)
@@ -4157,8 +4155,10 @@ bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw) old_gen =folio_lru_gen (folio);if (old_gen <0 )folio_set_referenced (folio); -else if (old_gen != new_gen) +else if (old_gen != new_gen) { +folio_clear_lru_refs (folio);folio_activate (folio); + } }arch_leave_lazy_mmu_mode ();
@@ -4400,7 +4400,7 @@ static bool isolate_folio(struct lruvec *lruvec, struct folio *folio, struct sca/* see the comment on MAX_NR_TIERS */ if (!folio_test_referenced (folio)) -set_mask_bits (&folio->flags,LRU_REFS_MASK |LRU_REFS_FLAGS ,0 ); +folio_clear_lru_refs (folio);/* for shrink_folio_list() */ folio_clear_reclaim (folio);
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/4 mm/mglru: optimize deactivation
From: Yu Zhao <[email protected]>
[ Upstream commit cc8ec7be78ffaa29f6e0781fd12602974970eb53 ]
Do not shuffle a folio in the deactivation paths if it is already in the oldest generation. This reduces the LRU lock contention.
Before this patch, the contention is reproducible by FIO, e.g.,
fio -filename=/dev/nvme1n1p2 -direct=0 -thread -size=1024G \
-rwmixwrite=30 --norandommap --randrepeat=0 -ioengine=sync \
-bs=4k -numjobs=400 -runtime=25000 --time_based \
-group_reporting -name=mglru98.96%--_raw_spin_lock_irqsave
folio_lruvec_lock_irqsave
|
--98.78%--folio_batch_move_lru
|
--98.63%--deactivate_file_folio
mapping_try_invalidate
invalidate_mapping_pages
invalidate_bdev
blkdev_common_ioctl
blkdev_ioctlAfter this patch, deactivate_file_folio() bails out early without taking the LRU lock.
A side effect is that a folio can be left at the head of the oldest generation, rather than the tail. If reclaim happens at the same time, it cannot reclaim this folio immediately. Since there is no known correlation between truncation and reclaim, this side effect is considered insignificant.
Stable-dep-of: f7e698e326b2 ("mm/mglru: fix and remove redundant unevictable folio handling")
--- mm/swap.c | 49 +++++++++++++++++++++++++++++++++++++++++-------- mm/vmscan.c | 38 ++++++++++++++++++++++++++++++-------- 2 files changed, 71 insertions(+), 16 deletions(-)
mm/swap.c +41 -8
@@ -411,7 +411,8 @@ static void __lru_cache_activate_folio(struct folio *folio) }#ifdef CONFIG_LRU_GEN -static void folio_inc_refs (struct folio *folio) + +static void lru_gen_inc_refs (struct folio *folio) {unsigned long new_flags, old_flags =READ_ONCE (folio->flags);
@@ -438,10 +439,34 @@ static void folio_inc_refs(struct folio *folio) new_flags |= old_flags & ~LRU_REFS_MASK; }while (!try_cmpxchg (&folio->flags, &old_flags, new_flags)); } -#else -static void folio_inc_refs (struct folio *folio) + +static bool lru_gen_clear_refs (struct folio *folio) +{ +struct lru_gen_folio *lrugen; +int gen =folio_lru_gen (folio); +int type =folio_is_file_lru (folio); + +if (gen <0 ) +return true; + +set_mask_bits (&folio->flags,LRU_REFS_MASK |LRU_REFS_FLAGS ,0 ); + + lrugen = &folio_lruvec (folio)->lrugen; +/* whether can do without shuffling under the LRU lock */ +return gen ==lru_gen_from_seq (READ_ONCE (lrugen->min_seq[type])); +} + +#else /* !CONFIG_LRU_GEN */ + +static void lru_gen_inc_refs (struct folio *folio) +{ +} + +static bool lru_gen_clear_refs (struct folio *folio) { +return false; } +#endif /* CONFIG_LRU_GEN */ /**
@@ -460,7 +485,7 @@ static void folio_inc_refs(struct folio *folio)void folio_mark_accessed (struct folio *folio) {if (lru_gen_enabled ()) { -folio_inc_refs (folio); +lru_gen_inc_refs (folio);return ; }
@@ -556,7 +581,7 @@ void folio_add_lru_vma(struct folio *folio, struct vm_area_struct *vma)*/ static void lru_deactivate_file (struct lruvec *lruvec,struct folio *folio) { -bool active =folio_test_active (folio); +bool active =folio_test_active (folio) ||lru_gen_enabled ();long nr_pages =folio_nr_pages (folio);if (folio_test_unevictable (folio))
@@ -621,7 +646,10 @@ static void lru_lazyfree(struct lruvec *lruvec, struct folio *folio)lruvec_del_folio (lruvec, folio);folio_clear_active (folio); -folio_clear_referenced (folio); +if (lru_gen_enabled ()) +lru_gen_clear_refs (folio); +else +folio_clear_referenced (folio);/* * Lazyfree folios are clean anonymous folios. They have * the swapbacked flag cleared, to distinguish them from normal
@@ -689,6 +717,9 @@ void deactivate_file_folio(struct folio *folio)if (folio_test_unevictable (folio) || !folio_test_lru (folio))return ; +if (lru_gen_enabled () &&lru_gen_clear_refs (folio)) +return ; +folio_batch_add_and_move (folio, lru_deactivate_file); }
@@ -702,8 +733,10 @@ void deactivate_file_folio(struct folio *folio)*/ void folio_deactivate (struct folio *folio) { -if (folio_test_unevictable (folio) || !folio_test_lru (folio) || - !(folio_test_active (folio) ||lru_gen_enabled ())) +if (folio_test_unevictable (folio) || !folio_test_lru (folio)) +return ; + +if (lru_gen_enabled () ?lru_gen_clear_refs (folio) : !folio_test_active (folio))return ;folio_batch_add_and_move (folio, lru_deactivate);
mm/vmscan.c +30 -8
@@ -4313,7 +4313,6 @@ static bool sort_folio(struct lruvec *lruvec, struct folio *folio, struct scan_c int tier_idx) {bool success; -bool dirty, writeback;int gen =folio_lru_gen (folio);int type =folio_is_file_lru (folio);int zone =folio_zonenum (folio);
@@ -4359,8 +4358,9 @@ static bool sort_folio(struct lruvec *lruvec, struct folio *folio, struct scan_creturn true; } - dirty =folio_test_dirty (folio); - writeback =folio_test_writeback (folio); +bool dirty =folio_test_dirty (folio); +bool writeback =folio_test_writeback (folio); +if (type ==LRU_GEN_FILE && dirty) { sc->nr.file_taken += delta;if (!writeback)
@@ -4627,12 +4627,23 @@ static int evict_folios(struct lruvec *lruvec, struct scan_control *sc, int swap type ? LRU_INACTIVE_FILE : LRU_INACTIVE_ANON);list_for_each_entry_safe_reverse (folio, next, &list, lru) { +DEFINE_MIN_SEQ (lruvec); +if (!folio_evictable (folio)) {list_del (&folio->lru);folio_putback_lru (folio);continue ; } +/* retry folios that may have missed folio_rotate_reclaimable() */ +if (!skip_retry && !folio_test_active (folio) && !folio_mapped (folio) && + !folio_test_dirty (folio) && !folio_test_writeback (folio)) { +if (!folio_test_referenced (folio) && !folio_test_locked (folio)) { +list_move (&folio->lru, &clean); +continue ; + } + } +if (folio_test_reclaim (folio) && (folio_test_dirty (folio) ||folio_test_writeback (folio))) {/* restore LRU_REFS_FLAGS cleared by isolate_folio() */
@@ -4644,14 +4655,25 @@ static int evict_folios(struct lruvec *lruvec, struct scan_control *sc, int swapif (skip_retry ||folio_test_active (folio) ||folio_test_referenced (folio) ||folio_mapped (folio) ||folio_test_locked (folio) ||folio_test_dirty (folio) ||folio_test_writeback (folio)) { +unsigned long seq =READ_ONCE (lruvec->lrugen.max_seq); +/* don't add rejected folios to the oldest generation */ -set_mask_bits (&folio->flags,LRU_REFS_MASK |LRU_REFS_FLAGS , -BIT (PG_active)); +if (!folio_test_active (folio)) { +if ((type ==LRU_GEN_ANON && !folio_test_swapcache (folio)) || + (folio_test_reclaim (folio) && + (folio_test_dirty (folio) ||folio_test_writeback (folio)))) + seq--; +else if (min_seq[type] +MIN_NR_GENS < seq) + seq = min_seq[type] +1 ; +else + seq = min_seq[type]; + } + +if (seq == min_seq[type]) +set_mask_bits (&folio->flags,LRU_REFS_MASK |LRU_REFS_FLAGS , +BIT (PG_active));continue ; } - -/* retry folios that may have missed folio_rotate_reclaimable() */ -list_move (&folio->lru, &clean); }spin_lock_irq (&lruvec->lru_lock);
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 3/4 mm/mglru: use the common routine for dirty/writeback reactivation
In reply to Sasha LevinFrom: Kairui Song <[email protected]>
[ Upstream commit 75d4c3f5fb980de1b620adede47e43dff4d6a5f3 ]
Currently MGLRU will move the dirty writeback folios to the second oldest gen instead of reactivate them like the classical LRU. This might help to reduce the LRU contention as it skipped the isolation. But as a result we will see these folios at the LRU tail more frequently leading to inefficient reclaim.
Besides, the dirty / writeback check after isolation in shrink_folio_list is more accurate and covers more cases. So instead, just drop the special handling for dirty writeback, use the common routine and re-activate it like the classical LRU.
This should in theory improve the scan efficiency. These folios will be rotated back to LRU tail once writeback is done so there is no risk of hotness inversion. And now each reclaim loop will have a higher success rate. This also prepares for unifying the writeback and throttling mechanism with classical LRU, we keep these folios far from tail so detecting the tail batch will have a similar pattern with classical LRU.
The micro optimization that avoids LRU contention by skipping the isolation is gone, which should be fine. Compared to IO and writeback cost, the isolation overhead is trivial.
And using the common routine also keeps the folio's referenced bits (tier bits), which could improve metrics in the long term. Also no more need to clean reclaim bit as the common routine will make use of it.
Note the common routine updates a few throttling and writeback counters, which are not used, and never have been for the MGLRU case. We will start making use of these in later commits.
Stable-dep-of: f7e698e326b2 ("mm/mglru: fix and remove redundant unevictable folio handling")
--- mm/vmscan.c | 21 --------------------- 1 file changed, 21 deletions(-)
mm/vmscan.c +0 -21
@@ -4358,23 +4358,6 @@ static bool sort_folio(struct lruvec *lruvec, struct folio *folio, struct scan_creturn true; } -bool dirty =folio_test_dirty (folio); -bool writeback =folio_test_writeback (folio); - -if (type ==LRU_GEN_FILE && dirty) { - sc->nr.file_taken += delta; -if (!writeback) - sc->nr.unqueued_dirty += delta; - } - -/* waiting for writeback */ -if (folio_test_locked (folio) || writeback || - (type ==LRU_GEN_FILE && dirty)) { - gen =folio_inc_gen (lruvec, folio, true); -list_move (&folio->lru, &lrugen->folios[gen][type][zone]); -return true; - } -return false; }
@@ -4402,10 +4385,6 @@ static bool isolate_folio(struct lruvec *lruvec, struct folio *folio, struct scaif (!folio_test_referenced (folio))folio_clear_lru_refs (folio); -/* for shrink_folio_list() */ -folio_clear_reclaim (folio); -folio_clear_referenced (folio); - success =lru_gen_del_folio (lruvec, folio, true);VM_WARN_ON_ONCE_FOLIO (!success, folio);
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 4/4 mm/mglru: fix and remove redundant unevictable folio handling
In reply to Sasha LevinFrom: Kairui Song <[email protected]>
[ Upstream commit f7e698e326b239a91ea15844817551921209e826 ]
sort_folio() has a shortcut for moving folios that are no longer evictable but are still sitting on a generation list. However, this shortcut is buggy. It does not follow the PG_lru usage convention, and it has a more serious issue.
Unevictable folios are not threaded on lists[LRU_UNEVICTABLE], so that folio->lru can be reused to hold folio->mlock_count (see the comment in lruvec_init()). Hence lruvec_add_folio() skips the list_add() for them, and every other place that turns a folio unevictable initialises mlock_count explicitly: lru_add() sets it to 0, __mlock_folio() and __mlock_new_folio() set it to !!folio_test_mlocked(folio). sort_folio() sets nothing, and the lru_gen_del_folio() right above it may have already poisoned folio->lru via list_del(), so mlock_count ends up aliasing LIST_POISON2, which reads as 0x122, i.e. 290. The result is user visible. On munlock, __munlock_folio() decrements that bogus count, finds it still non-zero and bails out before clearing PG_mlocked, so the folio remains unevictable and the Mlocked accounting stays inflated until the folio is freed.
The shortcut also touches the LRU flags in the wrong order. It calls lru_gen_del_folio() while PG_lru is still set, so a concurrent folio_test_clear_lru() (e.g. compaction, folio_isolate_lru()) can succeed on a folio that has already been taken off the generation list, which may lead to unexpected behavior.
So fix it by isolating them as common folios and letting the generic shrink path cull them. This matches the classical LRU behavior, and there should be no visible effect on the generic eviction or isolation behavior.
There is no performance concern either, such a folio goes through this once, and then it is off the generation lists for good.
--- mm/vmscan.c | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-)
mm/vmscan.c +5 -14
@@ -4312,7 +4312,6 @@ void lru_gen_soft_reclaim(struct mem_cgroup *memcg, int nid)static bool sort_folio (struct lruvec *lruvec,struct folio *folio,struct scan_control *sc,int tier_idx) { -bool success;int gen =folio_lru_gen (folio);int type =folio_is_file_lru (folio);int zone =folio_zonenum (folio);
@@ -4323,15 +4322,9 @@ static bool sort_folio(struct lruvec *lruvec, struct folio *folio, struct scan_cVM_WARN_ON_ONCE_FOLIO (gen >=MAX_NR_GENS , folio); -/* unevictable */ -if (!folio_evictable (folio)) { - success =lru_gen_del_folio (lruvec, folio, true); -VM_WARN_ON_ONCE_FOLIO (!success, folio); -folio_set_unevictable (folio); -lruvec_add_folio (lruvec, folio); -__count_vm_events (UNEVICTABLE_PGCULLED , delta); -return true; - } +/* unevictable: let it through and the generic path will cull it */ +if (!folio_evictable (folio)) +return false;/* promoted */ if (gen !=lru_gen_from_seq (lrugen->min_seq[type])) {
@@ -4608,11 +4601,9 @@ static int evict_folios(struct lruvec *lruvec, struct scan_control *sc, int swaplist_for_each_entry_safe_reverse (folio, next, &list, lru) {DEFINE_MIN_SEQ (lruvec); -if (!folio_evictable (folio)) { -list_del (&folio->lru); -folio_putback_lru (folio); +/* move_folios_to_lru() culls unevictable folios via folio_putback_lru() */ +if (!folio_evictable (folio))continue ; - }/* retry folios that may have missed folio_rotate_reclaimable() */ if (!skip_retry && !folio_test_active(folio) && !folio_mapped(folio) &&
Signature · 1 line
2.53.0