]>
Commit | Line | Data |
---|---|---|
59033f2a GKH |
1 | From 09789e5de18e4e442870b2d700831f5cb802eb05 Mon Sep 17 00:00:00 2001 |
2 | From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> | |
3 | Date: Tue, 5 May 2015 16:23:35 -0700 | |
4 | Subject: mm/memory-failure: call shake_page() when error hits thp tail page | |
5 | ||
6 | From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> | |
7 | ||
8 | commit 09789e5de18e4e442870b2d700831f5cb802eb05 upstream. | |
9 | ||
10 | Currently memory_failure() calls shake_page() to sweep pages out from | |
11 | pcplists only when the victim page is 4kB LRU page or thp head page. | |
12 | But we should do this for a thp tail page too. | |
13 | ||
14 | Consider that a memory error hits a thp tail page whose head page is on | |
15 | a pcplist when memory_failure() runs. Then, the current kernel skips | |
16 | shake_pages() part, so hwpoison_user_mappings() returns without calling | |
17 | split_huge_page() nor try_to_unmap() because PageLRU of the thp head is | |
18 | still cleared due to the skip of shake_page(). | |
19 | ||
20 | As a result, me_huge_page() runs for the thp, which is broken behavior. | |
21 | ||
22 | One effect is a leak of the thp. And another is to fail to isolate the | |
23 | memory error, so later access to the error address causes another MCE, | |
24 | which kills the processes which used the thp. | |
25 | ||
26 | This patch fixes this problem by calling shake_page() for thp tail case. | |
27 | ||
28 | Fixes: 385de35722c9 ("thp: allow a hwpoisoned head page to be put back to LRU") | |
29 | Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com> | |
30 | Reviewed-by: Andi Kleen <ak@linux.intel.com> | |
31 | Acked-by: Dean Nelson <dnelson@redhat.com> | |
32 | Cc: Andrea Arcangeli <aarcange@redhat.com> | |
33 | Cc: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com> | |
34 | Cc: Jin Dongming <jin.dongming@np.css.fujitsu.com> | |
35 | Signed-off-by: Andrew Morton <akpm@linux-foundation.org> | |
36 | Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | |
37 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
38 | ||
39 | --- | |
40 | mm/memory-failure.c | 8 ++++---- | |
41 | 1 file changed, 4 insertions(+), 4 deletions(-) | |
42 | ||
43 | --- a/mm/memory-failure.c | |
44 | +++ b/mm/memory-failure.c | |
45 | @@ -1117,10 +1117,10 @@ int memory_failure(unsigned long pfn, in | |
46 | * The check (unnecessarily) ignores LRU pages being isolated and | |
47 | * walked by the page reclaim code, however that's not a big loss. | |
48 | */ | |
49 | - if (!PageHuge(p) && !PageTransTail(p)) { | |
50 | - if (!PageLRU(p)) | |
51 | - shake_page(p, 0); | |
52 | - if (!PageLRU(p)) { | |
53 | + if (!PageHuge(p)) { | |
54 | + if (!PageLRU(hpage)) | |
55 | + shake_page(hpage, 0); | |
56 | + if (!PageLRU(hpage)) { | |
57 | /* | |
58 | * shake_page could have turned it free. | |
59 | */ |