Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6de2b1aa authored by Naoya Horiguchi's avatar Naoya Horiguchi Committed by Andi Kleen
Browse files

HWPOISON, hugetlb: add free check to dequeue_hwpoison_huge_page() 



This check is necessary to avoid race between dequeue and allocation,
which can cause a free hugepage to be dequeued twice and get kernel unstable.

Signed-off-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: default avatarWu Fengguang <fengguang.wu@intel.com>
Acked-by: default avatarMel Gorman <mel@csn.ul.ie>
Reviewed-by: default avatarChristoph Lameter <cl@linux.com>
Signed-off-by: default avatarAndi Kleen <ak@linux.intel.com>
parent 290408d4

include/linux/hugetlb.h

+2 −2
Original line number Diff line number Diff line
@@ -43,7 +43,7 @@ int hugetlb_reserve_pages(struct inode *inode, long from, long to, 
						struct vm_area_struct *vma,

						int acctflags);

void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed);

void __isolate_hwpoisoned_huge_page(struct page *page);

int dequeue_hwpoisoned_huge_page(struct page *page);

void copy_huge_page(struct page *dst, struct page *src);



extern unsigned long hugepages_treat_as_movable;
@@ -102,7 +102,7 @@ static inline void hugetlb_report_meminfo(struct seq_file *m) 
#define hugetlb_free_pgd_range(tlb, addr, end, floor, ceiling) ({BUG(); 0; })

#define hugetlb_fault(mm, vma, addr, flags)	({ BUG(); 0; })

#define huge_pte_offset(mm, address)	0

#define __isolate_hwpoisoned_huge_page(page)	0

#define dequeue_hwpoisoned_huge_page(page)	0

static inline void copy_huge_page(struct page *dst, struct page *src)

{

}

mm/hugetlb.c

+25 −4
Original line number Diff line number Diff line
@@ -2955,18 +2955,39 @@ void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed) 
	hugetlb_acct_memory(h, -(chg - freed));

}



/* Should be called in hugetlb_lock */

static int is_hugepage_on_freelist(struct page *hpage)

{

	struct page *page;

	struct page *tmp;

	struct hstate *h = page_hstate(hpage);

	int nid = page_to_nid(hpage);



	list_for_each_entry_safe(page, tmp, &h->hugepage_freelists[nid], lru)

		if (page == hpage)

			return 1;

	return 0;

}



#ifdef CONFIG_MEMORY_FAILURE

/*

 * This function is called from memory failure code.

 * Assume the caller holds page lock of the head page.

 */

void __isolate_hwpoisoned_huge_page(struct page *hpage)

int dequeue_hwpoisoned_huge_page(struct page *hpage)

{

	struct hstate *h = page_hstate(hpage);

	int nid = page_to_nid(hpage);

	int ret = -EBUSY;



	spin_lock(&hugetlb_lock);

	if (is_hugepage_on_freelist(hpage)) {

		list_del(&hpage->lru);

		h->free_huge_pages--;

		h->free_huge_pages_node[nid]--;

		ret = 0;

	}

	spin_unlock(&hugetlb_lock);

	return ret;

}

#endif

mm/memory-failure.c

+4 −2
Original line number Diff line number Diff line
@@ -698,6 +698,7 @@ static int me_swapcache_clean(struct page *p, unsigned long pfn) 
 */

static int me_huge_page(struct page *p, unsigned long pfn)

{

	int res = 0;

	struct page *hpage = compound_head(p);

	/*

	 * We can safely recover from error on free or reserved (i.e.
@@ -710,7 +711,8 @@ static int me_huge_page(struct page *p, unsigned long pfn) 
	 * so there is no race between isolation and mapping/unmapping.

	 */

	if (!(page_mapping(hpage) || PageAnon(hpage))) {

		__isolate_hwpoisoned_huge_page(hpage);

		res = dequeue_hwpoisoned_huge_page(hpage);

		if (!res)

			return RECOVERED;

	}

	return DELAYED;