Received: by 10.223.176.5 with SMTP id f5csp306554wra; Tue, 6 Feb 2018 23:01:57 -0800 (PST) X-Google-Smtp-Source: AH8x2252pacrr8wXQh6369uJVwzm5+ACHhHhgWoKMLUUuScrAEqYGyuNyaVCLORMHYo40RqaST3e X-Received: by 10.98.71.84 with SMTP id u81mr5026443pfa.204.1517986917660; Tue, 06 Feb 2018 23:01:57 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1517986917; cv=none; d=google.com; s=arc-20160816; b=aA+xRSfIronHiIytJoFa+AjnFbkrCfqNi3MCaqjdCY88mcZvwRxZFVN5dp7dVFNfJw eZF+nPAh8iJ5DCnYOlMaHVLigrzoY1Sm5oGvXSdsxxDIexHxVWe26peZScN79OPpuvl/ nk6DcIHvd/ZSVUy1e3+UhHsPOr6IOxvyrmMXFF+hxsAerqtZYUsQBmjAO9vx9FqLzpV/ OUYHvnf6l6/PJ1PgLpgyeSJAIQeR/YslDf6hfrArUNTlMhpuc3s/aAkn/YgjF6OX7QTB eL/S5QkaxuVWCVxgu5R+MSmK1AC8dxHSGO+glTQpKSRX/QQ0wFdTzb5C/liaYzTnI5CX JJow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:subject:cc:to:from :arc-authentication-results; bh=9mJW/MPXL6pT/miJFwsVxMG4xvSNKSmcU/LB+3ReSvA=; b=Emw0IeZ11ABjMmxv1N3/4rdea8sPIZRwt3AafABXwsSaYCCC+n4a0NIpsDBfvgvbVp Zdbt93EtqHdYwTh32kdwk4Y0vd47HV8CQq2AwjzMcEjYhGwIJExwjWr2Au7Zi8NUzwPt GGbZ4yrMU43IeHBFyJxxemEps6qqPK6VI6GEe99jTuk6O0ka16hDSb7mtKbreCrIZY6q IE+dAnTh4Z126ZpuWzB3LPAoWAsKTglGl1M0TX2mOhctxEGXZDkiYB0tGGfNTBGbOrQy E6niuJ1wT6+Nv1aKChtSTvjociUPQX3isP0jrRPRU2y6ENk6OUx99Pfsei+gQRn1oFFV NTag== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id q1si567302pgs.115.2018.02.06.23.01.43; Tue, 06 Feb 2018 23:01:57 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753554AbeBGHAp (ORCPT + 99 others); Wed, 7 Feb 2018 02:00:45 -0500 Received: from mga14.intel.com ([192.55.52.115]:48001 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753147AbeBGHAo (ORCPT ); Wed, 7 Feb 2018 02:00:44 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Feb 2018 23:00:44 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,471,1511856000"; d="scan'208";a="25516441" Received: from yhuang-mobile.sh.intel.com ([10.239.194.19]) by FMSMGA003.fm.intel.com with ESMTP; 06 Feb 2018 23:00:41 -0800 From: "Huang, Ying" To: Andrew Morton Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Huang Ying , "Huang, Ying" , Konrad Rzeszutek Wilk , Dan Streetman , Seth Jennings , Minchan Kim , Tetsuo Handa , Shaohua Li , Michal Hocko , Johannes Weiner , Mel Gorman , Shakeel Butt , stable@vger.kernel.org, Sergey Senozhatsky Subject: [PATCH -mm -v2] mm, swap, frontswap: Fix THP swap if frontswap enabled Date: Wed, 7 Feb 2018 15:00:35 +0800 Message-Id: <20180207070035.30302-1-ying.huang@intel.com> X-Mailer: git-send-email 2.15.1 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Huang Ying It was reported by Sergey Senozhatsky that if THP (Transparent Huge Page) and frontswap (via zswap) are both enabled, when memory goes low so that swap is triggered, segfault and memory corruption will occur in random user space applications as follow, kernel: urxvt[338]: segfault at 20 ip 00007fc08889ae0d sp 00007ffc73a7fc40 error 6 in libc-2.26.so[7fc08881a000+1ae000] #0 0x00007fc08889ae0d _int_malloc (libc.so.6) #1 0x00007fc08889c2f3 malloc (libc.so.6) #2 0x0000560e6004bff7 _Z14rxvt_wcstoutf8PKwi (urxvt) #3 0x0000560e6005e75c n/a (urxvt) #4 0x0000560e6007d9f1 _ZN16rxvt_perl_interp6invokeEP9rxvt_term9hook_typez (urxvt) #5 0x0000560e6003d988 _ZN9rxvt_term9cmd_parseEv (urxvt) #6 0x0000560e60042804 _ZN9rxvt_term6pty_cbERN2ev2ioEi (urxvt) #7 0x0000560e6005c10f _Z17ev_invoke_pendingv (urxvt) #8 0x0000560e6005cb55 ev_run (urxvt) #9 0x0000560e6003b9b9 main (urxvt) #10 0x00007fc08883af4a __libc_start_main (libc.so.6) #11 0x0000560e6003f9da _start (urxvt) After bisection, it was found the first bad commit is bd4c82c22c367e068 ("mm, THP, swap: delay splitting THP after swapped out"). The root cause is as follow. When the pages are written to swap device during swapping out in swap_writepage(), zswap (fontswap) is tried to compress the pages instead to improve the performance. But zswap (frontswap) will treat THP as normal page, so only the head page is saved. After swapping in, tail pages will not be restored to its original contents, so cause the memory corruption in the applications. This is fixed via splitting THP before writing the page to swap device if frontswap is enabled. To deal with the situation where frontswap is enabled at runtime, whether the page is THP is checked before using frontswap during swapping out too. Reported-and-tested-by: Sergey Senozhatsky Signed-off-by: "Huang, Ying" Cc: Konrad Rzeszutek Wilk Cc: Dan Streetman Cc: Seth Jennings Cc: Minchan Kim Cc: Tetsuo Handa Cc: Shaohua Li Cc: Michal Hocko Cc: Johannes Weiner Cc: Mel Gorman Cc: Shakeel Butt Cc: stable@vger.kernel.org # 4.14 Fixes: bd4c82c22c367e068 ("mm, THP, swap: delay splitting THP after swapped out") Changelog: v2: - Move frontswap check into swapfile.c to avoid to make vmscan.c depends on frontswap. --- mm/page_io.c | 2 +- mm/swapfile.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/mm/page_io.c b/mm/page_io.c index b41cf9644585..6dca817ae7a0 100644 --- a/mm/page_io.c +++ b/mm/page_io.c @@ -250,7 +250,7 @@ int swap_writepage(struct page *page, struct writeback_control *wbc) unlock_page(page); goto out; } - if (frontswap_store(page) == 0) { + if (!PageTransHuge(page) && frontswap_store(page) == 0) { set_page_writeback(page); unlock_page(page); end_page_writeback(page); diff --git a/mm/swapfile.c b/mm/swapfile.c index 006047b16814..0b7c7883ce64 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -934,6 +934,9 @@ int get_swap_pages(int n_goal, bool cluster, swp_entry_t swp_entries[]) /* Only single cluster request supported */ WARN_ON_ONCE(n_goal > 1 && cluster); + /* Frontswap doesn't support THP */ + if (frontswap_enabled() && cluster) + goto noswap; avail_pgs = atomic_long_read(&nr_swap_pages) / nr_pages; if (avail_pgs <= 0) -- 2.15.1