Received: by 10.223.185.116 with SMTP id b49csp4173544wrg; Mon, 26 Feb 2018 12:32:26 -0800 (PST) X-Google-Smtp-Source: AH8x226ojjgEpkc5Vpo8ZHWVsgZJoV9iklN0hw0WRGuO9rYzhIFhCC3P5hBSi4xBiBPBHDIuV6UR X-Received: by 2002:a17:902:8349:: with SMTP id z9-v6mr11571460pln.163.1519677146777; Mon, 26 Feb 2018 12:32:26 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519677146; cv=none; d=google.com; s=arc-20160816; b=PFlVjTzQM4q/vmyH23hN8wTMYNLrNsgWMbq9e6hO77KShQ1W1kjFNXOqT3cFUYxF82 9tqiVgydmJP+GDVlvhlvBSURwRWjXHmkCq+ZaDueAakqVa3LBf9a2gydrD7pi7m1mAEA D4DTKaKMdiPrew4Wc49ayXIeQ0mY2+Ytn45VEvBsNO542NJRCkHvTnj6SxhhNGTwWeeC 0U3zI26x+dixd3yjhEyraBnWm5hw4hiGmmoD3uajWNbp/51CeJT9x0lvktxT1vSn5hIM 8Kbzc4CkvTLfOmI+65ZcMzprIQdJatmGgrWLV4IQIsYWkXL/A3BYlCMMt7aXPdFgyKey VW9Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=C8ifoOPWFiMnEPaj3dad22YrZFlxqxAw163Y+4tfiCs=; b=xJwQJ6wG/MkWPYXF+v1VtrJZ/clIqpdWKDYqRaS2jpA86ndPpVbUl+j8Tf8ug+TmAA 72CdczX8xNGnZk4tYPeRGxvZ8RcLWWAAxDVPHUov493nKG9U/NkEe+gMTndtX9NRPFKm l64zSGKN0RJZriSGootHMvPwHNN1JUQQKir7dWbYYHuZTY8Jvwpt2m8+QXJ/uCeaPDQb Rq6gpOgbdeQ/LuFWMtRAEQ671paLB98+bx5F8zve3lTp4XDCP0oSS2IvISu/YTLDpSXg AjtX1Y6qFVng+n14bEvYsAeG41MXKvkltukz0ayNN+4S0V2JCVPjHoe3VXCbuP4rRnoX bhIQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id o6-v6si7179710plh.287.2018.02.26.12.32.10; Mon, 26 Feb 2018 12:32:26 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754089AbeBZU30 (ORCPT + 99 others); Mon, 26 Feb 2018 15:29:26 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:37528 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753646AbeBZU3V (ORCPT ); Mon, 26 Feb 2018 15:29:21 -0500 Received: from localhost (clnet-b04-243.ikbnet.co.at [83.175.124.243]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id C4F50EE4; Mon, 26 Feb 2018 20:29:20 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Huang, Ying" , Sergey Senozhatsky , Konrad Rzeszutek Wilk , Dan Streetman , Seth Jennings , Tetsuo Handa , Shaohua Li , Michal Hocko , Johannes Weiner , Mel Gorman , Shakeel Butt , Boris Ostrovsky , Juergen Gross , Andrew Morton , Linus Torvalds Subject: [PATCH 4.15 29/64] mm, swap, frontswap: fix THP swap if frontswap enabled Date: Mon, 26 Feb 2018 21:22:06 +0100 Message-Id: <20180226202154.695632056@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180226202153.453363333@linuxfoundation.org> References: <20180226202153.453363333@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Huang Ying commit 7ba716698cc53f8d5367766c93c538c7da6c68ce upstream. It was reported by Sergey Senozhatsky that if THP (Transparent Huge Page) and frontswap (via zswap) are both enabled, when memory goes low so that swap is triggered, segfault and memory corruption will occur in random user space applications as follow, kernel: urxvt[338]: segfault at 20 ip 00007fc08889ae0d sp 00007ffc73a7fc40 error 6 in libc-2.26.so[7fc08881a000+1ae000] #0 0x00007fc08889ae0d _int_malloc (libc.so.6) #1 0x00007fc08889c2f3 malloc (libc.so.6) #2 0x0000560e6004bff7 _Z14rxvt_wcstoutf8PKwi (urxvt) #3 0x0000560e6005e75c n/a (urxvt) #4 0x0000560e6007d9f1 _ZN16rxvt_perl_interp6invokeEP9rxvt_term9hook_typez (urxvt) #5 0x0000560e6003d988 _ZN9rxvt_term9cmd_parseEv (urxvt) #6 0x0000560e60042804 _ZN9rxvt_term6pty_cbERN2ev2ioEi (urxvt) #7 0x0000560e6005c10f _Z17ev_invoke_pendingv (urxvt) #8 0x0000560e6005cb55 ev_run (urxvt) #9 0x0000560e6003b9b9 main (urxvt) #10 0x00007fc08883af4a __libc_start_main (libc.so.6) #11 0x0000560e6003f9da _start (urxvt) After bisection, it was found the first bad commit is bd4c82c22c36 ("mm, THP, swap: delay splitting THP after swapped out"). The root cause is as follows: When the pages are written to swap device during swapping out in swap_writepage(), zswap (fontswap) is tried to compress the pages to improve performance. But zswap (frontswap) will treat THP as a normal page, so only the head page is saved. After swapping in, tail pages will not be restored to their original contents, causing memory corruption in the applications. This is fixed by refusing to save page in the frontswap store functions if the page is a THP. So that the THP will be swapped out to swap device. Another choice is to split THP if frontswap is enabled. But it is found that the frontswap enabling isn't flexible. For example, if CONFIG_ZSWAP=y (cannot be module), frontswap will be enabled even if zswap itself isn't enabled. Frontswap has multiple backends, to make it easy for one backend to enable THP support, the THP checking is put in backend frontswap store functions instead of the general interfaces. Link: http://lkml.kernel.org/r/20180209084947.22749-1-ying.huang@intel.com Fixes: bd4c82c22c367e068 ("mm, THP, swap: delay splitting THP after swapped out") Signed-off-by: "Huang, Ying" Reported-by: Sergey Senozhatsky Tested-by: Sergey Senozhatsky Suggested-by: Minchan Kim [put THP checking in backend] Cc: Konrad Rzeszutek Wilk Cc: Dan Streetman Cc: Seth Jennings Cc: Tetsuo Handa Cc: Shaohua Li Cc: Michal Hocko Cc: Johannes Weiner Cc: Mel Gorman Cc: Shakeel Butt Cc: Boris Ostrovsky Cc: Juergen Gross Cc: [4.14] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- drivers/xen/tmem.c | 4 ++++ mm/zswap.c | 6 ++++++ 2 files changed, 10 insertions(+) --- a/drivers/xen/tmem.c +++ b/drivers/xen/tmem.c @@ -284,6 +284,10 @@ static int tmem_frontswap_store(unsigned int pool = tmem_frontswap_poolid; int ret; + /* THP isn't supported */ + if (PageTransHuge(page)) + return -1; + if (pool < 0) return -1; if (ind64 != ind) --- a/mm/zswap.c +++ b/mm/zswap.c @@ -970,6 +970,12 @@ static int zswap_frontswap_store(unsigne u8 *src, *dst; struct zswap_header *zhdr; + /* THP isn't supported */ + if (PageTransHuge(page)) { + ret = -EINVAL; + goto reject; + } + if (!zswap_enabled || !tree) { ret = -ENODEV; goto reject;