lkml.org 
[lkml]   [2018]   [Dec]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 12/50] mm/khugepaged: collapse_shmem() do not crash on Compound
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    commit 06a5e1268a5fb9c2b346a3da6b97e85f2eba0f07 upstream.

    collapse_shmem()'s VM_BUG_ON_PAGE(PageTransCompound) was unsafe: before
    it holds page lock of the first page, racing truncation then extension
    might conceivably have inserted a hugepage there already. Fail with the
    SCAN_PAGE_COMPOUND result, instead of crashing (CONFIG_DEBUG_VM=y) or
    otherwise mishandling the unexpected hugepage - though later we might
    code up a more constructive way of handling it, with SCAN_SUCCESS.

    Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261529310.2275@eggly.anvils
    Fixes: f3f0e1d2150b2 ("khugepaged: add support of collapse for tmpfs/shmem pages")
    Signed-off-by: Hugh Dickins <hughd@google.com>
    Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Cc: Jerome Glisse <jglisse@redhat.com>
    Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
    Cc: Matthew Wilcox <willy@infradead.org>
    Cc: <stable@vger.kernel.org> [4.8+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    mm/khugepaged.c | 10 +++++++++-
    1 file changed, 9 insertions(+), 1 deletion(-)

    diff --git a/mm/khugepaged.c b/mm/khugepaged.c
    index b87bd43993bd..e0cfc3a54b6a 100644
    --- a/mm/khugepaged.c
    +++ b/mm/khugepaged.c
    @@ -1400,7 +1400,15 @@ static void collapse_shmem(struct mm_struct *mm,
    */
    VM_BUG_ON_PAGE(!PageLocked(page), page);
    VM_BUG_ON_PAGE(!PageUptodate(page), page);
    - VM_BUG_ON_PAGE(PageTransCompound(page), page);
    +
    + /*
    + * If file was truncated then extended, or hole-punched, before
    + * we locked the first page, then a THP might be there already.
    + */
    + if (PageTransCompound(page)) {
    + result = SCAN_PAGE_COMPOUND;
    + goto out_unlock;
    + }

    if (page_mapping(page) != mapping) {
    result = SCAN_TRUNCATED;
    --
    2.17.1


    \
     
     \ /
      Last update: 2018-12-04 12:13    [W:4.141 / U:0.784 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site