Commit 03f3c433648a97ae7c86be789edba67690f6ea60
Committed by
Linus Torvalds
Linus Torvalds
1 parent
42e9abb628
Exists in
master
and in
4 other branches
memcg: fix swap accounting leak
Fix swapin charge operation of memcg. Now, memcg has hooks to swap-out operation and checks SwapCache is really unused or not. That check depends on contents of struct page. I.e. If PageAnon(page) && page_mapped(page), the page is recoginized as still-in-use. Now, reuse_swap_page() calles delete_from_swap_cache() before establishment of any rmap. Then, in followinig sequence (Page fault with WRITE) try_charge() (charge += PAGESIZE) commit_charge() (Check page_cgroup is used or not..) reuse_swap_page() -> delete_from_swapcache() -> mem_cgroup_uncharge_swapcache() (charge -= PAGESIZE) ...... New charge is uncharged soon.... To avoid this, move commit_charge() after page_mapcount() goes up to 1. By this, try_charge() (usage += PAGESIZE) reuse_swap_page() (may usage -= PAGESIZE if PCG_USED is set) commit_charge() (If page_cgroup is not marked as PCG_USED, add new charge.) Accounting will be correct. Changelog (v2) -> (v3) - fixed invalid charge to swp_entry==0. - updated documentation. Changelog (v1) -> (v2) - fixed comment. [nishimura@mxp.nes.nec.co.jp: swap accounting leak doc fix] Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Acked-by: Balbir Singh <balbir@linux.vnet.ibm.com> Tested-by: Balbir Singh <balbir@linux.vnet.ibm.com> Cc: Hugh Dickins <hugh@veritas.com> Cc: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp> Signed-off-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Showing 3 changed files with 46 additions and 13 deletions Side-by-side Diff
Documentation/controllers/memcg_test.txt
| 1 | 1 | Memory Resource Controller(Memcg) Implementation Memo. |
| 2 | -Last Updated: 2008/12/10 | |
| 3 | -Base Kernel Version: based on 2.6.28-rc7-mm. | |
| 2 | +Last Updated: 2008/12/15 | |
| 3 | +Base Kernel Version: based on 2.6.28-rc8-mm. | |
| 4 | 4 | |
| 5 | 5 | Because VM is getting complex (one of reasons is memcg...), memcg's behavior |
| 6 | 6 | is complex. This is a document for memcg's internal behavior. |
| ... | ... | @@ -111,9 +111,40 @@ |
| 111 | 111 | (b) If the SwapCache has been mapped by processes, it has been |
| 112 | 112 | charged already. |
| 113 | 113 | |
| 114 | - In case (a), we charge it. In case (b), we don't charge it. | |
| 115 | - (But racy state between (a) and (b) exists. We do check it.) | |
| 116 | - At charging, a charge recorded in swap_cgroup is moved to page_cgroup. | |
| 114 | + This swap-in is one of the most complicated work. In do_swap_page(), | |
| 115 | + following events occur when pte is unchanged. | |
| 116 | + | |
| 117 | + (1) the page (SwapCache) is looked up. | |
| 118 | + (2) lock_page() | |
| 119 | + (3) try_charge_swapin() | |
| 120 | + (4) reuse_swap_page() (may call delete_swap_cache()) | |
| 121 | + (5) commit_charge_swapin() | |
| 122 | + (6) swap_free(). | |
| 123 | + | |
| 124 | + Considering following situation for example. | |
| 125 | + | |
| 126 | + (A) The page has not been charged before (2) and reuse_swap_page() | |
| 127 | + doesn't call delete_from_swap_cache(). | |
| 128 | + (B) The page has not been charged before (2) and reuse_swap_page() | |
| 129 | + calls delete_from_swap_cache(). | |
| 130 | + (C) The page has been charged before (2) and reuse_swap_page() doesn't | |
| 131 | + call delete_from_swap_cache(). | |
| 132 | + (D) The page has been charged before (2) and reuse_swap_page() calls | |
| 133 | + delete_from_swap_cache(). | |
| 134 | + | |
| 135 | + memory.usage/memsw.usage changes to this page/swp_entry will be | |
| 136 | + Case (A) (B) (C) (D) | |
| 137 | + Event | |
| 138 | + Before (2) 0/ 1 0/ 1 1/ 1 1/ 1 | |
| 139 | + =========================================== | |
| 140 | + (3) +1/+1 +1/+1 +1/+1 +1/+1 | |
| 141 | + (4) - 0/ 0 - -1/ 0 | |
| 142 | + (5) 0/-1 0/ 0 -1/-1 0/ 0 | |
| 143 | + (6) - 0/-1 - 0/-1 | |
| 144 | + =========================================== | |
| 145 | + Result 1/ 1 1/ 1 1/ 1 1/ 1 | |
| 146 | + | |
| 147 | + In any cases, charges to this page should be 1/ 1. | |
| 117 | 148 | |
| 118 | 149 | 4.2 Swap-out. |
| 119 | 150 | At swap-out, typical state transition is below. |
mm/memcontrol.c
| ... | ... | @@ -1169,10 +1169,11 @@ |
| 1169 | 1169 | /* |
| 1170 | 1170 | * Now swap is on-memory. This means this page may be |
| 1171 | 1171 | * counted both as mem and swap....double count. |
| 1172 | - * Fix it by uncharging from memsw. This SwapCache is stable | |
| 1173 | - * because we're still under lock_page(). | |
| 1172 | + * Fix it by uncharging from memsw. Basically, this SwapCache is stable | |
| 1173 | + * under lock_page(). But in do_swap_page()::memory.c, reuse_swap_page() | |
| 1174 | + * may call delete_from_swap_cache() before reach here. | |
| 1174 | 1175 | */ |
| 1175 | - if (do_swap_account) { | |
| 1176 | + if (do_swap_account && PageSwapCache(page)) { | |
| 1176 | 1177 | swp_entry_t ent = {.val = page_private(page)}; |
| 1177 | 1178 | struct mem_cgroup *memcg; |
| 1178 | 1179 | memcg = swap_cgroup_record(ent, NULL); |
mm/memory.c
| ... | ... | @@ -2457,22 +2457,23 @@ |
| 2457 | 2457 | * while the page is counted on swap but not yet in mapcount i.e. |
| 2458 | 2458 | * before page_add_anon_rmap() and swap_free(); try_to_free_swap() |
| 2459 | 2459 | * must be called after the swap_free(), or it will never succeed. |
| 2460 | - * And mem_cgroup_commit_charge_swapin(), which uses the swp_entry | |
| 2461 | - * in page->private, must be called before reuse_swap_page(), | |
| 2462 | - * which may delete_from_swap_cache(). | |
| 2460 | + * Because delete_from_swap_page() may be called by reuse_swap_page(), | |
| 2461 | + * mem_cgroup_commit_charge_swapin() may not be able to find swp_entry | |
| 2462 | + * in page->private. In this case, a record in swap_cgroup is silently | |
| 2463 | + * discarded at swap_free(). | |
| 2463 | 2464 | */ |
| 2464 | 2465 | |
| 2465 | - mem_cgroup_commit_charge_swapin(page, ptr); | |
| 2466 | 2466 | inc_mm_counter(mm, anon_rss); |
| 2467 | 2467 | pte = mk_pte(page, vma->vm_page_prot); |
| 2468 | 2468 | if (write_access && reuse_swap_page(page)) { |
| 2469 | 2469 | pte = maybe_mkwrite(pte_mkdirty(pte), vma); |
| 2470 | 2470 | write_access = 0; |
| 2471 | 2471 | } |
| 2472 | - | |
| 2473 | 2472 | flush_icache_page(vma, page); |
| 2474 | 2473 | set_pte_at(mm, address, page_table, pte); |
| 2475 | 2474 | page_add_anon_rmap(page, vma, address); |
| 2475 | + /* It's better to call commit-charge after rmap is established */ | |
| 2476 | + mem_cgroup_commit_charge_swapin(page, ptr); | |
| 2476 | 2477 | |
| 2477 | 2478 | swap_free(entry); |
| 2478 | 2479 | if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page)) |