Commit 57e68e9cd65b4b8eb4045a1e0d0746458502554c
Committed by
Linus Torvalds
1 parent
3a025760fc
Exists in
master
and in
13 other branches
mm: try_to_unmap_cluster() should lock_page() before mlocking
A BUG_ON(!PageLocked) was triggered in mlock_vma_page() by Sasha Levin fuzzing with trinity. The call site try_to_unmap_cluster() does not lock the pages other than its check_page parameter (which is already locked). The BUG_ON in mlock_vma_page() is not documented and its purpose is somewhat unclear, but apparently it serializes against page migration, which could otherwise fail to transfer the PG_mlocked flag. This would not be fatal, as the page would be eventually encountered again, but NR_MLOCK accounting would become distorted nevertheless. This patch adds a comment to the BUG_ON in mlock_vma_page() and munlock_vma_page() to that effect. The call site try_to_unmap_cluster() is fixed so that for page != check_page, trylock_page() is attempted (to avoid possible deadlocks as we already have check_page locked) and mlock_vma_page() is performed only upon success. If the page lock cannot be obtained, the page is left without PG_mlocked, which is again not a problem in the whole unevictable memory design. Signed-off-by: Vlastimil Babka <vbabka@suse.cz> Signed-off-by: Bob Liu <bob.liu@oracle.com> Reported-by: Sasha Levin <sasha.levin@oracle.com> Cc: Wanpeng Li <liwanp@linux.vnet.ibm.com> Cc: Michel Lespinasse <walken@google.com> Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Acked-by: Rik van Riel <riel@redhat.com> Cc: David Rientjes <rientjes@google.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Hugh Dickins <hughd@google.com> Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Showing 2 changed files with 14 additions and 2 deletions Side-by-side Diff
mm/mlock.c
... | ... | @@ -79,6 +79,7 @@ |
79 | 79 | */ |
80 | 80 | void mlock_vma_page(struct page *page) |
81 | 81 | { |
82 | + /* Serialize with page migration */ | |
82 | 83 | BUG_ON(!PageLocked(page)); |
83 | 84 | |
84 | 85 | if (!TestSetPageMlocked(page)) { |
... | ... | @@ -174,6 +175,7 @@ |
174 | 175 | unsigned int nr_pages; |
175 | 176 | struct zone *zone = page_zone(page); |
176 | 177 | |
178 | + /* For try_to_munlock() and to serialize with page migration */ | |
177 | 179 | BUG_ON(!PageLocked(page)); |
178 | 180 | |
179 | 181 | /* |
mm/rmap.c
... | ... | @@ -1332,9 +1332,19 @@ |
1332 | 1332 | BUG_ON(!page || PageAnon(page)); |
1333 | 1333 | |
1334 | 1334 | if (locked_vma) { |
1335 | - mlock_vma_page(page); /* no-op if already mlocked */ | |
1336 | - if (page == check_page) | |
1335 | + if (page == check_page) { | |
1336 | + /* we know we have check_page locked */ | |
1337 | + mlock_vma_page(page); | |
1337 | 1338 | ret = SWAP_MLOCK; |
1339 | + } else if (trylock_page(page)) { | |
1340 | + /* | |
1341 | + * If we can lock the page, perform mlock. | |
1342 | + * Otherwise leave the page alone, it will be | |
1343 | + * eventually encountered again later. | |
1344 | + */ | |
1345 | + mlock_vma_page(page); | |
1346 | + unlock_page(page); | |
1347 | + } | |
1338 | 1348 | continue; /* don't unmap */ |
1339 | 1349 | } |
1340 | 1350 |