mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 22:02:02 +00:00
mm, thp: fix infinite loop on memcg OOM
Masayoshi Mizuma reported a bug with the hang of an application under the memcg limit. It happens on write-protection fault to huge zero page If we successfully allocate a huge page to replace zero page but hit the memcg limit we need to split the zero page with split_huge_page_pmd() and fallback to small pages. The other part of the problem is that VM_FAULT_OOM has special meaning in do_huge_pmd_wp_page() context. __handle_mm_fault() expects the page to be split if it sees VM_FAULT_OOM and it will will retry page fault handling. This causes an infinite loop if the page was not split. do_huge_pmd_wp_zero_page_fallback() can return VM_FAULT_OOM if it failed to allocate one small page, so fallback to small pages will not help. The solution for this part is to replace VM_FAULT_OOM with VM_FAULT_FALLBACK is fallback required. Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Reported-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com> Reviewed-by: Michal Hocko <mhocko@suse.cz> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: David Rientjes <rientjes@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
01412886b7
commit
9845cbbd11
2 changed files with 9 additions and 14 deletions
|
@ -1166,8 +1166,10 @@ int do_huge_pmd_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
|
||||||
} else {
|
} else {
|
||||||
ret = do_huge_pmd_wp_page_fallback(mm, vma, address,
|
ret = do_huge_pmd_wp_page_fallback(mm, vma, address,
|
||||||
pmd, orig_pmd, page, haddr);
|
pmd, orig_pmd, page, haddr);
|
||||||
if (ret & VM_FAULT_OOM)
|
if (ret & VM_FAULT_OOM) {
|
||||||
split_huge_page(page);
|
split_huge_page(page);
|
||||||
|
ret |= VM_FAULT_FALLBACK;
|
||||||
|
}
|
||||||
put_page(page);
|
put_page(page);
|
||||||
}
|
}
|
||||||
count_vm_event(THP_FAULT_FALLBACK);
|
count_vm_event(THP_FAULT_FALLBACK);
|
||||||
|
@ -1179,9 +1181,10 @@ int do_huge_pmd_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
|
||||||
if (page) {
|
if (page) {
|
||||||
split_huge_page(page);
|
split_huge_page(page);
|
||||||
put_page(page);
|
put_page(page);
|
||||||
}
|
} else
|
||||||
|
split_huge_page_pmd(vma, address, pmd);
|
||||||
|
ret |= VM_FAULT_FALLBACK;
|
||||||
count_vm_event(THP_FAULT_FALLBACK);
|
count_vm_event(THP_FAULT_FALLBACK);
|
||||||
ret |= VM_FAULT_OOM;
|
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
12
mm/memory.c
12
mm/memory.c
|
@ -3704,7 +3704,6 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
|
||||||
if (unlikely(is_vm_hugetlb_page(vma)))
|
if (unlikely(is_vm_hugetlb_page(vma)))
|
||||||
return hugetlb_fault(mm, vma, address, flags);
|
return hugetlb_fault(mm, vma, address, flags);
|
||||||
|
|
||||||
retry:
|
|
||||||
pgd = pgd_offset(mm, address);
|
pgd = pgd_offset(mm, address);
|
||||||
pud = pud_alloc(mm, pgd, address);
|
pud = pud_alloc(mm, pgd, address);
|
||||||
if (!pud)
|
if (!pud)
|
||||||
|
@ -3742,22 +3741,15 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
|
||||||
if (dirty && !pmd_write(orig_pmd)) {
|
if (dirty && !pmd_write(orig_pmd)) {
|
||||||
ret = do_huge_pmd_wp_page(mm, vma, address, pmd,
|
ret = do_huge_pmd_wp_page(mm, vma, address, pmd,
|
||||||
orig_pmd);
|
orig_pmd);
|
||||||
/*
|
if (!(ret & VM_FAULT_FALLBACK))
|
||||||
* If COW results in an oom, the huge pmd will
|
|
||||||
* have been split, so retry the fault on the
|
|
||||||
* pte for a smaller charge.
|
|
||||||
*/
|
|
||||||
if (unlikely(ret & VM_FAULT_OOM))
|
|
||||||
goto retry;
|
|
||||||
return ret;
|
return ret;
|
||||||
} else {
|
} else {
|
||||||
huge_pmd_set_accessed(mm, vma, address, pmd,
|
huge_pmd_set_accessed(mm, vma, address, pmd,
|
||||||
orig_pmd, dirty);
|
orig_pmd, dirty);
|
||||||
}
|
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
|
||||||
/* THP should already have been handled */
|
/* THP should already have been handled */
|
||||||
BUG_ON(pmd_numa(*pmd));
|
BUG_ON(pmd_numa(*pmd));
|
||||||
|
|
Loading…
Reference in a new issue