mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-04 18:09:57 +00:00
![Miaohe Lin](/assets/img/avatar_default.png)
The current implementation of hugetlb_cgroup for shared mappings could
have different behavior. Consider the following two scenarios:
1.Assume initial css reference count of hugetlb_cgroup is 1:
1.1 Call hugetlb_reserve_pages with from = 1, to = 2. So css reference
count is 2 associated with 1 file_region.
1.2 Call hugetlb_reserve_pages with from = 2, to = 3. So css reference
count is 3 associated with 2 file_region.
1.3 coalesce_file_region will coalesce these two file_regions into
one. So css reference count is 3 associated with 1 file_region
now.
2.Assume initial css reference count of hugetlb_cgroup is 1 again:
2.1 Call hugetlb_reserve_pages with from = 1, to = 3. So css reference
count is 2 associated with 1 file_region.
Therefore, we might have one file_region while holding one or more css
reference counts. This inconsistency could lead to imbalanced css_get()
and css_put() pair. If we do css_put one by one (i.g. hole punch case),
scenario 2 would put one more css reference. If we do css_put all
together (i.g. truncate case), scenario 1 will leak one css reference.
The imbalanced css_get() and css_put() pair would result in a non-zero
reference when we try to destroy the hugetlb cgroup. The hugetlb cgroup
directory is removed __but__ associated resource is not freed. This
might result in OOM or can not create a new hugetlb cgroup in a busy
workload ultimately.
In order to fix this, we have to make sure that one file_region must
hold exactly one css reference. So in coalesce_file_region case, we
should release one css reference before coalescence. Also only put css
reference when the entire file_region is removed.
The last thing to note is that the caller of region_add() will only hold
one reference to h_cg->css for the whole contiguous reservation region.
But this area might be scattered when there are already some
file_regions reside in it. As a result, many file_regions may share only
one h_cg->css reference. In order to ensure that one file_region must
hold exactly one css reference, we should do css_get() for each
file_region and release the reference held by caller when they are done.
[linmiaohe@huawei.com: fix imbalanced css_get and css_put pair for shared mappings]
Link: https://lkml.kernel.org/r/20210316023002.53921-1-linmiaohe@huawei.com
Link: https://lkml.kernel.org/r/20210301120540.37076-1-linmiaohe@huawei.com
Fixes: 075a61d07a
("hugetlb_cgroup: add accounting for shared mappings")
Reported-by: kernel test robot <lkp@intel.com> (auto build test ERROR)
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: Wanpeng Li <liwp.linux@gmail.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
263 lines
6.7 KiB
C
263 lines
6.7 KiB
C
/*
|
|
* Copyright IBM Corporation, 2012
|
|
* Author Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of version 2.1 of the GNU Lesser General Public License
|
|
* as published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it would be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
|
|
*
|
|
*/
|
|
|
|
#ifndef _LINUX_HUGETLB_CGROUP_H
|
|
#define _LINUX_HUGETLB_CGROUP_H
|
|
|
|
#include <linux/mmdebug.h>
|
|
|
|
struct hugetlb_cgroup;
|
|
struct resv_map;
|
|
struct file_region;
|
|
|
|
/*
|
|
* Minimum page order trackable by hugetlb cgroup.
|
|
* At least 4 pages are necessary for all the tracking information.
|
|
* The second tail page (hpage[2]) is the fault usage cgroup.
|
|
* The third tail page (hpage[3]) is the reservation usage cgroup.
|
|
*/
|
|
#define HUGETLB_CGROUP_MIN_ORDER 2
|
|
|
|
#ifdef CONFIG_CGROUP_HUGETLB
|
|
enum hugetlb_memory_event {
|
|
HUGETLB_MAX,
|
|
HUGETLB_NR_MEMORY_EVENTS,
|
|
};
|
|
|
|
struct hugetlb_cgroup {
|
|
struct cgroup_subsys_state css;
|
|
|
|
/*
|
|
* the counter to account for hugepages from hugetlb.
|
|
*/
|
|
struct page_counter hugepage[HUGE_MAX_HSTATE];
|
|
|
|
/*
|
|
* the counter to account for hugepage reservations from hugetlb.
|
|
*/
|
|
struct page_counter rsvd_hugepage[HUGE_MAX_HSTATE];
|
|
|
|
atomic_long_t events[HUGE_MAX_HSTATE][HUGETLB_NR_MEMORY_EVENTS];
|
|
atomic_long_t events_local[HUGE_MAX_HSTATE][HUGETLB_NR_MEMORY_EVENTS];
|
|
|
|
/* Handle for "hugetlb.events" */
|
|
struct cgroup_file events_file[HUGE_MAX_HSTATE];
|
|
|
|
/* Handle for "hugetlb.events.local" */
|
|
struct cgroup_file events_local_file[HUGE_MAX_HSTATE];
|
|
};
|
|
|
|
static inline struct hugetlb_cgroup *
|
|
__hugetlb_cgroup_from_page(struct page *page, bool rsvd)
|
|
{
|
|
VM_BUG_ON_PAGE(!PageHuge(page), page);
|
|
|
|
if (compound_order(page) < HUGETLB_CGROUP_MIN_ORDER)
|
|
return NULL;
|
|
if (rsvd)
|
|
return (struct hugetlb_cgroup *)page[3].private;
|
|
else
|
|
return (struct hugetlb_cgroup *)page[2].private;
|
|
}
|
|
|
|
static inline struct hugetlb_cgroup *hugetlb_cgroup_from_page(struct page *page)
|
|
{
|
|
return __hugetlb_cgroup_from_page(page, false);
|
|
}
|
|
|
|
static inline struct hugetlb_cgroup *
|
|
hugetlb_cgroup_from_page_rsvd(struct page *page)
|
|
{
|
|
return __hugetlb_cgroup_from_page(page, true);
|
|
}
|
|
|
|
static inline int __set_hugetlb_cgroup(struct page *page,
|
|
struct hugetlb_cgroup *h_cg, bool rsvd)
|
|
{
|
|
VM_BUG_ON_PAGE(!PageHuge(page), page);
|
|
|
|
if (compound_order(page) < HUGETLB_CGROUP_MIN_ORDER)
|
|
return -1;
|
|
if (rsvd)
|
|
page[3].private = (unsigned long)h_cg;
|
|
else
|
|
page[2].private = (unsigned long)h_cg;
|
|
return 0;
|
|
}
|
|
|
|
static inline int set_hugetlb_cgroup(struct page *page,
|
|
struct hugetlb_cgroup *h_cg)
|
|
{
|
|
return __set_hugetlb_cgroup(page, h_cg, false);
|
|
}
|
|
|
|
static inline int set_hugetlb_cgroup_rsvd(struct page *page,
|
|
struct hugetlb_cgroup *h_cg)
|
|
{
|
|
return __set_hugetlb_cgroup(page, h_cg, true);
|
|
}
|
|
|
|
static inline bool hugetlb_cgroup_disabled(void)
|
|
{
|
|
return !cgroup_subsys_enabled(hugetlb_cgrp_subsys);
|
|
}
|
|
|
|
static inline void hugetlb_cgroup_put_rsvd_cgroup(struct hugetlb_cgroup *h_cg)
|
|
{
|
|
css_put(&h_cg->css);
|
|
}
|
|
|
|
extern int hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages,
|
|
struct hugetlb_cgroup **ptr);
|
|
extern int hugetlb_cgroup_charge_cgroup_rsvd(int idx, unsigned long nr_pages,
|
|
struct hugetlb_cgroup **ptr);
|
|
extern void hugetlb_cgroup_commit_charge(int idx, unsigned long nr_pages,
|
|
struct hugetlb_cgroup *h_cg,
|
|
struct page *page);
|
|
extern void hugetlb_cgroup_commit_charge_rsvd(int idx, unsigned long nr_pages,
|
|
struct hugetlb_cgroup *h_cg,
|
|
struct page *page);
|
|
extern void hugetlb_cgroup_uncharge_page(int idx, unsigned long nr_pages,
|
|
struct page *page);
|
|
extern void hugetlb_cgroup_uncharge_page_rsvd(int idx, unsigned long nr_pages,
|
|
struct page *page);
|
|
|
|
extern void hugetlb_cgroup_uncharge_cgroup(int idx, unsigned long nr_pages,
|
|
struct hugetlb_cgroup *h_cg);
|
|
extern void hugetlb_cgroup_uncharge_cgroup_rsvd(int idx, unsigned long nr_pages,
|
|
struct hugetlb_cgroup *h_cg);
|
|
extern void hugetlb_cgroup_uncharge_counter(struct resv_map *resv,
|
|
unsigned long start,
|
|
unsigned long end);
|
|
|
|
extern void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv,
|
|
struct file_region *rg,
|
|
unsigned long nr_pages,
|
|
bool region_del);
|
|
|
|
extern void hugetlb_cgroup_file_init(void) __init;
|
|
extern void hugetlb_cgroup_migrate(struct page *oldhpage,
|
|
struct page *newhpage);
|
|
|
|
#else
|
|
static inline void hugetlb_cgroup_uncharge_file_region(struct resv_map *resv,
|
|
struct file_region *rg,
|
|
unsigned long nr_pages,
|
|
bool region_del)
|
|
{
|
|
}
|
|
|
|
static inline struct hugetlb_cgroup *hugetlb_cgroup_from_page(struct page *page)
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
static inline struct hugetlb_cgroup *
|
|
hugetlb_cgroup_from_page_resv(struct page *page)
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
static inline struct hugetlb_cgroup *
|
|
hugetlb_cgroup_from_page_rsvd(struct page *page)
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
static inline int set_hugetlb_cgroup(struct page *page,
|
|
struct hugetlb_cgroup *h_cg)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline int set_hugetlb_cgroup_rsvd(struct page *page,
|
|
struct hugetlb_cgroup *h_cg)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline bool hugetlb_cgroup_disabled(void)
|
|
{
|
|
return true;
|
|
}
|
|
|
|
static inline void hugetlb_cgroup_put_rsvd_cgroup(struct hugetlb_cgroup *h_cg)
|
|
{
|
|
}
|
|
|
|
static inline int hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages,
|
|
struct hugetlb_cgroup **ptr)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline int hugetlb_cgroup_charge_cgroup_rsvd(int idx,
|
|
unsigned long nr_pages,
|
|
struct hugetlb_cgroup **ptr)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline void hugetlb_cgroup_commit_charge(int idx, unsigned long nr_pages,
|
|
struct hugetlb_cgroup *h_cg,
|
|
struct page *page)
|
|
{
|
|
}
|
|
|
|
static inline void
|
|
hugetlb_cgroup_commit_charge_rsvd(int idx, unsigned long nr_pages,
|
|
struct hugetlb_cgroup *h_cg,
|
|
struct page *page)
|
|
{
|
|
}
|
|
|
|
static inline void hugetlb_cgroup_uncharge_page(int idx, unsigned long nr_pages,
|
|
struct page *page)
|
|
{
|
|
}
|
|
|
|
static inline void hugetlb_cgroup_uncharge_page_rsvd(int idx,
|
|
unsigned long nr_pages,
|
|
struct page *page)
|
|
{
|
|
}
|
|
static inline void hugetlb_cgroup_uncharge_cgroup(int idx,
|
|
unsigned long nr_pages,
|
|
struct hugetlb_cgroup *h_cg)
|
|
{
|
|
}
|
|
|
|
static inline void
|
|
hugetlb_cgroup_uncharge_cgroup_rsvd(int idx, unsigned long nr_pages,
|
|
struct hugetlb_cgroup *h_cg)
|
|
{
|
|
}
|
|
|
|
static inline void hugetlb_cgroup_uncharge_counter(struct resv_map *resv,
|
|
unsigned long start,
|
|
unsigned long end)
|
|
{
|
|
}
|
|
|
|
static inline void hugetlb_cgroup_file_init(void)
|
|
{
|
|
}
|
|
|
|
static inline void hugetlb_cgroup_migrate(struct page *oldhpage,
|
|
struct page *newhpage)
|
|
{
|
|
}
|
|
|
|
#endif /* CONFIG_MEM_RES_CTLR_HUGETLB */
|
|
#endif
|