On Mon, Mar 06, 2017 at 10:49:06AM -0500, Johannes Weiner wrote:
< snip >
> > @@ -1413,20 +1413,24 @@ static int try_to_unmap_one(struct page *page,
> > struct vm_area_struct *vma,
> > * Store the swap location in the pte.
> > * See handle_pte_fault() ...
> > */
> > - VM_BUG_ON_PAGE(!PageSwapCache(page) &&
> > PageSwapBacked(page),
> > - page);
> > + if (VM_WARN_ON_ONCE(PageSwapBacked(page) &&
> > + !PageSwapCache(page))) {
> > + ret = SWAP_FAIL;
>
> But you're not adding the !swapbacked && swapcache case?
>
> > + page_vma_mapped_walk_done(&pvmw);
> > + break;
> > + }
>
> [...]
>
> > - /*
> > - * swapin page could be clean, it has data stored in
> > - * swap. We can't silently discard it without setting
> > - * swap entry in the page table.
> > - */
> > - if (!PageDirty(page) && !PageSwapCache(page)) {
> > - /* It's a freeable page by MADV_FREE */
> > - dec_mm_counter(mm, MM_ANONPAGES);
> > - goto discard;
> > - } else if (!PageSwapBacked(page)) {
> > - /* dirty MADV_FREE page */
> > + /* MADV_FREE page check */
> > + if (!PageSwapBacked(page)) {
> > + if (!PageDirty(page)) {
> > + dec_mm_counter(mm, MM_ANONPAGES);
> > + goto discard;
> > + }
>
> Andrew already has this, you might want to send the warning changes as
> a separate patch on top of this one.
Here it goes.
>From d42d296950c3bbce74afddcff307fa18eef305fe Mon Sep 17 00:00:00 2001
From: Minchan Kim <minc...@kernel.org>
Date: Tue, 7 Mar 2017 14:48:37 +0900
Subject: [PATCH] mm: fix lazyfree bug on check in try_to_unmap_one
If a page is swapbacked, it means it should be in swapcache
in try_to_unmap_one's path.
If a page is !swapbacked, it mean it shouldn't be in swapcache
in try_to_unmap_one's path.
Check both two cases all at once and if it fails, warn and
return SWAP_FAIL. Such bug never mean we should shut down
the kernel.
Suggested-by: Johannes Weiner <han...@cmpxchg.org>
Signed-off-by: Minchan Kim <minc...@kernel.org>
---
mm/rmap.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/mm/rmap.c b/mm/rmap.c
index 35acb83..9925f32 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1413,8 +1413,13 @@ static int try_to_unmap_one(struct page *page, struct
vm_area_struct *vma,
* Store the swap location in the pte.
* See handle_pte_fault() ...
*/
- VM_BUG_ON_PAGE(!PageSwapCache(page) &&
PageSwapBacked(page),
- page);
+ if (VM_WARN_ON_ONCE(PageSwapBacked(page) !=
+ PageSwapCache(page))) {
+ ret = SWAP_FAIL;
+ page_vma_mapped_walk_done(&pvmw);
+ break;
+
+ }
/* MADV_FREE page check */
if (!PageSwapBacked(page)) {
--
2.7.4
