linux/drivers/xen
Huang Ying 7ba716698c mm, swap, frontswap: fix THP swap if frontswap enabled
It was reported by Sergey Senozhatsky that if THP (Transparent Huge
Page) and frontswap (via zswap) are both enabled, when memory goes low
so that swap is triggered, segfault and memory corruption will occur in
random user space applications as follow,

kernel: urxvt[338]: segfault at 20 ip 00007fc08889ae0d sp 00007ffc73a7fc40 error 6 in libc-2.26.so[7fc08881a000+1ae000]
 #0  0x00007fc08889ae0d _int_malloc (libc.so.6)
 #1  0x00007fc08889c2f3 malloc (libc.so.6)
 #2  0x0000560e6004bff7 _Z14rxvt_wcstoutf8PKwi (urxvt)
 #3  0x0000560e6005e75c n/a (urxvt)
 #4  0x0000560e6007d9f1 _ZN16rxvt_perl_interp6invokeEP9rxvt_term9hook_typez (urxvt)
 #5  0x0000560e6003d988 _ZN9rxvt_term9cmd_parseEv (urxvt)
 #6  0x0000560e60042804 _ZN9rxvt_term6pty_cbERN2ev2ioEi (urxvt)
 #7  0x0000560e6005c10f _Z17ev_invoke_pendingv (urxvt)
 #8  0x0000560e6005cb55 ev_run (urxvt)
 #9  0x0000560e6003b9b9 main (urxvt)
 #10 0x00007fc08883af4a __libc_start_main (libc.so.6)
 #11 0x0000560e6003f9da _start (urxvt)

After bisection, it was found the first bad commit is bd4c82c22c ("mm,
THP, swap: delay splitting THP after swapped out").

The root cause is as follows:

When the pages are written to swap device during swapping out in
swap_writepage(), zswap (fontswap) is tried to compress the pages to
improve performance.  But zswap (frontswap) will treat THP as a normal
page, so only the head page is saved.  After swapping in, tail pages
will not be restored to their original contents, causing memory
corruption in the applications.

This is fixed by refusing to save page in the frontswap store functions
if the page is a THP.  So that the THP will be swapped out to swap
device.

Another choice is to split THP if frontswap is enabled.  But it is found
that the frontswap enabling isn't flexible.  For example, if
CONFIG_ZSWAP=y (cannot be module), frontswap will be enabled even if
zswap itself isn't enabled.

Frontswap has multiple backends, to make it easy for one backend to
enable THP support, the THP checking is put in backend frontswap store
functions instead of the general interfaces.

Link: http://lkml.kernel.org/r/20180209084947.22749-1-ying.huang@intel.com
Fixes: bd4c82c22c ("mm, THP, swap: delay splitting THP after swapped out")
Signed-off-by: "Huang, Ying" <ying.huang@intel.com>
Reported-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Suggested-by: Minchan Kim <minchan@kernel.org>	[put THP checking in backend]
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Dan Streetman <ddstreet@ieee.org>
Cc: Seth Jennings <sjenning@redhat.com>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Shaohua Li <shli@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: <stable@vger.kernel.org>	[4.14]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-02-21 15:35:43 -08:00
..
events License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
xen-pciback License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
xenbus xenbus: track caller request id 2018-02-17 09:40:33 +01:00
xenfs License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
acpi.c
arm-device.c Xen: ARM: Zero reserved fields of xatp before making hypervisor call 2017-01-03 10:06:13 -08:00
balloon.c xen/balloon: Mark unallocated host memory as UNUSABLE 2017-12-20 13:16:20 -05:00
biomerge.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
cpu_hotplug.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
dbgp.c
efi.c xen: Implement EFI reset_system callback 2017-05-02 12:06:50 +02:00
evtchn.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
fallback.c
features.c
gntalloc.c mm: treewide: remove GFP_TEMPORARY allocation flag 2017-09-13 18:53:16 -07:00
gntdev.c xen/gntdev: Fix partial gntdev_mmap() cleanup 2018-01-10 08:38:44 -05:00
grant-table.c xen/grant-table: Use put_page instead of free_page 2018-02-06 09:55:37 +01:00
Kconfig xen: XEN_ACPI_PROCESSOR is Dom0-only 2017-12-12 09:39:43 -05:00
Makefile xen: features and fixes for v4.15-rc1 2017-11-16 13:06:27 -08:00
manage.c xen/time: do not decrease steal time after live migration on xen 2017-11-02 16:49:41 -04:00
mcelog.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
pci.c
pcpu.c
platform-pci.c xen-platform: constify pci_device_id. 2017-08-31 09:45:55 -04:00
preempt.c
privcmd.c xen/privcmd: remove unused variable pageidx 2017-11-08 09:15:28 -05:00
privcmd.h
pvcalls-back.c pvcalls-back: do not return error on inet_accept EAGAIN 2018-02-06 15:50:52 +01:00
pvcalls-front.c pvcalls-front: wait for other operations to return when release passive sockets 2018-02-17 09:41:06 +01:00
pvcalls-front.h xen: fix poll misannotation 2018-02-01 10:07:32 -05:00
swiotlb-xen.c dma-mapping: move swiotlb arch helpers to a new header 2018-01-10 16:40:54 +01:00
sys-hypervisor.c xen: add sysfs node for hypervisor build id 2017-06-15 08:50:37 +02:00
time.c xen: features and fixes for v4.15-rc1 2017-11-16 13:06:27 -08:00
tmem.c mm, swap, frontswap: fix THP swap if frontswap enabled 2018-02-21 15:35:43 -08:00
xen-acpi-cpuhotplug.c
xen-acpi-memhotplug.c
xen-acpi-pad.c
xen-acpi-processor.c xen/acpi: upload PM state from init-domain to Xen 2017-03-23 12:00:02 -04:00
xen-balloon.c xen: fix booting ballooned down hvm guest 2017-10-26 08:11:44 -04:00
xen-scsiback.c xen/scsiback: Make TMF processing slightly faster 2017-07-06 22:58:03 -07:00
xen-selfballoon.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
xen-stub.c
xlate_mmu.c