mm: make page pfmemalloc check more robust (2f064f34) · Commits · 戴 / test

Commit ("netvm: propagate page->pfmemalloc to skb") added checks for page->pfmemalloc to __skb_fill_page_desc(): if (page->pfmemalloc && !page->mapping) skb->pfmemalloc = true; It assumes page->mapping == NULL implies that page->pfmemalloc can be trusted. However, __delete_from_page_cache() can set set page->mapping to NULL and leave page->index value alone. Due to being in union, a non-zero page->index will be interpreted as true page->pfmemalloc. So the assumption is invalid if the networking code can see such a page. And it seems it can. We have encountered this with a NFS over loopback setup when such a page is attached to a new skbuf. There is no copying going on in this case so the page confuses __skb_fill_page_desc which interprets the index as pfmemalloc flag and the network stack drops packets that have been allocated using the reserves unless they are to be queued on sockets handling the swapping which is the case here and that leads to hangs when the nfs client waits for a response from the server which has been dropped and thus never arrive. The struct page is already heavily packed so rather than finding another hole to put it in, let's do a trick instead. We can reuse the index again but define it to an impossible value (-1UL). This is the page index so it should never see the value that large. Replace all direct users of page->pfmemalloc by page_is_pfmemalloc which will hide this nastiness from unspoiled eyes. The information will get lost if somebody wants to use page->index obviously but that was the case before and the original code expected that the information should be persisted somewhere else if that is really needed (e.g. what SLAB and SLUB do). [akpm@linux-foundation.org: fix blooper in slub] Fixes: ("netvm: propagate page->pfmemalloc to skb") Signed-off-by:

Michal Hocko <mhocko@suse.com> Debugged-by:

Vlastimil Babka <vbabka@suse.com> Debugged-by:

Jiri Bohac <jbohac@suse.com> Cc: Eric Dumazet <eric.dumazet@gmail.com> Cc: David Miller <davem@davemloft.net> Acked-by:

Mel Gorman <mgorman@suse.de> Cc: <stable@vger.kernel.org> [3.6+] Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

drivers/net/ethernet/intel/fm10k/fm10k_main.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -216,7 +216,7 @@ static void fm10k_reuse_rx_page(struct fm10k_ring *rx_ring,

		static inline bool fm10k_page_is_reserved(struct page *page)
		{
		return (page_to_nid(page) != numa_mem_id()) \|\| page->pfmemalloc;
		return (page_to_nid(page) != numa_mem_id()) \|\| page_is_pfmemalloc(page);
		}

		static bool fm10k_can_reuse_rx_page(struct fm10k_rx_buffer *rx_buffer,

drivers/net/ethernet/intel/igb/igb_main.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -6566,7 +6566,7 @@ static void igb_reuse_rx_page(struct igb_ring *rx_ring,

		static inline bool igb_page_is_reserved(struct page *page)
		{
		return (page_to_nid(page) != numa_mem_id()) \|\| page->pfmemalloc;
		return (page_to_nid(page) != numa_mem_id()) \|\| page_is_pfmemalloc(page);
		}

		static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer,

drivers/net/ethernet/intel/ixgbe/ixgbe_main.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1832,7 +1832,7 @@ static void ixgbe_reuse_rx_page(struct ixgbe_ring *rx_ring,

		static inline bool ixgbe_page_is_reserved(struct page *page)
		{
		return (page_to_nid(page) != numa_mem_id()) \|\| page->pfmemalloc;
		return (page_to_nid(page) != numa_mem_id()) \|\| page_is_pfmemalloc(page);
		}

		/**

drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -765,7 +765,7 @@ static void ixgbevf_reuse_rx_page(struct ixgbevf_ring *rx_ring,

		static inline bool ixgbevf_page_is_reserved(struct page *page)
		{
		return (page_to_nid(page) != numa_mem_id()) \|\| page->pfmemalloc;
		return (page_to_nid(page) != numa_mem_id()) \|\| page_is_pfmemalloc(page);
		}

		/**

include/linux/mm.h

+28 −0

Original line number	Diff line number	Diff line
		@@ -1002,6 +1002,34 @@ static inline int page_mapped(struct page *page)
		return atomic_read(&(page)->_mapcount) >= 0;
		}

		/*
		* Return true only if the page has been allocated with
		* ALLOC_NO_WATERMARKS and the low watermark was not
		* met implying that the system is under some pressure.
		*/
		static inline bool page_is_pfmemalloc(struct page *page)
		{
		/*
		* Page index cannot be this large so this must be
		* a pfmemalloc page.
		*/
		return page->index == -1UL;
		}

		/*
		* Only to be called by the page allocator on a freshly allocated
		* page.
		*/
		static inline void set_page_pfmemalloc(struct page *page)
		{
		page->index = -1UL;
		}

		static inline void clear_page_pfmemalloc(struct page *page)
		{
		page->index = 0;
		}

		/*
		* Different kinds of faults, as returned by handle_mm_fault().
		* Used to decide whether a process gets delivered SIGBUS or

Admin message