Commit 9845cbbd authored by Kirill A. Shutemov's avatar Kirill A. Shutemov Committed by Linus Torvalds
Browse files

mm, thp: fix infinite loop on memcg OOM 



Masayoshi Mizuma reported a bug with the hang of an application under
the memcg limit.  It happens on write-protection fault to huge zero page

If we successfully allocate a huge page to replace zero page but hit the
memcg limit we need to split the zero page with split_huge_page_pmd()
and fallback to small pages.

The other part of the problem is that VM_FAULT_OOM has special meaning
in do_huge_pmd_wp_page() context.  __handle_mm_fault() expects the page
to be split if it sees VM_FAULT_OOM and it will will retry page fault
handling.  This causes an infinite loop if the page was not split.

do_huge_pmd_wp_zero_page_fallback() can return VM_FAULT_OOM if it failed
to allocate one small page, so fallback to small pages will not help.

The solution for this part is to replace VM_FAULT_OOM with
VM_FAULT_FALLBACK is fallback required.

Signed-off-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reported-by: default avatarMasayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Reviewed-by: default avatarMichal Hocko <mhocko@suse.cz>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: David Rientjes <rientjes@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 01412886

mm/huge_memory.c

+6 −3
Original line number Original line Diff line number Diff line
@@ -1166,8 +1166,10 @@ alloc: 
		} else {

		} else {

			ret = do_huge_pmd_wp_page_fallback(mm, vma, address,

			ret = do_huge_pmd_wp_page_fallback(mm, vma, address,

					pmd, orig_pmd, page, haddr);

					pmd, orig_pmd, page, haddr);

			if (ret & VM_FAULT_OOM)

			if (ret & VM_FAULT_OOM) {

				split_huge_page(page);

				split_huge_page(page);

				ret |= VM_FAULT_FALLBACK;

			}

			put_page(page);

			put_page(page);

		}

		}

		count_vm_event(THP_FAULT_FALLBACK);

		count_vm_event(THP_FAULT_FALLBACK);
@@ -1179,9 +1181,10 @@ alloc: 
		if (page) {

		if (page) {

			split_huge_page(page);

			split_huge_page(page);

			put_page(page);

			put_page(page);

		}

		} else

			split_huge_page_pmd(vma, address, pmd);

		ret |= VM_FAULT_FALLBACK;

		count_vm_event(THP_FAULT_FALLBACK);

		count_vm_event(THP_FAULT_FALLBACK);

		ret |= VM_FAULT_OOM;

		goto out;

		goto out;

	}

	}

mm/memory.c

+3 −11
Original line number Original line Diff line number Diff line
@@ -3704,7 +3704,6 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma, 
	if (unlikely(is_vm_hugetlb_page(vma)))

	if (unlikely(is_vm_hugetlb_page(vma)))

		return hugetlb_fault(mm, vma, address, flags);

		return hugetlb_fault(mm, vma, address, flags);





retry:

	pgd = pgd_offset(mm, address);

	pgd = pgd_offset(mm, address);

	pud = pud_alloc(mm, pgd, address);

	pud = pud_alloc(mm, pgd, address);

	if (!pud)

	if (!pud)
@@ -3742,22 +3741,15 @@ retry: 
			if (dirty && !pmd_write(orig_pmd)) {

			if (dirty && !pmd_write(orig_pmd)) {

				ret = do_huge_pmd_wp_page(mm, vma, address, pmd,

				ret = do_huge_pmd_wp_page(mm, vma, address, pmd,

							  orig_pmd);

							  orig_pmd);

				/*

				if (!(ret & VM_FAULT_FALLBACK))

				 * If COW results in an oom, the huge pmd will

				 * have been split, so retry the fault on the

				 * pte for a smaller charge.

				 */

				if (unlikely(ret & VM_FAULT_OOM))

					goto retry;

					return ret;

					return ret;

			} else {

			} else {

				huge_pmd_set_accessed(mm, vma, address, pmd,

				huge_pmd_set_accessed(mm, vma, address, pmd,

						      orig_pmd, dirty);

						      orig_pmd, dirty);

			}



				return 0;

				return 0;

			}

			}

		}

		}

	}





	/* THP should already have been handled */

	/* THP should already have been handled */

	BUG_ON(pmd_numa(*pmd));

	BUG_ON(pmd_numa(*pmd));

CRA Git | Maintained and supported by SUSTech CRA and CCSE