Commit 998b4382 authored Sep 08, 2010 by Naoya Horiguchi Committed by Andi Kleen Oct 08, 2010

hugetlb: fix metadata corruption in hugetlb_fault()



Since the PageHWPoison() check is for avoiding hwpoisoned page remained
in pagecache mapping to the process, it should be done in "found in pagecache"
branch, not in the common path.
Otherwise, metadata corruption occurs if memory failure happens between
alloc_huge_page() and lock_page() because page fault fails with metadata
changes remained (such as refcount, mapcount, etc.)

This patch moves the check to "found in pagecache" branch and fix the problem.

ChangeLog since v2:
- remove retry check in "new allocation" path.
- make description more detailed
- change patch name from "HWPOISON, hugetlb: move PG_HWPoison bit check"

Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Acked-by: Mel Gorman <mel@csn.ul.ie>
Reviewed-by: Wu Fengguang <fengguang.wu@intel.com>
Reviewed-by: Christoph Lameter <cl@linux.com>
Signed-off-by: Andi Kleen <ak@linux.intel.com>

parent 6b0cd00b

mm/hugetlb.c

+9 −12

Original line number	Diff line number	Diff line
		@@ -2515,20 +2515,17 @@ retry:
		hugepage_add_new_anon_rmap(page, vma, address);
		}
		} else {
		page_dup_rmap(page);
		}

		/*
		* Since memory error handler replaces pte into hwpoison swap entry
		* at the time of error handling, a process which reserved but not have
		* the mapping to the error hugepage does not have hwpoison swap entry.
		* So we need to block accesses from such a process by checking
		* PG_hwpoison bit here.
		* If memory error occurs between mmap() and fault, some process
		* don't have hwpoisoned swap entry for errored virtual address.
		* So we need to block hugepage fault by PG_hwpoison bit check.
		*/
		if (unlikely(PageHWPoison(page))) {
		ret = VM_FAULT_HWPOISON;
		goto backout_unlocked;
		}
		page_dup_rmap(page);
		}

		/*
		* If we are going to COW a private mapping later, we examine the

Admin message