[Devel,RHEL7,COMMIT] mm/memcg: fix crashes on migrating THP

Submitted by Konstantin Khorenko on Aug. 14, 2017, 4:28 p.m.

Details

Message ID 201708141628.v7EGSMp0025051@finist_cl7.x64_64.work.ct
State New
Series "mm/memcg: fix crashes on migrating THP."
Headers show

Commit Message

Konstantin Khorenko Aug. 14, 2017, 4:28 p.m.
The commit is pushed to "branch-rh7-3.10.0-514.26.1.vz7.35.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-514.26.1.vz7.35.4
------>
commit a7140eca2d73e219e7fc51822c57f3a163b8eb4d
Author: Andrey Ryabinin <aryabinin@virtuozzo.com>
Date:   Mon Aug 14 20:28:22 2017 +0400

    mm/memcg: fix crashes on migrating THP
    
    memcg_numa_isolate_pages() calls list_del() inside list_for_each_entry()
    causing crashes. Use list_for_each_entry_safe() instead as it's safe
    against removal of list entries.
    
    https://jira.sw.ru/browse/PSBM-69999
    Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
---
 mm/memcontrol.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Patch hide | download patch | download mbox

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 2dd4833..97824e2 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4925,7 +4925,7 @@  static long memcg_numa_isolate_pages(struct lruvec *lruvec, enum lru_list lru,
 {
 	struct list_head *src = &lruvec->lists[lru];
 	struct zone *zone = lruvec_zone(lruvec);
-	struct page *page;
+	struct page *page, *tmp;
 	long scanned = 0, taken = 0;
 
 	spin_lock_irq(&zone->lru_lock);
@@ -4955,7 +4955,7 @@  static long memcg_numa_isolate_pages(struct lruvec *lruvec, enum lru_list lru,
 	__mod_zone_page_state(zone, NR_ISOLATED_ANON + is_file_lru(lru), taken);
 	spin_unlock_irq(&zone->lru_lock);
 
-	list_for_each_entry(page, dst, lru) {
+	list_for_each_entry_safe(page, tmp, dst, lru) {
 		if (PageTransHuge(page) && split_huge_page_to_list(page, dst)) {
 			list_del(&page->lru);
 			mod_zone_page_state(zone, NR_ISOLATED_ANON,

Comments

Konstantin Khorenko Aug. 14, 2017, 4:29 p.m.
Please consider to prepare a ReadyKernel patch for it.

https://readykernel.com/

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

On 08/14/2017 07:28 PM, Konstantin Khorenko wrote:
> The commit is pushed to "branch-rh7-3.10.0-514.26.1.vz7.35.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
> after rh7-3.10.0-514.26.1.vz7.35.4
> ------>
> commit a7140eca2d73e219e7fc51822c57f3a163b8eb4d
> Author: Andrey Ryabinin <aryabinin@virtuozzo.com>
> Date:   Mon Aug 14 20:28:22 2017 +0400
>
>     mm/memcg: fix crashes on migrating THP
>
>     memcg_numa_isolate_pages() calls list_del() inside list_for_each_entry()
>     causing crashes. Use list_for_each_entry_safe() instead as it's safe
>     against removal of list entries.
>
>     https://jira.sw.ru/browse/PSBM-69999
>     Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
> ---
>  mm/memcontrol.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/mm/memcontrol.c b/mm/memcontrol.c
> index 2dd4833..97824e2 100644
> --- a/mm/memcontrol.c
> +++ b/mm/memcontrol.c
> @@ -4925,7 +4925,7 @@ static long memcg_numa_isolate_pages(struct lruvec *lruvec, enum lru_list lru,
>  {
>  	struct list_head *src = &lruvec->lists[lru];
>  	struct zone *zone = lruvec_zone(lruvec);
> -	struct page *page;
> +	struct page *page, *tmp;
>  	long scanned = 0, taken = 0;
>
>  	spin_lock_irq(&zone->lru_lock);
> @@ -4955,7 +4955,7 @@ static long memcg_numa_isolate_pages(struct lruvec *lruvec, enum lru_list lru,
>  	__mod_zone_page_state(zone, NR_ISOLATED_ANON + is_file_lru(lru), taken);
>  	spin_unlock_irq(&zone->lru_lock);
>
> -	list_for_each_entry(page, dst, lru) {
> +	list_for_each_entry_safe(page, tmp, dst, lru) {
>  		if (PageTransHuge(page) && split_huge_page_to_list(page, dst)) {
>  			list_del(&page->lru);
>  			mod_zone_page_state(zone, NR_ISOLATED_ANON,
> .
>