[5.17,094/114] mm/huge_memory: do not overkill when splitting huge_zero_page

From: Xu Yu <xuyu@linux.alibaba.com>

From: Xu Yu <xuyu@linux.alibaba.com>

commit 478d134e9506c7e9bfe2830ed03dd85e97966313 upstream.

Kernel panic when injecting memory_failure for the global huge_zero_page,
when CONFIG_DEBUG_VM is enabled, as follows.

  Injecting memory failure for pfn 0x109ff9 at process virtual address 0x20ff9000
  page:00000000fb053fc3 refcount:2 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109e00
  head:00000000fb053fc3 order:9 compound_mapcount:0 compound_pincount:0
  flags: 0x17fffc000010001(locked|head|node=0|zone=2|lastcpupid=0x1ffff)
  raw: 017fffc000010001 0000000000000000 dead000000000122 0000000000000000
  raw: 0000000000000000 0000000000000000 00000002ffffffff 0000000000000000
  page dumped because: VM_BUG_ON_PAGE(is_huge_zero_page(head))
  ------------[ cut here ]------------
  kernel BUG at mm/huge_memory.c:2499!
  invalid opcode: 0000 [#1] PREEMPT SMP PTI
  CPU: 6 PID: 553 Comm: split_bug Not tainted 5.18.0-rc1+ #11
  Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 3288b3c 04/01/2014
  RIP: 0010:split_huge_page_to_list+0x66a/0x880
  Code: 84 9b fb ff ff 48 8b 7c 24 08 31 f6 e8 9f 5d 2a 00 b8 b8 02 00 00 e9 e8 fb ff ff 48 c7 c6 e8 47 3c 82 4c b
  RSP: 0018:ffffc90000dcbdf8 EFLAGS: 00010246
  RAX: 000000000000003c RBX: 0000000000000001 RCX: 0000000000000000
  RDX: 0000000000000000 RSI: ffffffff823e4c4f RDI: 00000000ffffffff
  RBP: ffff88843fffdb40 R08: 0000000000000000 R09: 00000000fffeffff
  R10: ffffc90000dcbc48 R11: ffffffff82d68448 R12: ffffea0004278000
  R13: ffffffff823c6203 R14: 0000000000109ff9 R15: ffffea000427fe40
  FS:  00007fc375a26740(0000) GS:ffff88842fd80000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00007fc3757c9290 CR3: 0000000102174006 CR4: 00000000003706e0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
  try_to_split_thp_page+0x3a/0x130
  memory_failure+0x128/0x800
  madvise_inject_error.cold+0x8b/0xa1
  __x64_sys_madvise+0x54/0x60
  do_syscall_64+0x35/0x80
  entry_SYSCALL_64_after_hwframe+0x44/0xae
  RIP: 0033:0x7fc3754f8bf9
  Code: 01 00 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 8
  RSP: 002b:00007ffeda93a1d8 EFLAGS: 00000217 ORIG_RAX: 000000000000001c
  RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc3754f8bf9
  RDX: 0000000000000064 RSI: 0000000000003000 RDI: 0000000020ff9000
  RBP: 00007ffeda93a200 R08: 0000000000000000 R09: 0000000000000000
  R10: 00000000ffffffff R11: 0000000000000217 R12: 0000000000400490
  R13: 00007ffeda93a2e0 R14: 0000000000000000 R15: 0000000000000000

We think that raising BUG is overkilling for splitting huge_zero_page, the
huge_zero_page can't be met from normal paths other than memory failure,
but memory failure is a valid caller.  So we tend to replace the BUG to
WARN + returning -EBUSY, and thus the panic above won't happen again.

Link: https://lkml.kernel.org/r/f35f8b97377d5d3ede1bc5ac3114da888c57cbce.1651052574.git.xuyu@linux.alibaba.com
Fixes: d173d5417fb6 ("mm/memory-failure.c: skip huge_zero_page in memory_failure()")
Fixes: 6a46079cf57a ("HWPOISON: The high level memory error handler in the VM v7")
Signed-off-by: Xu Yu <xuyu@linux.alibaba.com>
Suggested-by: Yang Shi <shy828301@gmail.com>
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
Reviewed-by: Yang Shi <shy828301@gmail.com>
Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/huge_memory.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

Message ID	20220516193628.173506259@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Xu Yu <xuyu@linux.alibaba.com>, Yang Shi <shy828301@gmail.com>, kernel test robot <lkp@intel.com>, Naoya Horiguchi <naoya.horiguchi@nec.com>, Miaohe Lin <linmiaohe@huawei.com>, Andrew Morton <akpm@linux-foundation.org> Subject: [PATCH 5.17 094/114] mm/huge_memory: do not overkill when splitting huge_zero_page Date: Mon, 16 May 2022 21:37:08 +0200 Message-Id: <20220516193628.173506259@linuxfoundation.org> In-Reply-To: <20220516193625.489108457@linuxfoundation.org> References: <20220516193625.489108457@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.17,002/114] iwlwifi: iwl-dbg: Use del_timer_sync() before freeing [5.17,003/114] hwmon: (tmp401) Add OF device ID table [5.17,004/114] mac80211: Reset MBSSID parameters upon connection [5.17,005/114] net: rds: use maybe_get_net() when acquiring refcount on TCP sockets [5.17,006/114] net: Fix features skip in for_each_netdev_feature() [5.17,007/114] net: mscc: ocelot: fix last VCAP IS1/IS2 filter persisting in hardware when deleted [5.17,008/114] net: mscc: ocelot: fix VCAP IS2 filters matching on both lookups [5.17,009/114] net: mscc: ocelot: restrict tc-trap actions to VCAP IS2 lookup 0 [5.17,010/114] net: mscc: ocelot: avoid corrupting hardware counters when moving VCAP filters [5.17,011/114] fbdev: simplefb: Cleanup fb_info in .fb_destroy rather than .remove [5.17,012/114] fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove [5.17,013/114] fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove [5.17,014/114] platform/surface: aggregator: Fix initialization order when compiling as builtin m... [5.17,015/114] ice: Fix race during aux device (un)plugging [5.17,016/114] ice: clear stale Tx queue settings before configuring [5.17,017/114] ice: fix PTP stale Tx timestamps cleanup [5.17,018/114] ipv4: drop dst in multicast routing path [5.17,019/114] drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name() [5.17,020/114] netlink: do not reset transport header in netlink_recvmsg() [5.17,021/114] net: chelsio: cxgb4: Avoid potential negative array offset [5.17,022/114] fbdev: efifb: Fix a use-after-free due early fb_info cleanup [5.17,023/114] net: sfc: fix memory leak due to ptp channel [5.17,024/114] fanotify: do not allow setting dirent events in mask of non-dir [5.17,025/114] mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection [5.17,026/114] nfs: fix broken handling of the softreval mount option [5.17,027/114] ionic: fix missing pci_release_regions() on error in ionic_probe() [5.17,028/114] dim: initialize all struct fields [5.17,029/114] hwmon: (ltq-cputemp) restrict it to SOC_XWAY [5.17,030/114] procfs: prevent unprivileged processes accessing fdinfo dir [5.17,031/114] selftests: vm: Makefile: rename TARGETS to VMTARGETS [5.17,032/114] net: dsa: flush switchdev workqueue on bridge join error path [5.17,033/114] arm64: vdso: fix makefile dependency on vdso.so [5.17,034/114] virtio: fix virtio transitional ids [5.17,035/114] s390/ctcm: fix variable dereferenced before check [5.17,036/114] s390/ctcm: fix potential memory leak [5.17,037/114] s390/lcs: fix variable dereferenced before check [5.17,038/114] net/sched: act_pedit: really ensure the skb is writable [5.17,039/114] net: ethernet: mediatek: ppe: fix wrong size passed to memset() [5.17,040/114] net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral [5.17,041/114] drm/vc4: hdmi: Fix build error for implicit function declaration [5.17,042/114] mlxsw: Avoid warning during ip6gre device removal [5.17,043/114] net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down() [5.17,044/114] net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending [5.17,045/114] net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe() [5.17,046/114] tls: Fix context leak on tls_device_down [5.17,047/114] drm/vmwgfx: Fix fencing on SVGAv3 [5.17,048/114] gfs2: Fix filesystem block deallocation for short writes [5.17,049/114] hwmon: (asus_wmi_sensors) Fix CROSSHAIR VI HERO name [5.17,050/114] hwmon: (f71882fg) Fix negative temperature [5.17,051/114] RDMA/irdma: Fix deadlock in irdma_cleanup_cm_core() [5.17,052/114] iommu: arm-smmu: disable large page mappings for Nvidia arm-smmu [5.17,053/114] ASoC: max98090: Reject invalid values in custom control put() [5.17,054/114] ASoC: max98090: Generate notifications on changes for custom control [5.17,055/114] ASoC: ops: Validate input values in snd_soc_put_volsw_range() [5.17,056/114] s390: disable -Warray-bounds [5.17,057/114] ASoC: SOF: Fix NULL pointer exception in sof_pci_probe callback [5.17,058/114] io_uring: assign non-fixed early for async work [5.17,059/114] net: emaclite: Dont advertise 1000BASE-T and do auto negotiation [5.17,060/114] net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT [5.17,061/114] secure_seq: use the 64 bits of the siphash for port offset calculation [5.17,062/114] tcp: use different parts of the port_offset for index and offset [5.17,063/114] tcp: resalt the secret every 10 seconds [5.17,064/114] tcp: add small random increments to the source port [5.17,065/114] tcp: dynamically allocate the perturb table used by source ports [5.17,066/114] tcp: increase source port perturb table to 2^16 [5.17,067/114] tcp: drop the hash_32() part from the index calculation [5.17,068/114] block: Do not call folio_next() on an unreferenced folio [5.17,069/114] interconnect: Restore sync state by ignoring ipa-virt in provider count [5.17,070/114] perf tests: Fix coresight `perf test` failure. [5.17,071/114] firmware_loader: use kernel credentials when reading firmware [5.17,072/114] KVM: PPC: Book3S PR: Enable MSR_DR for switch_mmu_context() [5.17,073/114] usb: xhci-mtk: fix fs isocs transfer error [5.17,074/114] x86/mm: Fix marking of unused sub-pmd ranges [5.17,075/114] tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe() [5.17,076/114] tty: n_gsm: fix buffer over-read in gsm_dlci_data() [5.17,077/114] tty: n_gsm: fix mux activation issues in gsm_config() [5.17,078/114] tty: n_gsm: fix invalid gsmtty_write_room() result [5.17,079/114] usb: gadget: uvc: allow for application to cleanly shutdown [5.17,080/114] usb: cdc-wdm: fix reading stuck on device close [5.17,081/114] usb: typec: tcpci: Dont skip cleanup in .remove() on error [5.17,082/114] usb: typec: tcpci_mt6360: Update for BMC PHY setting [5.17,083/114] USB: serial: pl2303: add device id for HP LM930 Display [5.17,084/114] USB: serial: qcserial: add support for Sierra Wireless EM7590 [5.17,085/114] USB: serial: option: add Fibocom L610 modem [5.17,086/114] USB: serial: option: add Fibocom MA510 modem [5.17,087/114] slimbus: qcom: Fix IRQ check in qcom_slim_probe [5.17,088/114] fsl_lpuart: Dont enable interrupts too early [5.17,089/114] genirq: Remove WARN_ON_ONCE() in generic_handle_domain_irq() [5.17,090/114] serial: 8250_mtk: Fix UART_EFR register address [5.17,091/114] serial: 8250_mtk: Fix register address for XON/XOFF character [5.17,092/114] ceph: fix setting of xattrs on async created inodes [5.17,093/114] Revert "mm/memory-failure.c: skip huge_zero_page in memory_failure()" [5.17,094/114] mm/huge_memory: do not overkill when splitting huge_zero_page [5.17,095/114] mm: mremap: fix sign for EFAULT error return value [5.17,096/114] drm/vmwgfx: Disable command buffers on svga3 without gbobjects [5.17,097/114] drm/nouveau/tegra: Stop using iommu_present() [5.17,098/114] i40e: i40e_main: fix a missing check on list iterator [5.17,099/114] net: atlantic: always deep reset on pm op, fixing up my null deref regression [5.17,100/114] net: phy: Fix race condition on link status change [5.17,101/114] writeback: Avoid skipping inode writeback [5.17,102/114] cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp() [5.17,103/114] ping: fix address binding wrt vrf [5.17,104/114] ath11k: reduce the wait time of 11d scan and hw scan while add interface [5.17,105/114] arm[64]/memremap: dont abuse pfn_valid() to ensure presence of linear map [5.17,106/114] net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061 [5.17,107/114] net: phy: micrel: Pass .probe for KS8737 [5.17,108/114] SUNRPC: Ensure that the gssproxy client can start in a connected state [5.17,109/114] drm/vmwgfx: Initialize drm_mode_fb_cmd2 [5.17,110/114] Revert "drm/amd/pm: keep the BACO feature enabled for suspend" [5.17,111/114] dma-buf: call dma_buf_stats_setup after dmabuf is in valid list [5.17,112/114] mm/hwpoison: use pr_err() instead of dump_page() in get_any_page() [5.17,113/114] net: phy: micrel: Fix incorrect variable type in micrel [5.17,114/114] mm/kfence: reset PG_slab and memcg_data before freeing __kfence_pool

[5.17,094/114] mm/huge_memory: do not overkill when splitting huge_zero_page

Commit Message

Patch