Re: zswap explosion when using zsmalloc pool compression

[Mike Galbraith <efault@gmx.de>]

On Thu, 2020-12-03 at 13:51 +0100, Mike Galbraith wrote:
>
> BUG()
> 0xffffffff812f6e90 is in zs_map_object (mm/zsmalloc.c:1401).
> 1396
> 1397            get_zspage_mapping(zspage, &class_idx, &fg);
> 1398            class = pool->size_class[class_idx];
> 1399            off = (class->size * obj_idx) & ~PAGE_MASK;
> 1400
> 1401            local_lock(&zs_map_area.lock);
> 1402            area = this_cpu_ptr(&zs_map_area);
> 1403            area->vm_mm = mm;
> 1404            if (off + class->size <= PAGE_SIZE) {
> 1405                    /* this object is contained entirely within a page */


crash> rt_mutex ffff8a33ded29d20
struct rt_mutex {
  wait_lock = {
    raw_lock = {
      {
        val = {
          counter = 1
        },
        {
          locked = 1 '\001',
          pending = 0 '\000'
        },
        {
          locked_pending = 1,
          tail = 0
        }
      }
    },
    magic = 3735899821,
    owner_cpu = 4,
    owner = 0xffff8a337a651b40,
    dep_map = {
      key = 0x0,
      class_cache = {0x0, 0x0},
      name = 0xffffffffba10c8da "(lock).lock.lock.wait_lock",
      wait_type_outer = 0,
      wait_type_inner = 2
    }
  },
  waiters = {
    rb_root = {
      rb_node = 0xffffa2524328b5e0
    },
    rb_leftmost = 0xffffa2524328b5e0
  },
  owner = 0xffff8a3359ff3681,
  save_state = 1,
  dep_map = {
    key = 0x0,
    class_cache = {0x0, 0x0},
    name = 0x0,
    wait_type_outer = 0,
    wait_type_inner = 0
  }
}
crash>

Oh dear, lock.owner is indeed the guy who made BUG() happen.