linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH -mm -v3] mm, swap, frontswap: Fix THP swap if frontswap enabled
@ 2018-02-09  8:49 Huang, Ying
  2018-02-09 21:03 ` Andrew Morton
  0 siblings, 1 reply; 3+ messages in thread
From: Huang, Ying @ 2018-02-09  8:49 UTC (permalink / raw)
  To: Andrew Morton
  Cc: linux-mm, linux-kernel, Huang Ying, Huang, Ying,
	Konrad Rzeszutek Wilk, Dan Streetman, Seth Jennings,
	Tetsuo Handa, Shaohua Li, Michal Hocko, Johannes Weiner,
	Mel Gorman, Shakeel Butt, Boris Ostrovsky, Juergen Gross, stable,
	Sergey Senozhatsky, Minchan Kim

From: Huang Ying <huang.ying.caritas@gmail.com>

It was reported by Sergey Senozhatsky that if THP (Transparent Huge
Page) and frontswap (via zswap) are both enabled, when memory goes low
so that swap is triggered, segfault and memory corruption will occur
in random user space applications as follow,

kernel: urxvt[338]: segfault at 20 ip 00007fc08889ae0d sp 00007ffc73a7fc40 error 6 in libc-2.26.so[7fc08881a000+1ae000]
 #0  0x00007fc08889ae0d _int_malloc (libc.so.6)
 #1  0x00007fc08889c2f3 malloc (libc.so.6)
 #2  0x0000560e6004bff7 _Z14rxvt_wcstoutf8PKwi (urxvt)
 #3  0x0000560e6005e75c n/a (urxvt)
 #4  0x0000560e6007d9f1 _ZN16rxvt_perl_interp6invokeEP9rxvt_term9hook_typez (urxvt)
 #5  0x0000560e6003d988 _ZN9rxvt_term9cmd_parseEv (urxvt)
 #6  0x0000560e60042804 _ZN9rxvt_term6pty_cbERN2ev2ioEi (urxvt)
 #7  0x0000560e6005c10f _Z17ev_invoke_pendingv (urxvt)
 #8  0x0000560e6005cb55 ev_run (urxvt)
 #9  0x0000560e6003b9b9 main (urxvt)
 #10 0x00007fc08883af4a __libc_start_main (libc.so.6)
 #11 0x0000560e6003f9da _start (urxvt)

After bisection, it was found the first bad commit is
bd4c82c22c367e068 ("mm, THP, swap: delay splitting THP after swapped
out").

The root cause is as follow.

When the pages are written to swap device during swapping out in
swap_writepage(), zswap (fontswap) is tried to compress the pages
instead to improve the performance.  But zswap (frontswap) will treat
THP as normal page, so only the head page is saved.  After swapping
in, tail pages will not be restored to its original contents, so cause
the memory corruption in the applications.

This is fixed via rejecting to save page in frontswap store functions
if the page is a THP.  So that the THP will be swapped out to swap
device.

Another choice is to split THP if frontswap is enabled.  But it is
found that the frontswap enabling isn't flexible.  For example, if
CONFIG_ZSWAP=y (cannot be module), frontswap will be enabled even if
zswap itself isn't enabled.

Frontswap has multiple backends, to make it easy for one backend to
enable THP support, the THP checking is put in backend frontswap store
functions instead of the general interfaces.

Fixes: bd4c82c22c367e068 ("mm, THP, swap: delay splitting THP after swapped out")
Reported-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Suggested-by: Minchan Kim <minchan@kernel.org> # put THP checking in backend
Signed-off-by: "Huang, Ying" <ying.huang@intel.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Dan Streetman <ddstreet@ieee.org>
Cc: Seth Jennings <sjenning@redhat.com>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Shaohua Li <shli@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: stable@vger.kernel.org # 4.14

Changelog:

v3:

- Fix via checking THP in frontswap backend as suggested by Minchan.

v2:

- Move frontswap check into swapfile.c to avoid to make vmscan.c
  depends on frontswap as suggested by Minchan.
---
 drivers/xen/tmem.c | 4 ++++
 mm/zswap.c         | 6 ++++++
 2 files changed, 10 insertions(+)

diff --git a/drivers/xen/tmem.c b/drivers/xen/tmem.c
index bf13d1ec51f3..04e7b3b29bac 100644
--- a/drivers/xen/tmem.c
+++ b/drivers/xen/tmem.c
@@ -284,6 +284,10 @@ static int tmem_frontswap_store(unsigned type, pgoff_t offset,
 	int pool = tmem_frontswap_poolid;
 	int ret;
 
+	/* THP isn't supported */
+	if (PageTransHuge(page))
+		return -1;
+
 	if (pool < 0)
 		return -1;
 	if (ind64 != ind)
diff --git a/mm/zswap.c b/mm/zswap.c
index c004aa4fd3f4..61a5c41972db 100644
--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -1007,6 +1007,12 @@ static int zswap_frontswap_store(unsigned type, pgoff_t offset,
 	u8 *src, *dst;
 	struct zswap_header zhdr = { .swpentry = swp_entry(type, offset) };
 
+	/* THP isn't supported */
+	if (PageTransHuge(page)) {
+		ret = -EINVAL;
+		goto reject;
+	}
+
 	if (!zswap_enabled || !tree) {
 		ret = -ENODEV;
 		goto reject;
-- 
2.15.1

^ permalink raw reply related	[flat|nested] 3+ messages in thread

* Re: [PATCH -mm -v3] mm, swap, frontswap: Fix THP swap if frontswap enabled
  2018-02-09  8:49 [PATCH -mm -v3] mm, swap, frontswap: Fix THP swap if frontswap enabled Huang, Ying
@ 2018-02-09 21:03 ` Andrew Morton
  2018-02-12  2:28   ` Sergey Senozhatsky
  0 siblings, 1 reply; 3+ messages in thread
From: Andrew Morton @ 2018-02-09 21:03 UTC (permalink / raw)
  To: Huang, Ying
  Cc: linux-mm, linux-kernel, Huang Ying, Konrad Rzeszutek Wilk,
	Dan Streetman, Seth Jennings, Tetsuo Handa, Shaohua Li,
	Michal Hocko, Johannes Weiner, Mel Gorman, Shakeel Butt,
	Boris Ostrovsky, Juergen Gross, stable, Sergey Senozhatsky,
	Minchan Kim

On Fri,  9 Feb 2018 16:49:47 +0800 "Huang, Ying" <ying.huang@intel.com> wrote:

> From: Huang Ying <huang.ying.caritas@gmail.com>
> 
> It was reported by Sergey Senozhatsky that if THP (Transparent Huge
> Page) and frontswap (via zswap) are both enabled, when memory goes low
> so that swap is triggered, segfault and memory corruption will occur
> in random user space applications as follow,
> 
> kernel: urxvt[338]: segfault at 20 ip 00007fc08889ae0d sp 00007ffc73a7fc40 error 6 in libc-2.26.so[7fc08881a000+1ae000]
>  #0  0x00007fc08889ae0d _int_malloc (libc.so.6)
>  #1  0x00007fc08889c2f3 malloc (libc.so.6)
>  #2  0x0000560e6004bff7 _Z14rxvt_wcstoutf8PKwi (urxvt)
>  #3  0x0000560e6005e75c n/a (urxvt)
>  #4  0x0000560e6007d9f1 _ZN16rxvt_perl_interp6invokeEP9rxvt_term9hook_typez (urxvt)
>  #5  0x0000560e6003d988 _ZN9rxvt_term9cmd_parseEv (urxvt)
>  #6  0x0000560e60042804 _ZN9rxvt_term6pty_cbERN2ev2ioEi (urxvt)
>  #7  0x0000560e6005c10f _Z17ev_invoke_pendingv (urxvt)
>  #8  0x0000560e6005cb55 ev_run (urxvt)
>  #9  0x0000560e6003b9b9 main (urxvt)
>  #10 0x00007fc08883af4a __libc_start_main (libc.so.6)
>  #11 0x0000560e6003f9da _start (urxvt)
> 
> After bisection, it was found the first bad commit is
> bd4c82c22c367e068 ("mm, THP, swap: delay splitting THP after swapped
> out").
> 
> The root cause is as follow.
> 
> When the pages are written to swap device during swapping out in
> swap_writepage(), zswap (fontswap) is tried to compress the pages
> instead to improve the performance.  But zswap (frontswap) will treat
> THP as normal page, so only the head page is saved.  After swapping
> in, tail pages will not be restored to its original contents, so cause
> the memory corruption in the applications.
> 
> This is fixed via rejecting to save page in frontswap store functions
> if the page is a THP.  So that the THP will be swapped out to swap
> device.
> 
> Another choice is to split THP if frontswap is enabled.  But it is
> found that the frontswap enabling isn't flexible.  For example, if
> CONFIG_ZSWAP=y (cannot be module), frontswap will be enabled even if
> zswap itself isn't enabled.
> 
> Frontswap has multiple backends, to make it easy for one backend to
> enable THP support, the THP checking is put in backend frontswap store
> functions instead of the general interfaces.
> 
> Fixes: bd4c82c22c367e068 ("mm, THP, swap: delay splitting THP after swapped out")
> Reported-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
> Tested-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>

I don't think Sergey has tested this version and I suspect this is a
holdover from the earlier patch, so I'll remove this line.

> Suggested-by: Minchan Kim <minchan@kernel.org> # put THP checking in backend
> Signed-off-by: "Huang, Ying" <ying.huang@intel.com>
> Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> Cc: Dan Streetman <ddstreet@ieee.org>
> Cc: Seth Jennings <sjenning@redhat.com>
> Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Cc: Shaohua Li <shli@kernel.org>
> Cc: Michal Hocko <mhocko@suse.com>
> Cc: Johannes Weiner <hannes@cmpxchg.org>
> Cc: Mel Gorman <mgorman@techsingularity.net>
> Cc: Shakeel Butt <shakeelb@google.com>
> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> Cc: Juergen Gross <jgross@suse.com>
> Cc: stable@vger.kernel.org # 4.14

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH -mm -v3] mm, swap, frontswap: Fix THP swap if frontswap enabled
  2018-02-09 21:03 ` Andrew Morton
@ 2018-02-12  2:28   ` Sergey Senozhatsky
  0 siblings, 0 replies; 3+ messages in thread
From: Sergey Senozhatsky @ 2018-02-12  2:28 UTC (permalink / raw)
  To: Andrew Morton
  Cc: Huang, Ying, linux-mm, linux-kernel, Huang Ying,
	Konrad Rzeszutek Wilk, Dan Streetman, Seth Jennings,
	Tetsuo Handa, Shaohua Li, Michal Hocko, Johannes Weiner,
	Mel Gorman, Shakeel Butt, Boris Ostrovsky, Juergen Gross, stable,
	Sergey Senozhatsky, Minchan Kim

Hello,

On (02/09/18 13:03), Andrew Morton wrote:
[..]
> > Frontswap has multiple backends, to make it easy for one backend to
> > enable THP support, the THP checking is put in backend frontswap store
> > functions instead of the general interfaces.
> > 
> > Fixes: bd4c82c22c367e068 ("mm, THP, swap: delay splitting THP after swapped out")
> > Reported-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
> > Tested-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
> 
> I don't think Sergey has tested this version and I suspect this is a
> holdover from the earlier patch, so I'll remove this line.

Just tested it (v3) with FRONTSWAP enabled (didn't test XEN tmem).
Works fine.

FWIW
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com> # frontswap

	-ss

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2018-02-12  2:28 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-02-09  8:49 [PATCH -mm -v3] mm, swap, frontswap: Fix THP swap if frontswap enabled Huang, Ying
2018-02-09 21:03 ` Andrew Morton
2018-02-12  2:28   ` Sergey Senozhatsky

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).