• Gerald Schaefer's avatar
    mm: thp: broken page count after commit aa88b68c · 770a5370
    Gerald Schaefer authored
    Christian Borntraeger reported a kernel panic after corrupt page counts,
    and it turned out to be a regression introduced with commit aa88b68c
    ("thp: keep huge zero page pinned until tlb flush"), at least on s390.
    
    put_huge_zero_page() was moved over from zap_huge_pmd() to
    release_pages(), and it was replaced by tlb_remove_page().  However,
    release_pages() might not always be triggered by (the arch-specific)
    tlb_remove_page().
    
    On s390 we call free_page_and_swap_cache() from tlb_remove_page(), and
    not tlb_flush_mmu() -> free_pages_and_swap_cache() like the generic
    version, because we don't use the MMU-gather logic.  Although both
    functions have very similar names, they are doing very unsimilar things,
    in particular free_page_xxx is just doing a put_page(), while
    free_pages_xxx calls release_pages().
    
    This of course results in very harmful put_page()s on the huge zero
    page, on architectures where tlb_remove_page() is implemented in this
    way.  It seems to affect only s390 and sh, but sh doesn't have THP
    support, so the problem (currently) probably only exists on s390.
    
    The following quick hack fixed the issue:
    
    Link: http://lkml.kernel.org/r/20160602172141.75c006a9@thinkpadSigned-off-by: default avatarGerald Schaefer <gerald.schaefer@de.ibm.com>
    Reported-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
    Tested-by: default avatarChristian Borntraeger <borntraeger@de.ibm.com>
    Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
    Cc: Mel Gorman <mgorman@techsingularity.net>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Johannes Weiner <hannes@cmpxchg.org>
    Cc: Dave Hansen <dave.hansen@intel.com>
    Cc: Vlastimil Babka <vbabka@suse.cz>
    Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
    Cc: <stable@vger.kernel.org>	[4.6.x]
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    770a5370
swap_state.c 13.1 KB