On Tue, 11 Aug 2015 18:47:57 +0800 Wanpeng Li <wanpeng.li@xxxxxxxxxxx> wrote:
...So I'm assuming this patch is needed for 4.2 but not in earlier
Huge zero page is allocated if page fault w/o FAULT_FLAG_WRITE flag.
The get_user_pages_fast() which called in madvise_hwpoison() will get
huge zero page if the page is not allocated before. Huge zero page is
a tranparent huge page, however, it is not an anonymous page. memory_failure
will split the huge zero page and trigger BUG_ON(is_huge_zero_page(page));
After commit (98ed2b0: mm/memory-failure: give up error handling for
non-tail-refcounted thp), memory_failure will not catch non anon thp
from madvise_hwpoison path and this bug occur.