Re: [PATCH -mm -v3] mm, swap, frontswap: Fix THP swap if frontswap enabled

[Andrew Morton]

On Fri,  9 Feb 2018 16:49:47 +0800 "Huang, Ying" <ying.huang@xxxxxxxxx> wrote:

> From: Huang Ying <huang.ying.caritas@xxxxxxxxx>
> 
> It was reported by Sergey Senozhatsky that if THP (Transparent Huge
> Page) and frontswap (via zswap) are both enabled, when memory goes low
> so that swap is triggered, segfault and memory corruption will occur
> in random user space applications as follow,
> 
> kernel: urxvt[338]: segfault at 20 ip 00007fc08889ae0d sp 00007ffc73a7fc40 error 6 in libc-2.26.so[7fc08881a000+1ae000]
>  #0  0x00007fc08889ae0d _int_malloc (libc.so.6)
>  #1  0x00007fc08889c2f3 malloc (libc.so.6)
>  #2  0x0000560e6004bff7 _Z14rxvt_wcstoutf8PKwi (urxvt)
>  #3  0x0000560e6005e75c n/a (urxvt)
>  #4  0x0000560e6007d9f1 _ZN16rxvt_perl_interp6invokeEP9rxvt_term9hook_typez (urxvt)
>  #5  0x0000560e6003d988 _ZN9rxvt_term9cmd_parseEv (urxvt)
>  #6  0x0000560e60042804 _ZN9rxvt_term6pty_cbERN2ev2ioEi (urxvt)
>  #7  0x0000560e6005c10f _Z17ev_invoke_pendingv (urxvt)
>  #8  0x0000560e6005cb55 ev_run (urxvt)
>  #9  0x0000560e6003b9b9 main (urxvt)
>  #10 0x00007fc08883af4a __libc_start_main (libc.so.6)
>  #11 0x0000560e6003f9da _start (urxvt)
> 
> After bisection, it was found the first bad commit is
> bd4c82c22c367e068 ("mm, THP, swap: delay splitting THP after swapped
> out").
> 
> The root cause is as follow.
> 
> When the pages are written to swap device during swapping out in
> swap_writepage(), zswap (fontswap) is tried to compress the pages
> instead to improve the performance.  But zswap (frontswap) will treat
> THP as normal page, so only the head page is saved.  After swapping
> in, tail pages will not be restored to its original contents, so cause
> the memory corruption in the applications.
> 
> This is fixed via rejecting to save page in frontswap store functions
> if the page is a THP.  So that the THP will be swapped out to swap
> device.
> 
> Another choice is to split THP if frontswap is enabled.  But it is
> found that the frontswap enabling isn't flexible.  For example, if
> CONFIG_ZSWAP=y (cannot be module), frontswap will be enabled even if
> zswap itself isn't enabled.
> 
> Frontswap has multiple backends, to make it easy for one backend to
> enable THP support, the THP checking is put in backend frontswap store
> functions instead of the general interfaces.
> 
> Fixes: bd4c82c22c367e068 ("mm, THP, swap: delay splitting THP after swapped out")
> Reported-by: Sergey Senozhatsky <sergey.senozhatsky@xxxxxxxxx>
> Tested-by: Sergey Senozhatsky <sergey.senozhatsky@xxxxxxxxx>

I don't think Sergey has tested this version and I suspect this is a
holdover from the earlier patch, so I'll remove this line.

> Suggested-by: Minchan Kim <minchan@xxxxxxxxxx> # put THP checking in backend
> Signed-off-by: "Huang, Ying" <ying.huang@xxxxxxxxx>
> Cc: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
> Cc: Dan Streetman <ddstreet@xxxxxxxx>
> Cc: Seth Jennings <sjenning@xxxxxxxxxx>
> Cc: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
> Cc: Shaohua Li <shli@xxxxxxxxxx>
> Cc: Michal Hocko <mhocko@xxxxxxxx>
> Cc: Johannes Weiner <hannes@xxxxxxxxxxx>
> Cc: Mel Gorman <mgorman@xxxxxxxxxxxxxxxxxxx>
> Cc: Shakeel Butt <shakeelb@xxxxxxxxxx>
> Cc: Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>
> Cc: Juergen Gross <jgross@xxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx # 4.14