Patch "mm/memory-failure: call shake_page() when error hits thp tail page" has been added to the 4.0-stable tree

This is a note to let you know that I've just added the patch titled

mm/memory-failure: call shake_page() when error hits thp tail page

to the 4.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch
and it can be found in the queue-4.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Naoya Horiguchi <[email protected]>
Date: Tue, 5 May 2015 16:23:35 -0700
Subject: mm/memory-failure: call shake_page() when error hits thp tail page

From: Naoya Horiguchi <[email protected]>

commit 09789e5de18e4e442870b2d700831f5cb802eb05 upstream.

Currently memory_failure() calls shake_page() to sweep pages out from pcplists only when the victim page is 4kB LRU page or thp head page. But we should do this for a thp tail page too.

Consider that a memory error hits a thp tail page whose head page is on a pcplist when memory_failure() runs. Then, the current kernel skips shake_pages() part, so hwpoison_user_mappings() returns without calling split_huge_page() nor try_to_unmap() because PageLRU of the thp head is still cleared due to the skip of shake_page().

As a result, me_huge_page() runs for the thp, which is broken behavior.

One effect is a leak of the thp. And another is to fail to isolate the memory error, so later access to the error address causes another MCE, which kills the processes which used the thp.

This patch fixes this problem by calling shake_page() for thp tail case.

---
 mm/memory-failure.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

@@ -1141,10 +1141,10 @@ int memory_failure(unsigned long pfn, in
 	 * The check (unnecessarily) ignores LRU pages being isolated and
 	 * walked by the page reclaim code, however that's not a big loss.
 	 */
-	if (!PageHuge(p) && !PageTransTail(p)) {
-		if (!PageLRU(p))
-			shake_page(p, 0);
-		if (!PageLRU(p)) {
+	if (!PageHuge(p)) {
+		if (!PageLRU(hpage))
+			shake_page(hpage, 0);
+		if (!PageLRU(hpage)) {
 			/*
 			 * shake_page could have turned it free.
 			 */

Patches currently in stable-queue which might be from [email protected] are

queue-4.0/mm-soft-offline-fix-num_poisoned_pages-counting-on-concurrent-events.patch queue-4.0/mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch