Patch "mm: thp: broken page count after commit aa88b68c3b1d" has been added to the 4.6-stable tree

This is a note to let you know that I've just added the patch titled

mm: thp: broken page count after commit aa88b68c3b1d

to the 4.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mm-thp-broken-page-count-after-commit-aa88b68c3b1d.patch
and it can be found in the queue-4.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Gerald Schaefer <[email protected]>
Date: Wed, 8 Jun 2016 15:33:50 -0700
Subject: mm: thp: broken page count after commit aa88b68c3b1d

From: Gerald Schaefer <[email protected]>

commit 770a5370226cb207461bbad902543381c1fad521 upstream.

Christian Borntraeger reported a kernel panic after corrupt page counts, and it turned out to be a regression introduced with commit aa88b68c3b1d ("thp: keep huge zero page pinned until tlb flush"), at least on s390.

put_huge_zero_page() was moved over from zap_huge_pmd() to release_pages(), and it was replaced by tlb_remove_page(). However, release_pages() might not always be triggered by (the arch-specific) tlb_remove_page().

On s390 we call free_page_and_swap_cache() from tlb_remove_page(), and not tlb_flush_mmu() -> free_pages_and_swap_cache() like the generic version, because we don't use the MMU-gather logic. Although both functions have very similar names, they are doing very unsimilar things, in particular free_page_xxx is just doing a put_page(), while free_pages_xxx calls release_pages().

This of course results in very harmful put_page()s on the huge zero page, on architectures where tlb_remove_page() is implemented in this way. It seems to affect only s390 and sh, but sh doesn't have THP support, so the problem (currently) probably only exists on s390.

The following quick hack fixed the issue:

---
 mm/swap_state.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

@@ -252,7 +252,10 @@ static inline void free_swap_cache(struc
 void free_page_and_swap_cache(struct page *page)
 {
 	free_swap_cache(page);
-	put_page(page);
+	if (is_huge_zero_page(page))
+		put_huge_zero_page();
+	else
+		put_page(page);
 }
 
 /*

Patches currently in stable-queue which might be from [email protected] are

queue-4.6/mm-thp-broken-page-count-after-commit-aa88b68c3b1d.patch