History

Merge branch 'akpm' (patches from Andrew)

Merge misc fixes from Andrew Morton: "12 fixes" * emailed patches from Andrew Morton <akpm@linux-foundation.org>: mm, vmscan: prevent kswapd livelock due to pfmemalloc-throttled process being killed memcg: fix destination cgroup leak on task charges migration mm: memcontrol: switch soft limit default back to infinity mm/debug_pagealloc: remove obsolete Kconfig options vfs: renumber FMODE_NONOTIFY and add to uniqueness check arch/blackfin/mach-bf533/boards/stamp.c: add linux/delay.h ocfs2: fix the wrong directory passed to ocfs2_lookup_ino_from_name() when link file MAINTAINERS: update rydberg's addresses mm: protect set_page_dirty() from ongoing truncation mm: prevent endless growth of anon_vma hierarchy exit: fix race between wait_consider_task() and wait_task_zombie() ocfs2: remove bogus check in dlm_process_recovery_data

Linus Torvalds committed 11 years ago

Commit b3d574a2 parents 11c8f01 9e5e36617 files · +155 −101Browse files

Unified · Split

17 files
  1. .mailmap +1 −0
  2. MAINTAINERS +6 −6
  3. arch/blackfin/mach-bf533/boards/stamp.c +1 −0
  4. fs/fcntl.c +3 −2
  5. fs/ocfs2/dlm/dlmrecovery.c +1 −4
  6. fs/ocfs2/namei.c +35 −8
  7. include/linux/fs.h +1 −1
  8. include/linux/rmap.h +10 −0
  9. include/linux/writeback.h +0 −1
  10. include/uapi/asm-generic/fcntl.h +1 −1
  11. kernel/exit.c +9 −3
  12. mm/Kconfig.debug +0 −9
  13. mm/memcontrol.c +4 −13
  14. mm/memory.c +17 −10
  15. mm/page-writeback.c +12 −31
  16. mm/rmap.c +41 −1
  17. mm/vmscan.c +13 −11
.mailmap+1−0
@@ -51,6 +51,7 @@ Greg Kroah-Hartman <gregkh@suse.de> · 50 unmodified lines
5151 Greg Kroah-Hartman <greg@kroah.com>
5252 Henk Vergonet <Henk.Vergonet@gmail.com>
5353 Henrik Kretzschmar <henne@nachtwindheim.de>
54+Henrik Rydberg <rydberg@bitmath.org>
5455 Herbert Xu <herbert@gondor.apana.org.au>
5556 Jacob Shin <Jacob.Shin@amd.com>
5657 James Bottomley <jejb@mulgrave.(none)>
MAINTAINERS+6−6
@@ -724,15 +724,15 @@ F: include/uapi/linux/apm_bios.h · 723 unmodified lines
724724 F: drivers/char/apm-emulation.c
725725
726726 APPLE BCM5974 MULTITOUCH DRIVER
727−M: Henrik Rydberg <rydberg@euromail.se>
727+M: Henrik Rydberg <rydberg@bitmath.org>
728728 L: linux-input@vger.kernel.org
729−S: Maintained
729+S: Odd fixes
730730 F: drivers/input/mouse/bcm5974.c
731731
732732 APPLE SMC DRIVER
733−M: Henrik Rydberg <rydberg@euromail.se>
733+M: Henrik Rydberg <rydberg@bitmath.org>
734734 L: lm-sensors@lm-sensors.org
735−S: Maintained
735+S: Odd fixes
736736 F: drivers/hwmon/applesmc.c
737737
738738 APPLETALK NETWORK LAYER
@@ -4940,10 +4940,10 @@ F: include/uapi/linux/input.h · 4201 unmodified lines
49404940 F: include/linux/input/
49414941
49424942 INPUT MULTITOUCH (MT) PROTOCOL
4943−M: Henrik Rydberg <rydberg@euromail.se>
4943+M: Henrik Rydberg <rydberg@bitmath.org>
49444944 L: linux-input@vger.kernel.org
49454945 T: git git://git.kernel.org/pub/scm/linux/kernel/git/rydberg/input-mt.git
4946−S: Maintained
4946+S: Odd fixes
49474947 F: Documentation/input/multi-touch-protocol.txt
49484948 F: drivers/input/input-mt.c
49494949 K: \b(ABS|SYN)_MT_
arch/blackfin/mach-bf533/boards/stamp.c+1−0
@@ -7,6 +7,7 @@ · 6 unmodified lines
77 */
88
99 #include <linux/device.h>
10+#include <linux/delay.h>
1011 #include <linux/platform_device.h>
1112 #include <linux/mtd/mtd.h>
1213 #include <linux/mtd/partitions.h>
fs/fcntl.c+3−2
@@ -740,14 +740,15 @@ static int __init fcntl_init(void) · 739 unmodified lines
740740 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
741741 * is defined as O_NONBLOCK on some platforms and not on others.
742742 */
743− BUILD_BUG_ON(20 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
743+ BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
744744 O_RDONLY | O_WRONLY | O_RDWR |
745745 O_CREAT | O_EXCL | O_NOCTTY |
746746 O_TRUNC | O_APPEND | /* O_NONBLOCK | */
747747 __O_SYNC | O_DSYNC | FASYNC |
748748 O_DIRECT | O_LARGEFILE | O_DIRECTORY |
749749 O_NOFOLLOW | O_NOATIME | O_CLOEXEC |
750− __FMODE_EXEC | O_PATH | __O_TMPFILE
750+ __FMODE_EXEC | O_PATH | __O_TMPFILE |
751+ __FMODE_NONOTIFY
751752 ));
752753
753754 fasync_cache = kmem_cache_create("fasync_cache",
fs/ocfs2/dlm/dlmrecovery.c+1−4
@@ -2023,11 +2023,8 @@ leave: · 2022 unmodified lines
20232023 dlm_lockres_drop_inflight_ref(dlm, res);
20242024 spin_unlock(&res->spinlock);
20252025
2026− if (ret < 0) {
2026+ if (ret < 0)
20272027 mlog_errno(ret);
2028− if (newlock)
2029− dlm_lock_put(newlock);
2030− }
20312028
20322029 return ret;
20332030 }
fs/ocfs2/namei.c+35−8
@@ -94,6 +94,14 @@ static int ocfs2_create_symlink_data(struct ocfs2_super *osb, · 93 unmodified lines
9494 struct inode *inode,
9595 const char *symname);
9696
97+static int ocfs2_double_lock(struct ocfs2_super *osb,
98+ struct buffer_head **bh1,
99+ struct inode *inode1,
100+ struct buffer_head **bh2,
101+ struct inode *inode2,
102+ int rename);
103+
104+static void ocfs2_double_unlock(struct inode *inode1, struct inode *inode2);
97105 /* An orphan dir name is an 8 byte value, printed as a hex string */
98106 #define OCFS2_ORPHAN_NAMELEN ((int)(2 * sizeof(u64)))
99107
@@ -678,8 +686,10 @@ static int ocfs2_link(struct dentry *old_dentry, · 578 unmodified lines
678686 {
679687 handle_t *handle;
680688 struct inode *inode = old_dentry->d_inode;
689+ struct inode *old_dir = old_dentry->d_parent->d_inode;
681690 int err;
682691 struct buffer_head *fe_bh = NULL;
692+ struct buffer_head *old_dir_bh = NULL;
683693 struct buffer_head *parent_fe_bh = NULL;
684694 struct ocfs2_dinode *fe = NULL;
685695 struct ocfs2_super *osb = OCFS2_SB(dir->i_sb);
@@ -696,19 +706,33 @@ static int ocfs2_link(struct dentry *old_dentry, · 10 unmodified lines
696706
697707 dquot_initialize(dir);
698708
699− err = ocfs2_inode_lock_nested(dir, &parent_fe_bh, 1, OI_LS_PARENT);
709+ err = ocfs2_double_lock(osb, &old_dir_bh, old_dir,
710+ &parent_fe_bh, dir, 0);
700711 if (err < 0) {
701712 if (err != -ENOENT)
702713 mlog_errno(err);
703714 return err;
704715 }
705716
717+ /* make sure both dirs have bhs
718+ * get an extra ref on old_dir_bh if old==new */
719+ if (!parent_fe_bh) {
720+ if (old_dir_bh) {
721+ parent_fe_bh = old_dir_bh;
722+ get_bh(parent_fe_bh);
723+ } else {
724+ mlog(ML_ERROR, "%s: no old_dir_bh!\n", osb->uuid_str);
725+ err = -EIO;
726+ goto out;
727+ }
728+ }
729+
706730 if (!dir->i_nlink) {
707731 err = -ENOENT;
708732 goto out;
709733 }
710734
711− err = ocfs2_lookup_ino_from_name(dir, old_dentry->d_name.name,
735+ err = ocfs2_lookup_ino_from_name(old_dir, old_dentry->d_name.name,
712736 old_dentry->d_name.len, &old_de_ino);
713737 if (err) {
714738 err = -ENOENT;
@@ -801,10 +825,11 @@ out_unlock_inode: · 86 unmodified lines
801825 ocfs2_inode_unlock(inode, 1);
802826
803827 out:
804− ocfs2_inode_unlock(dir, 1);
828+ ocfs2_double_unlock(old_dir, dir);
805829
806830 brelse(fe_bh);
807831 brelse(parent_fe_bh);
832+ brelse(old_dir_bh);
808833
809834 ocfs2_free_dir_lookup_result(&lookup);
810835
@@ -1072,14 +1097,15 @@ static int ocfs2_check_if_ancestor(struct ocfs2_super *osb, · 261 unmodified lines
10721097 }
10731098
10741099 /*
1075− * The only place this should be used is rename!
1100+ * The only place this should be used is rename and link!
10761101 * if they have the same id, then the 1st one is the only one locked.
10771102 */
10781103 static int ocfs2_double_lock(struct ocfs2_super *osb,
10791104 struct buffer_head **bh1,
10801105 struct inode *inode1,
10811106 struct buffer_head **bh2,
1082− struct inode *inode2)
1107+ struct inode *inode2,
1108+ int rename)
10831109 {
10841110 int status;
10851111 int inode1_is_ancestor, inode2_is_ancestor;
@@ -1127,7 +1153,7 @@ static int ocfs2_double_lock(struct ocfs2_super *osb, · 41 unmodified lines
11271153 }
11281154 /* lock id2 */
11291155 status = ocfs2_inode_lock_nested(inode2, bh2, 1,
1130− OI_LS_RENAME1);
1156+ rename == 1 ? OI_LS_RENAME1 : OI_LS_PARENT);
11311157 if (status < 0) {
11321158 if (status != -ENOENT)
11331159 mlog_errno(status);
@@ -1136,7 +1162,8 @@ static int ocfs2_double_lock(struct ocfs2_super *osb, · 2 unmodified lines
11361162 }
11371163
11381164 /* lock id1 */
1139− status = ocfs2_inode_lock_nested(inode1, bh1, 1, OI_LS_RENAME2);
1165+ status = ocfs2_inode_lock_nested(inode1, bh1, 1,
1166+ rename == 1 ? OI_LS_RENAME2 : OI_LS_PARENT);
11401167 if (status < 0) {
11411168 /*
11421169 * An error return must mean that no cluster locks
@@ -1252,7 +1279,7 @@ static int ocfs2_rename(struct inode *old_dir, · 109 unmodified lines
12521279
12531280 /* if old and new are the same, this'll just do one lock. */
12541281 status = ocfs2_double_lock(osb, &old_dir_bh, old_dir,
1255− &new_dir_bh, new_dir);
1282+ &new_dir_bh, new_dir, 1);
12561283 if (status < 0) {
12571284 mlog_errno(status);
12581285 goto bail;
include/linux/fs.h+1−1
@@ -135,7 +135,7 @@ typedef void (dio_iodone_t)(struct kiocb *iocb, loff_t offset, · 134 unmodified lines
135135 #define FMODE_CAN_WRITE ((__force fmode_t)0x40000)
136136
137137 /* File was opened by fanotify and shouldn't generate fanotify events */
138−#define FMODE_NONOTIFY ((__force fmode_t)0x1000000)
138+#define FMODE_NONOTIFY ((__force fmode_t)0x4000000)
139139
140140 /*
141141 * Flag for rw_copy_check_uvector and compat_rw_copy_check_uvector
include/linux/rmap.h+10−0
@@ -36,6 +36,16 @@ struct anon_vma { · 35 unmodified lines
3636 */
3737 atomic_t refcount;
3838
39+ /*
40+ * Count of child anon_vmas and VMAs which points to this anon_vma.
41+ *
42+ * This counter is used for making decision about reusing anon_vma
43+ * instead of forking new one. See comments in function anon_vma_clone.
44+ */
45+ unsigned degree;
46+
47+ struct anon_vma *parent; /* Parent of this anon_vma */
48+
3949 /*
4050 * NOTE: the LSB of the rb_root.rb_node is set by
4151 * mm_take_all_locks() _after_ taking the above lock. So the
include/linux/writeback.h+0−1
@@ -177,7 +177,6 @@ int write_cache_pages(struct address_space *mapping, · 176 unmodified lines
177177 struct writeback_control *wbc, writepage_t writepage,
178178 void *data);
179179 int do_writepages(struct address_space *mapping, struct writeback_control *wbc);
180−void set_page_dirty_balance(struct page *page);
181180 void writeback_set_ratelimit(void);
182181 void tag_pages_for_writeback(struct address_space *mapping,
183182 pgoff_t start, pgoff_t end);
include/uapi/asm-generic/fcntl.h+1−1
@@ -5,7 +5,7 @@ · 4 unmodified lines
55
66 /*
77 * FMODE_EXEC is 0x20
8− * FMODE_NONOTIFY is 0x1000000
8+ * FMODE_NONOTIFY is 0x4000000
99 * These cannot be used by userspace O_* until internal and external open
1010 * flags are split.
1111 * -Eric Paris
kernel/exit.c+9−3
@@ -1287,9 +1287,15 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p) · 1286 unmodified lines
12871287 static int wait_consider_task(struct wait_opts *wo, int ptrace,
12881288 struct task_struct *p)
12891289 {
1290+ /*
1291+ * We can race with wait_task_zombie() from another thread.
1292+ * Ensure that EXIT_ZOMBIE -> EXIT_DEAD/EXIT_TRACE transition
1293+ * can't confuse the checks below.
1294+ */
1295+ int exit_state = ACCESS_ONCE(p->exit_state);
12901296 int ret;
12911297
1292− if (unlikely(p->exit_state == EXIT_DEAD))
1298+ if (unlikely(exit_state == EXIT_DEAD))
12931299 return 0;
12941300
12951301 ret = eligible_child(wo, p);
@@ -1310,7 +1316,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace, · 14 unmodified lines
13101316 return 0;
13111317 }
13121318
1313− if (unlikely(p->exit_state == EXIT_TRACE)) {
1319+ if (unlikely(exit_state == EXIT_TRACE)) {
13141320 /*
13151321 * ptrace == 0 means we are the natural parent. In this case
13161322 * we should clear notask_error, debugger will notify us.
@@ -1337,7 +1343,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace, · 20 unmodified lines
13371343 }
13381344
13391345 /* slay zombie? */
1340− if (p->exit_state == EXIT_ZOMBIE) {
1346+ if (exit_state == EXIT_ZOMBIE) {
13411347 /* we don't reap group leaders with subthreads */
13421348 if (!delay_group_leader(p)) {
13431349 /*
mm/Kconfig.debug+0−9
@@ -14,7 +14,6 @@ config DEBUG_PAGEALLOC · 13 unmodified lines
1414 depends on !KMEMCHECK
1515 select PAGE_EXTENSION
1616 select PAGE_POISONING if !ARCH_SUPPORTS_DEBUG_PAGEALLOC
17− select PAGE_GUARD if ARCH_SUPPORTS_DEBUG_PAGEALLOC
1817 ---help---
1918 Unmap pages from the kernel linear mapping after free_pages().
2019 This results in a large slowdown, but helps to find certain types
@@ -27,13 +26,5 @@ config DEBUG_PAGEALLOC · 6 unmodified lines
2726 that would result in incorrect warnings of memory corruption after
2827 a resume because free pages are not saved to the suspend image.
2928
30−config WANT_PAGE_DEBUG_FLAGS
31− bool
32−
3329 config PAGE_POISONING
3430 bool
35− select WANT_PAGE_DEBUG_FLAGS
36−
37−config PAGE_GUARD
38− bool
39− select WANT_PAGE_DEBUG_FLAGS
mm/memcontrol.c+4−13
@@ -3043,18 +3043,6 @@ static int mem_cgroup_move_swap_account(swp_entry_t entry, · 3042 unmodified lines
30433043 if (swap_cgroup_cmpxchg(entry, old_id, new_id) == old_id) {
30443044 mem_cgroup_swap_statistics(from, false);
30453045 mem_cgroup_swap_statistics(to, true);
3046− /*
3047− * This function is only called from task migration context now.
3048− * It postpones page_counter and refcount handling till the end
3049− * of task migration(mem_cgroup_clear_mc()) for performance
3050− * improvement. But we cannot postpone css_get(to) because if
3051− * the process that has been moved to @to does swap-in, the
3052− * refcount of @to might be decreased to 0.
3053− *
3054− * We are in attach() phase, so the cgroup is guaranteed to be
3055− * alive, so we can just call css_get().
3056− */
3057− css_get(&to->css);
30583046 return 0;
30593047 }
30603048 return -EINVAL;
@@ -4679,6 +4667,7 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css) · 1618 unmodified lines
46794667 if (parent_css == NULL) {
46804668 root_mem_cgroup = memcg;
46814669 page_counter_init(&memcg->memory, NULL);
4670+ memcg->soft_limit = PAGE_COUNTER_MAX;
46824671 page_counter_init(&memcg->memsw, NULL);
46834672 page_counter_init(&memcg->kmem, NULL);
46844673 }
@@ -4724,6 +4713,7 @@ mem_cgroup_css_online(struct cgroup_subsys_state *css) · 39 unmodified lines
47244713
47254714 if (parent->use_hierarchy) {
47264715 page_counter_init(&memcg->memory, &parent->memory);
4716+ memcg->soft_limit = PAGE_COUNTER_MAX;
47274717 page_counter_init(&memcg->memsw, &parent->memsw);
47284718 page_counter_init(&memcg->kmem, &parent->kmem);
47294719
@@ -4733,6 +4723,7 @@ mem_cgroup_css_online(struct cgroup_subsys_state *css) · 3 unmodified lines
47334723 */
47344724 } else {
47354725 page_counter_init(&memcg->memory, NULL);
4726+ memcg->soft_limit = PAGE_COUNTER_MAX;
47364727 page_counter_init(&memcg->memsw, NULL);
47374728 page_counter_init(&memcg->kmem, NULL);
47384729 /*
@@ -4807,7 +4798,7 @@ static void mem_cgroup_css_reset(struct cgroup_subsys_state *css) · 68 unmodified lines
48074798 mem_cgroup_resize_limit(memcg, PAGE_COUNTER_MAX);
48084799 mem_cgroup_resize_memsw_limit(memcg, PAGE_COUNTER_MAX);
48094800 memcg_update_kmem_limit(memcg, PAGE_COUNTER_MAX);
4810− memcg->soft_limit = 0;
4801+ memcg->soft_limit = PAGE_COUNTER_MAX;
48114802 }
48124803
48134804 #ifdef CONFIG_MMU
mm/memory.c+17−10
@@ -2137,17 +2137,24 @@ reuse: · 2136 unmodified lines
21372137 if (!dirty_page)
21382138 return ret;
21392139
2140− /*
2141− * Yes, Virginia, this is actually required to prevent a race
2142− * with clear_page_dirty_for_io() from clearing the page dirty
2143− * bit after it clear all dirty ptes, but before a racing
2144− * do_wp_page installs a dirty pte.
2145− *
2146− * do_shared_fault is protected similarly.
2147− */
21482140 if (!page_mkwrite) {
2149− wait_on_page_locked(dirty_page);
2150− set_page_dirty_balance(dirty_page);
2141+ struct address_space *mapping;
2142+ int dirtied;
2143+
2144+ lock_page(dirty_page);
2145+ dirtied = set_page_dirty(dirty_page);
2146+ VM_BUG_ON_PAGE(PageAnon(dirty_page), dirty_page);
2147+ mapping = dirty_page->mapping;
2148+ unlock_page(dirty_page);
2149+
2150+ if (dirtied && mapping) {
2151+ /*
2152+ * Some device drivers do not set page.mapping
2153+ * but still dirty their pages
2154+ */
2155+ balance_dirty_pages_ratelimited(mapping);
2156+ }
2157+
21512158 /* file_update_time outside page_lock */
21522159 if (vma->vm_file)
21532160 file_update_time(vma->vm_file);
mm/page-writeback.c+12−31
@@ -1541,16 +1541,6 @@ pause: · 1540 unmodified lines
15411541 bdi_start_background_writeback(bdi);
15421542 }
15431543
1544−void set_page_dirty_balance(struct page *page)
1545−{
1546− if (set_page_dirty(page)) {
1547− struct address_space *mapping = page_mapping(page);
1548−
1549− if (mapping)
1550− balance_dirty_pages_ratelimited(mapping);
1551− }
1552−}
1553−
15541544 static DEFINE_PER_CPU(int, bdp_ratelimits);
15551545
15561546 /*
@@ -2123,32 +2113,25 @@ EXPORT_SYMBOL(account_page_dirtied); · 566 unmodified lines
21232113 * page dirty in that case, but not all the buffers. This is a "bottom-up"
21242114 * dirtying, whereas __set_page_dirty_buffers() is a "top-down" dirtying.
21252115 *
2126− * Most callers have locked the page, which pins the address_space in memory.
2127− * But zap_pte_range() does not lock the page, however in that case the
2128− * mapping is pinned by the vma's ->vm_file reference.
2129− *
2130− * We take care to handle the case where the page was truncated from the
2131− * mapping by re-checking page_mapping() inside tree_lock.
2116+ * The caller must ensure this doesn't race with truncation. Most will simply
2117+ * hold the page lock, but e.g. zap_pte_range() calls with the page mapped and
2118+ * the pte lock held, which also locks out truncation.
21322119 */
21332120 int __set_page_dirty_nobuffers(struct page *page)
21342121 {
21352122 if (!TestSetPageDirty(page)) {
21362123 struct address_space *mapping = page_mapping(page);
2137− struct address_space *mapping2;
21382124 unsigned long flags;
21392125
21402126 if (!mapping)
21412127 return 1;
21422128
21432129 spin_lock_irqsave(&mapping->tree_lock, flags);
2144− mapping2 = page_mapping(page);
2145− if (mapping2) { /* Race with truncate? */
2146− BUG_ON(mapping2 != mapping);
2147− WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
2148− account_page_dirtied(page, mapping);
2149− radix_tree_tag_set(&mapping->page_tree,
2150− page_index(page), PAGECACHE_TAG_DIRTY);
2151− }
2130+ BUG_ON(page_mapping(page) != mapping);
2131+ WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
2132+ account_page_dirtied(page, mapping);
2133+ radix_tree_tag_set(&mapping->page_tree, page_index(page),
2134+ PAGECACHE_TAG_DIRTY);
21522135 spin_unlock_irqrestore(&mapping->tree_lock, flags);
21532136 if (mapping->host) {
21542137 /* !PageAnon && !swapper_space */
@@ -2305,12 +2288,10 @@ int clear_page_dirty_for_io(struct page *page) · 150 unmodified lines
23052288 /*
23062289 * We carefully synchronise fault handlers against
23072290 * installing a dirty pte and marking the page dirty
2308− * at this point. We do this by having them hold the
2309− * page lock at some point after installing their
2310− * pte, but before marking the page dirty.
2311− * Pages are always locked coming in here, so we get
2312− * the desired exclusion. See mm/memory.c:do_wp_page()
2313− * for more comments.
2291+ * at this point. We do this by having them hold the
2292+ * page lock while dirtying the page, and pages are
2293+ * always locked coming in here, so we get the desired
2294+ * exclusion.
23142295 */
23152296 if (TestClearPageDirty(page)) {
23162297 dec_zone_page_state(page, NR_FILE_DIRTY);
mm/rmap.c+41−1
@@ -72,6 +72,8 @@ static inline struct anon_vma *anon_vma_alloc(void) · 71 unmodified lines
7272 anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL);
7373 if (anon_vma) {
7474 atomic_set(&anon_vma->refcount, 1);
75+ anon_vma->degree = 1; /* Reference for first vma */
76+ anon_vma->parent = anon_vma;
7577 /*
7678 * Initialise the anon_vma root to point to itself. If called
7779 * from fork, the root will be reset to the parents anon_vma.
@@ -188,6 +190,8 @@ int anon_vma_prepare(struct vm_area_struct *vma) · 110 unmodified lines
188190 if (likely(!vma->anon_vma)) {
189191 vma->anon_vma = anon_vma;
190192 anon_vma_chain_link(vma, avc, anon_vma);
193+ /* vma reference or self-parent link for new root */
194+ anon_vma->degree++;
191195 allocated = NULL;
192196 avc = NULL;
193197 }
@@ -236,6 +240,14 @@ static inline void unlock_anon_vma_root(struct anon_vma *root) · 42 unmodified lines
236240 /*
237241 * Attach the anon_vmas from src to dst.
238242 * Returns 0 on success, -ENOMEM on failure.
243+ *
244+ * If dst->anon_vma is NULL this function tries to find and reuse existing
245+ * anon_vma which has no vmas and only one child anon_vma. This prevents
246+ * degradation of anon_vma hierarchy to endless linear chain in case of
247+ * constantly forking task. On the other hand, an anon_vma with more than one
248+ * child isn't reused even if there was no alive vma, thus rmap walker has a
249+ * good chance of avoiding scanning the whole hierarchy when it searches where
250+ * page is mapped.
239251 */
240252 int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
241253 {
@@ -256,7 +268,21 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) · 14 unmodified lines
256268 anon_vma = pavc->anon_vma;
257269 root = lock_anon_vma_root(root, anon_vma);
258270 anon_vma_chain_link(dst, avc, anon_vma);
271+
272+ /*
273+ * Reuse existing anon_vma if its degree lower than two,
274+ * that means it has no vma and only one anon_vma child.
275+ *
276+ * Do not chose parent anon_vma, otherwise first child
277+ * will always reuse it. Root anon_vma is never reused:
278+ * it has self-parent reference and at least one child.
279+ */
280+ if (!dst->anon_vma && anon_vma != src->anon_vma &&
281+ anon_vma->degree < 2)
282+ dst->anon_vma = anon_vma;
259283 }
284+ if (dst->anon_vma)
285+ dst->anon_vma->degree++;
260286 unlock_anon_vma_root(root);
261287 return 0;
262288
@@ -280,6 +306,9 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) · 17 unmodified lines
280306 if (!pvma->anon_vma)
281307 return 0;
282308
309+ /* Drop inherited anon_vma, we'll reuse existing or allocate new. */
310+ vma->anon_vma = NULL;
311+
283312 /*
284313 * First, attach the new VMA to the parent VMA's anon_vmas,
285314 * so rmap can find non-COWed pages in child processes.
@@ -288,6 +317,10 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) · 2 unmodified lines
288317 if (error)
289318 return error;
290319
320+ /* An existing anon_vma has been reused, all done then. */
321+ if (vma->anon_vma)
322+ return 0;
323+
291324 /* Then add our own anon_vma. */
292325 anon_vma = anon_vma_alloc();
293326 if (!anon_vma)
@@ -301,6 +334,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) · 7 unmodified lines
301334 * lock any of the anon_vmas in this anon_vma tree.
302335 */
303336 anon_vma->root = pvma->anon_vma->root;
337+ anon_vma->parent = pvma->anon_vma;
304338 /*
305339 * With refcounts, an anon_vma can stay around longer than the
306340 * process it belongs to. The root anon_vma needs to be pinned until
@@ -311,6 +345,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) · 4 unmodified lines
311345 vma->anon_vma = anon_vma;
312346 anon_vma_lock_write(anon_vma);
313347 anon_vma_chain_link(vma, avc, anon_vma);
348+ anon_vma->parent->degree++;
314349 anon_vma_unlock_write(anon_vma);
315350
316351 return 0;
@@ -341,12 +376,16 @@ void unlink_anon_vmas(struct vm_area_struct *vma) · 24 unmodified lines
341376 * Leave empty anon_vmas on the list - we'll need
342377 * to free them outside the lock.
343378 */
344− if (RB_EMPTY_ROOT(&anon_vma->rb_root))
379+ if (RB_EMPTY_ROOT(&anon_vma->rb_root)) {
380+ anon_vma->parent->degree--;
345381 continue;
382+ }
346383
347384 list_del(&avc->same_vma);
348385 anon_vma_chain_free(avc);
349386 }
387+ if (vma->anon_vma)
388+ vma->anon_vma->degree--;
350389 unlock_anon_vma_root(root);
351390
352391 /*
@@ -357,6 +396,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma) · 4 unmodified lines
357396 list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
358397 struct anon_vma *anon_vma = avc->anon_vma;
359398
399+ BUG_ON(anon_vma->degree);
360400 put_anon_vma(anon_vma);
361401
362402 list_del(&avc->same_vma);
mm/vmscan.c+13−11
@@ -2921,18 +2921,20 @@ static bool prepare_kswapd_sleep(pg_data_t *pgdat, int order, long remaining, · 2920 unmodified lines
29212921 return false;
29222922
29232923 /*
2924− * There is a potential race between when kswapd checks its watermarks
2925− * and a process gets throttled. There is also a potential race if
2926− * processes get throttled, kswapd wakes, a large process exits therby
2927− * balancing the zones that causes kswapd to miss a wakeup. If kswapd
2928− * is going to sleep, no process should be sleeping on pfmemalloc_wait
2929− * so wake them now if necessary. If necessary, processes will wake
2930− * kswapd and get throttled again
2924+ * The throttled processes are normally woken up in balance_pgdat() as
2925+ * soon as pfmemalloc_watermark_ok() is true. But there is a potential
2926+ * race between when kswapd checks the watermarks and a process gets
2927+ * throttled. There is also a potential race if processes get
2928+ * throttled, kswapd wakes, a large process exits thereby balancing the
2929+ * zones, which causes kswapd to exit balance_pgdat() before reaching
2930+ * the wake up checks. If kswapd is going to sleep, no process should
2931+ * be sleeping on pfmemalloc_wait, so wake them now if necessary. If
2932+ * the wake up is premature, processes will wake kswapd and get
2933+ * throttled again. The difference from wake ups in balance_pgdat() is
2934+ * that here we are under prepare_to_wait().
29312935 */
2932− if (waitqueue_active(&pgdat->pfmemalloc_wait)) {
2933− wake_up(&pgdat->pfmemalloc_wait);
2934− return false;
2935− }
2936+ if (waitqueue_active(&pgdat->pfmemalloc_wait))
2937+ wake_up_all(&pgdat->pfmemalloc_wait);
29362938
29372939 return pgdat_balanced(pgdat, order, classzone_idx);
29382940 }