When handling shmem page fault the THP with corrupted subpage could be PMD mapped if certain conditions are satisfied. But kernel is supposed to send SIGBUS when trying to map hwpoisoned page. There are two paths which may do PMD map: fault around and regular fault. Before commit f9ce0be71d1f ("mm: Cleanup faultaround and finish_fault() codepaths") the thing was even worse in fault around path. The THP could be PMD mapped as long as the VMA fits regardless what subpage is accessed and corrupted. After this commit as long as head page is not corrupted the THP could be PMD mapped. In the regular fault path the THP could be PMD mapped as long as the corrupted page is not accessed and the VMA fits. This loophole could be fixed by iterating every subpage to check if any of them is hwpoisoned or not, but it is somewhat costly in page fault path. So introduce a new page flag called HasHWPoisoned on the first tail page. It indicates the THP has hwpoisoned subpage(s). It is set if any subpage of THP is found hwpoisoned by memory failure and after the refcount is bumped successfully, then cleared when the THP is freed or split. The soft offline path doesn't need this since soft offline handler just marks a subpage hwpoisoned when the subpage is migrated successfully. But shmem THP didn't get split then migrated at all.
Showing the changes to include/linux (1 of 5 files). Show all
Unified · Split
| @@ -171,6 +171,15 @@ enum pageflags { · 170 unmodified lines | |||
| 171 | /* Compound pages. Stored in first tail page's flags */ | 171 | /* Compound pages. Stored in first tail page's flags */ |
| 172 | PG_double_map = PG_workingset, | 172 | PG_double_map = PG_workingset, |
| 173 | 173 | ||
| 174 | #ifdef CONFIG_MEMORY_FAILURE | ||
| 175 | /* | ||
| 176 | * Compound pages. Stored in first tail page's flags. | ||
| 177 | * Indicates that at least one subpage is hwpoisoned in the | ||
| 178 | * THP. | ||
| 179 | */ | ||
| 180 | PG_has_hwpoisoned = PG_mappedtodisk, | ||
| 181 | #endif | ||
| 182 | |||
| 174 | /* non-lru isolated movable page */ | 183 | /* non-lru isolated movable page */ |
| 175 | PG_isolated = PG_reclaim, | 184 | PG_isolated = PG_reclaim, |
| 176 | 185 | ||
| @@ -668,6 +677,20 @@ PAGEFLAG_FALSE(DoubleMap) · 491 unmodified lines | |||
| 668 | TESTSCFLAG_FALSE(DoubleMap) | 677 | TESTSCFLAG_FALSE(DoubleMap) |
| 669 | #endif | 678 | #endif |
| 670 | 679 | ||
| 680 | #if defined(CONFIG_MEMORY_FAILURE) && defined(CONFIG_TRANSPARENT_HUGEPAGE) | ||
| 681 | /* | ||
| 682 | * PageHasHWPoisoned indicates that at least one subpage is hwpoisoned in the | ||
| 683 | * compound page. | ||
| 684 | * | ||
| 685 | * This flag is set by hwpoison handler. Cleared by THP split or free page. | ||
| 686 | */ | ||
| 687 | PAGEFLAG(HasHWPoisoned, has_hwpoisoned, PF_SECOND) | ||
| 688 | TESTSCFLAG(HasHWPoisoned, has_hwpoisoned, PF_SECOND) | ||
| 689 | #else | ||
| 690 | PAGEFLAG_FALSE(HasHWPoisoned) | ||
| 691 | TESTSCFLAG_FALSE(HasHWPoisoned) | ||
| 692 | #endif | ||
| 693 | |||
| 671 | /* | 694 | /* |
| 672 | * Check if a page is currently marked HWPoisoned. Note that this check is | 695 | * Check if a page is currently marked HWPoisoned. Note that this check is |
| 673 | * best effort only and inherently racy: there is no way to synchronize with | 696 | * best effort only and inherently racy: there is no way to synchronize with |