ksm: fix potential missing rmap_item for stable_node

[ Upstream commit c89a384e2551c692a9fe60d093fd7080f50afc51 ]

When removing rmap_item from stable tree, STABLE_FLAG of rmap_item is
cleared with head reserved.  So the following scenario might happen: For
ksm page with rmap_item1:

cmp_and_merge_page
  stable_node->head = &migrate_nodes;
  remove_rmap_item_from_tree, but head still equal to stable_node;
  try_to_merge_with_ksm_page failed;
  return;

For the same ksm page with rmap_item2, stable node migration succeed this
time.  The stable_node->head does not equal to migrate_nodes now.  For ksm
page with rmap_item1 again:

cmp_and_merge_page
 stable_node->head != &migrate_nodes && rmap_item->head == stable_node
 return;

We would miss the rmap_item for stable_node and might result in failed
rmap_walk_ksm().  Fix this by set rmap_item->head to NULL when rmap_item
is removed from stable tree.

Link: https://lkml.kernel.org/r/20210330140228.45635-5-linmiaohe@huawei.com
Fixes: 4146d2d673 ("ksm: make !merge_across_nodes migration safe")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

This commit is contained in:

Miaohe Lin

2021-05-04 18:37:45 -07:00

committed by

Greg Kroah-Hartman

parent dde73137ce

commit 6aeba28d12

1 changed files with 1 additions and 0 deletions

									
										1

mm/ksm.c

										View File
									
				@ -793,6 +793,7 @@ static void remove_rmap_item_from_tree(struct rmap_item *rmap_item)

						stable_node->rmap_hlist_len--;

						put_anon_vma(rmap_item->anon_vma);

						rmap_item->head = NULL;

						rmap_item->address &= PAGE_MASK;

					} else if (rmap_item->address & UNSTABLE_FLAG) {

ksm: fix potential missing rmap_item for stable_node

1 mm/ksm.c Unescape Escape View File

1

mm/ksm.c

View File