Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

ksm: fix bad user data when swapping

Building under memory pressure, with KSM on 2.6.36-rc5, collapsed with
an internal compiler error: typically indicating an error in swapping.

Perhaps there's a timing issue which makes it now more likely, perhaps
it's just a long time since I tried for so long: this bug goes back to
KSM swapping in 2.6.33.

Notice how reuse_swap_page() allows an exclusive page to be reused, but
only does SetPageDirty if it can delete it from swap cache right then -
if it's currently under Writeback, it has to be left in cache and we
don't SetPageDirty, but the page can be reused. Fine, the dirty bit
will get set in the pte; but notice how zap_pte_range() does not bother
to transfer pte_dirty to page_dirty when unmapping a PageAnon.

If KSM chooses to share such a page, it will look like a clean copy of
swapcache, and not be written out to swap when its memory is needed;
then stale data read back from swap when it's needed again.

We could fix this in reuse_swap_page() (or even refuse to reuse a
page under writeback), but it's more honest to fix my oversight in
KSM's write_protect_page(). Several days of testing on three machines
confirms that this fixes the issue they showed.

Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Hugh Dickins and committed by
Linus Torvalds
4e31635c 4829b906

+4 -2
+4 -2
mm/ksm.c
··· 712 712 if (!ptep) 713 713 goto out; 714 714 715 - if (pte_write(*ptep)) { 715 + if (pte_write(*ptep) || pte_dirty(*ptep)) { 716 716 pte_t entry; 717 717 718 718 swapped = PageSwapCache(page); ··· 735 735 set_pte_at(mm, addr, ptep, entry); 736 736 goto out_unlock; 737 737 } 738 - entry = pte_wrprotect(entry); 738 + if (pte_dirty(entry)) 739 + set_page_dirty(page); 740 + entry = pte_mkclean(pte_wrprotect(entry)); 739 741 set_pte_at_notify(mm, addr, ptep, entry); 740 742 } 741 743 *orig_pte = *ptep;