Rafael Aquini 009dfd4415 mm: avoid reinserting isolated balloon pages into LRU lists ... commit 117aad1e9e upstream. Isolated balloon pages can wrongly end up in LRU lists when migrate_pages() finishes its round without draining all the isolated page list. The same issue can happen when reclaim_clean_pages_from_list() tries to reclaim pages from an isolated page list, before migration, in the CMA path. Such balloon page leak opens a race window against LRU lists shrinkers that leads us to the following kernel panic: BUG: unable to handle kernel NULL pointer dereference at 0000000000000028 IP: [<ffffffff810c2625>] shrink_page_list+0x24e/0x897 PGD 3cda2067 PUD 3d713067 PMD 0 Oops: 0000 [#1] SMP CPU: 0 PID: 340 Comm: kswapd0 Not tainted 3.12.0-rc1-22626-g4367597 #87 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 RIP: shrink_page_list+0x24e/0x897 RSP: 0000:ffff88003da499b8 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88003e82bd60 RCX: 00000000000657d5 RDX: 0000000000000000 RSI: 000000000000031f RDI: ffff88003e82bd40 RBP: ffff88003da49ab0 R08: 0000000000000001 R09: 0000000081121a45 R10: ffffffff81121a45 R11: ffff88003c4a9a28 R12: ffff88003e82bd40 R13: ffff88003da0e800 R14: 0000000000000001 R15: ffff88003da49d58 FS: 0000000000000000(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000067d9000 CR3: 000000003ace5000 CR4: 00000000000407b0 Call Trace: shrink_inactive_list+0x240/0x3de shrink_lruvec+0x3e0/0x566 __shrink_zone+0x94/0x178 shrink_zone+0x3a/0x82 balance_pgdat+0x32a/0x4c2 kswapd+0x2f0/0x372 kthread+0xa2/0xaa ret_from_fork+0x7c/0xb0 Code: 80 7d 8f 01 48 83 95 68 ff ff ff 00 4c 89 e7 e8 5a 7b 00 00 48 85 c0 49 89 c5 75 08 80 7d 8f 00 74 3e eb 31 48 8b 80 18 01 00 00 <48> 8b 74 0d 48 8b 78 30 be 02 00 00 00 ff d2 eb RIP [<ffffffff810c2625>] shrink_page_list+0x24e/0x897 RSP <ffff88003da499b8> CR2: 0000000000000028 ---[ end trace 703d2451af6ffbfd ]--- Kernel panic - not syncing: Fatal exception This patch fixes the issue, by assuring the proper tests are made at putback_movable_pages() & reclaim_clean_pages_from_list() to avoid isolated balloon pages being wrongly reinserted in LRU lists. [akpm@linux-foundation.org: clarify awkward comment text] Signed-off-by: Rafael Aquini <aquini@redhat.com> Reported-by: Luiz Capitulino <lcapitulino@redhat.com> Tested-by: Luiz Capitulino <lcapitulino@redhat.com> Cc: Mel Gorman <mel@csn.ul.ie> Cc: Rik van Riel <riel@redhat.com> Cc: Hugh Dickins <hughd@google.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2013-10-13 16:08:33 -07:00
..
backing-dev.c	writeback: expose the bdi_wq workqueue	2013-04-01 19:08:06 -07:00
balloon_compaction.c	mm: introduce a common interface for balloon pages mobility	2012-12-11 17:22:26 -08:00
bootmem.c	mm: Add alloc_bootmem_low_pages_nopanic()	2013-01-29 19:32:59 -08:00
bounce.c	mm/bounce.c: fix a regression where MS_SNAP_STABLE (stable pages snapshotting) was ignored	2013-10-13 16:08:33 -07:00
cleancache.c	mm: cleancache: clean up cleancache_enabled	2013-04-30 17:04:01 -07:00
compaction.c	mm: add & use zone_end_pfn() and zone_spans_pfn()	2013-02-23 17:50:20 -08:00
debug-pagealloc.c	mm, x86: Remove debug_pagealloc_enabled	2011-12-06 09:24:07 +01:00
dmapool.c	dmapool: make DMAPOOL_DEBUG detect corruption of free marker	2012-12-11 17:22:24 -08:00
fadvise.c	teach SYSCALL_DEFINE<n> how to deal with long long/unsigned long long	2013-03-03 22:46:22 -05:00
failslab.c	switch debugfs to umode_t	2012-01-03 22:54:56 -05:00
filemap_xip.c	lift sb_start_write() out of ->write()	2013-04-09 14:12:56 -04:00
filemap.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-05-01 17:51:54 -07:00
fremap.c	Revert "mm: introduce VM_POPULATE flag to better deal with racy userspace programs"	2013-03-28 17:45:51 -07:00
frontswap.c	frontswap: fix incorrect zeroing and allocation size for frontswap_map	2013-06-12 16:29:46 -07:00
highmem.c	Some nice cleanups, and even a patch my wife did as a "live" demo for	2012-12-20 08:37:05 -08:00
huge_memory.c	mm/huge_memory.c: fix potential NULL pointer dereference	2013-09-26 17:18:28 -07:00
hugetlb_cgroup.c	mm/hugetlb: create hugetlb cgroup file in hugetlb_init	2012-12-18 15:02:15 -08:00
hugetlb.c	Fix TLB gather virtual address range invalidation corner cases	2013-08-20 08:43:05 -07:00
hwpoison-inject.c	memcg: rename config variables	2012-07-31 18:42:43 -07:00
init-mm.c	atomic: use <linux/atomic.h>	2011-07-26 16:49:47 -07:00
internal.h	mm: accelerate munlock() treatment of THP pages	2013-02-27 19:10:09 -08:00
interval_tree.c	mm: add CONFIG_DEBUG_VM_RB build option	2012-10-09 16:22:42 +09:00
Kconfig	mmKconfig: add an option to disable bounce	2013-04-29 15:54:40 -07:00
Kconfig.debug	mm: more intensive memory corruption debugging	2012-01-10 16:30:42 -08:00
kmemcheck.c
kmemleak-test.c	kmemleak: remove memset by using kzalloc	2011-01-27 18:31:51 +00:00
kmemleak.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
ksm.c	ksm: fix m68k build: only NUMA needs pfn_to_nid	2013-03-08 15:05:34 -08:00
maccess.c	mm: Map most files to use export.h instead of module.h	2011-10-31 09:20:12 -04:00
madvise.c	mm: madvise: complete input validation before taking lock	2013-04-29 15:54:37 -07:00
Makefile	memcg: add memory.pressure_level events	2013-04-29 15:54:38 -07:00
memblock.c	memblock: fix missing comment of memblock_insert_region()	2013-04-29 15:54:38 -07:00
memcontrol.c	memcg: fix multiple large threshold notifications	2013-09-26 17:18:28 -07:00
memory_hotplug.c	mm/memory_hotplug.c: fix printk format warnings	2013-05-24 16:22:52 -07:00
memory-failure.c	HWPOISON: check dirty flag to match against clean page	2013-04-29 15:54:28 -07:00
memory.c	Fix TLB gather virtual address range invalidation corner cases	2013-08-20 08:43:05 -07:00
mempolicy.c	mm: mempolicy: fix mbind_range() && vma_adjust() interaction	2013-08-04 16:51:14 +08:00
mempool.c	mempool: add @gfp_mask to mempool_create_node()	2012-06-25 11:53:47 +02:00
migrate.c	mm: avoid reinserting isolated balloon pages into LRU lists	2013-10-13 16:08:33 -07:00
mincore.c	swap: make each swap partition have one address_space	2013-02-23 17:50:17 -08:00
mlock.c	Revert "mm: introduce VM_POPULATE flag to better deal with racy userspace programs"	2013-03-28 17:45:51 -07:00
mm_init.c	mm: init: report on last-nid information stored in page->flags	2013-02-23 17:50:18 -08:00
mmap.c	Fix TLB gather virtual address range invalidation corner cases	2013-08-20 08:43:05 -07:00
mmu_context.c	mm: remove old aio use_mm() comment	2013-05-07 18:38:27 -07:00
mmu_notifier.c	mm: mmu_notifier: re-fix freed page still mapped in secondary MMU	2013-05-24 16:22:51 -07:00
mmzone.c	mm: rename page struct field helpers	2013-02-23 17:50:18 -08:00
mprotect.c	mm/mprotect.c: coding-style cleanups	2012-12-18 15:02:15 -08:00
mremap.c	mm/rmap: rename anon_vma_unlock() => anon_vma_unlock_write()	2013-02-23 17:50:17 -08:00
msync.c
nobootmem.c	mm, nobootmem: do memset() after memblock_reserve()	2013-04-29 15:54:39 -07:00
nommu.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal	2013-05-01 07:21:43 -07:00
oom_kill.c	memcg, oom: provide more precise dump info while memcg oom happening	2013-02-23 17:50:08 -08:00
page_alloc.c	mm/memory-hotplug: fix lowmem count overflow when offline pages	2013-07-21 18:21:36 -07:00
page_cgroup.c	memcontrol: use N_MEMORY instead N_HIGH_MEMORY	2012-12-12 17:38:32 -08:00
page_io.c	Merge branch 'for-3.10/core' of git://git.kernel.dk/linux-block	2013-05-08 10:13:35 -07:00
page_isolation.c	mm: fix zone_watermark_ok_safe() accounting of isolated pages	2013-01-04 16:11:46 -08:00
page-writeback.c	mm: make snapshotting pages for stable writes a per-bio operation	2013-04-29 15:54:33 -07:00
pagewalk.c	mm/pagewalk.c: walk_page_range should avoid VM_PFNMAP areas	2013-05-24 16:22:53 -07:00
percpu-km.c
percpu-vm.c	mm: fix kernel-doc warnings	2012-06-20 14:39:36 -07:00
percpu.c	mm, percpu: Make sure percpu_alloc early parameter has an argument	2012-12-02 06:23:04 -08:00
pgtable-generic.c	mm: Only flush the TLB when clearing an accessible pte	2012-12-11 14:28:34 +00:00
process_vm_access.c	Fix: compat_rw_copy_check_uvector() misuse in aio, readv, writev, and security keys	2013-03-12 11:05:45 -07:00
quicklist.c	mm: delete various needless include <linux/module.h>	2011-10-31 09:20:11 -04:00
readahead.c	teach SYSCALL_DEFINE<n> how to deal with long long/unsigned long long	2013-03-03 22:46:22 -05:00
rmap.c	rmap: recompute pgoff for unmapping huge page	2013-04-29 15:54:28 -07:00
shmem.c	aio: don't include aio.h in sched.h	2013-05-07 20:16:25 -07:00
slab_common.c	slab: prevent warnings when allocating with __GFP_NOWARN	2013-06-13 10:01:58 +03:00
slab.c	slab: fix init_lock_keys	2013-07-21 18:21:26 -07:00
slab.h	memcg: check that kmem_cache has memcg_params before accessing it	2013-09-07 22:09:58 -07:00
slob.c	mm: rename page struct field helpers	2013-02-23 17:50:18 -08:00
slub.c	Merge branch 'slab/for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux	2013-05-07 08:42:20 -07:00
sparse-vmemmap.c	sparse-vmemmap: specify vmemmap population range in bytes	2013-04-29 15:54:35 -07:00
sparse.c	mm, hotplug: avoid compiling memory hotremove functions when disabled	2013-04-29 15:54:37 -07:00
swap_state.c	swap: avoid read_swap_cache_async() race to deadlock while waiting on discard I/O completion	2013-06-12 16:29:45 -07:00
swap.c	mm: fix aio performance regression for database caused by THP	2013-10-01 09:17:48 -07:00
swapfile.c	frontswap: fix incorrect zeroing and allocation size for frontswap_map	2013-06-12 16:29:46 -07:00
truncate.c	mm: drop vmtruncate	2012-12-20 18:46:29 -05:00
util.c	swap: make each swap partition have one address_space	2013-02-23 17:50:17 -08:00
vmalloc.c	mm/vmalloc.c: add vfree comment	2013-05-07 18:38:27 -07:00
vmpressure.c	memcg: add memory.pressure_level events	2013-04-29 15:54:38 -07:00
vmscan.c	mm: avoid reinserting isolated balloon pages into LRU lists	2013-10-13 16:08:33 -07:00
vmstat.c	mm/vmstat: add note on safety of drain_zonestat	2013-04-29 15:54:38 -07:00