On Tue 28-11-17 08:19:41, Shakeel Butt wrote:

The commit d6810d730022 ("memcg, THP, swap: make mem_cgroup_swapout() support THP") changed mem_cgroup_swapout() to support transparent huge page (THP). However the patch missed one location which should be changed for correctly handling THPs. The resulting bug will cause the memory cgroups whose THPs were swapped out to become zombies on deletion.

Very well spotted! Have you seen this triggering or you found it by the code inspection?

Fixes: d6810d730022 ("memcg, THP, swap: make mem_cgroup_swapout() support THP")

To be honest I am not really happy how the whole THP swapout thing has been rushed in without a proper review. I am partly guildy for not find time for the proper review but this is not something that really had to be merged without a single ack or reviewed-by.

Signed-off-by: Shakeel Butt shakeelb@google.com Cc: stable@vger.kernel.org

Acked-by: Michal Hocko mhocko@suse.com

Thanks!

---

mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 50e6906314f8..ac2ffd5e02b9 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -6044,7 +6044,7 @@ void mem_cgroup_swapout(struct page *page, swp_entry_t entry) memcg_check_events(memcg, page); if (!mem_cgroup_is_root(memcg))

• css_put(&memcg->css);
  

• css_put_many(&memcg->css, nr_entries);
  

} /** -- 2.15.0.417.g466bffb3ac-goog

Shakeel Butt shakeelb@google.com writes:

The commit d6810d730022 ("memcg, THP, swap: make mem_cgroup_swapout() support THP") changed mem_cgroup_swapout() to support transparent huge page (THP). However the patch missed one location which should be changed for correctly handling THPs. The resulting bug will cause the memory cgroups whose THPs were swapped out to become zombies on deletion.

Good catch! Thanks a lot for fixing!

Best Regards, Huang, Ying

Fixes: d6810d730022 ("memcg, THP, swap: make mem_cgroup_swapout() support THP") Signed-off-by: Shakeel Butt shakeelb@google.com Cc: stable@vger.kernel.org

---

mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 50e6906314f8..ac2ffd5e02b9 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -6044,7 +6044,7 @@ void mem_cgroup_swapout(struct page *page, swp_entry_t entry) memcg_check_events(memcg, page); if (!mem_cgroup_is_root(memcg))

• css_put(&memcg->css);
  

• css_put_many(&memcg->css, nr_entries);
  

} /**