diff options
| author | Konstantin Khlebnikov <khlebnikov@yandex-team.ru> | 2016-04-29 01:19:03 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2016-04-29 04:34:04 +0200 |
| commit | c2e7e00b715d3c65f301bec8559d6af4ef8098ab (patch) | |
| tree | e89161188d2a485e428e9aa61690517418f75952 /mm | |
| parent | ocfs2/dlm: return zero if deref_done message is successfully handled (diff) | |
| download | linux-c2e7e00b715d3c65f301bec8559d6af4ef8098ab.tar.xz linux-c2e7e00b715d3c65f301bec8559d6af4ef8098ab.zip | |
mm/memory-failure: fix race with compound page split/merge
get_hwpoison_page() must recheck relation between head and tail pages.
n-horiguchi said: without this recheck, the race causes kernel to pin an
irrelevant page, and finally makes kernel crash for refcount mismatch.
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Acked-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'mm')
| -rw-r--r-- | mm/memory-failure.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 78f5f2641b91..ca5acee53b7a 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -888,7 +888,15 @@ int get_hwpoison_page(struct page *page) } } - return get_page_unless_zero(head); + if (get_page_unless_zero(head)) { + if (head == compound_head(page)) + return 1; + + pr_info("MCE: %#lx cannot catch tail\n", page_to_pfn(page)); + put_page(head); + } + + return 0; } EXPORT_SYMBOL_GPL(get_hwpoison_page); |