From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932843Ab2DSVH7 (ORCPT ); Thu, 19 Apr 2012 17:07:59 -0400 Received: from mail-pb0-f46.google.com ([209.85.160.46]:41537 "EHLO mail-pb0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932812Ab2DSVH5 (ORCPT ); Thu, 19 Apr 2012 17:07:57 -0400 Message-Id: <20120419210307.980343726@linuxfoundation.org> User-Agent: quilt/0.60-19.1 Date: Thu, 19 Apr 2012 14:04:00 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Hugh Dickins Subject: [ 57/75] memcg: fix Bad page state after replace_page_cache In-Reply-To: <20120419210322.GA6478@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Hugh Dickins commit 9b7f43afd417a6feb80841d30ced4051c362eb5d upstream. My 9ce70c0240d0 "memcg: fix deadlock by inverting lrucare nesting" put a nasty little bug into v3.3's version of mem_cgroup_replace_page_cache(), sometimes used for FUSE. Replacing __mem_cgroup_commit_charge_lrucare() by __mem_cgroup_commit_charge(), I used the "pc" pointer set up earlier: but it's for oldpage, and needs now to be for newpage. Once oldpage was freed, its PageCgroupUsed bit (cleared above but set again here) caused "Bad page state" messages - and perhaps worse, being missed from newpage. (I didn't find this by using FUSE, but in reusing the function for tmpfs.) Signed-off-by: Hugh Dickins Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/memcontrol.c | 1 + 1 file changed, 1 insertion(+) --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -3350,6 +3350,7 @@ void mem_cgroup_replace_page_cache(struc * the newpage may be on LRU(or pagevec for LRU) already. We lock * LRU while we overwrite pc->mem_cgroup. */ + pc = lookup_page_cgroup(newpage); __mem_cgroup_commit_charge(memcg, newpage, 1, pc, type, true); }