mm/migration: fix page corruption during hugepage migration

If migrate_huge_page by memory-failure fails , it calls put_page in itself to decrease page reference and caller of migrate_huge_page also calls putback_lru_pages. It can do double free of page so it can make page corruption on page holder. In addtion, clean of pages on caller is consistent behavior with migrate_pages by cf608ac ("mm: compaction: fix COMPACTPAGEFAILED counting"). Signed-off-by: Minchan Kim <[email protected]> Cc: Andrea Arcangeli <[email protected]> Cc: Christoph Lameter <[email protected]> Cc: Mel Gorman <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
mgowda · Feb 3, 2011 · 48db54e · 48db54e
1 parent 57fc4a5
commit 48db54e
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 5 deletions.
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
@@ -1295,7 +1295,10 @@ static int soft_offline_huge_page(struct page *page, int flags)
 	ret = migrate_huge_pages(&pagelist, new_page, MPOL_MF_MOVE_ALL, 0,
 				true);
 	if (ret) {
-		putback_lru_pages(&pagelist);
+		struct page *page1, *page2;
+		list_for_each_entry_safe(page1, page2, &pagelist, lru)
+			put_page(page1);
+
 		pr_debug("soft offline: %#lx: migration failed %d, type %lx\n",
 			 pfn, ret, page->flags);
 		if (ret > 0)

diff --git a/mm/migrate.c b/mm/migrate.c
@@ -980,10 +980,6 @@ int migrate_huge_pages(struct list_head *from,
 	}
 	rc = 0;
 out:
-
-	list_for_each_entry_safe(page, page2, from, lru)
-		put_page(page);
-
 	if (rc)
 		return rc;
-Original file line number
+Diff line change
@@ Expand Up / @@ -980,10 +980,6 @@ int migrate_huge_pages(struct list_head *from, @@
     	}
     	rc = 0;
     out:
-    	list_for_each_entry_safe(page, page2, from, lru)
-    		put_page(page);
     	if (rc)
     		return rc;
@@ Expand Down @@