]> www.infradead.org Git - users/dwmw2/linux.git/commit
mm/mglru: fix div-by-zero in vmpressure_calc_level()
authorYu Zhao <yuzhao@google.com>
Thu, 11 Jul 2024 19:19:56 +0000 (13:19 -0600)
committerAndrew Morton <akpm@linux-foundation.org>
Thu, 18 Jul 2024 04:05:18 +0000 (21:05 -0700)
commit8b671fe1a879923ecfb72dda6caf01460dd885ef
tree6f25ff50591df68a2d2df6864e06d9eeef9e6259
parent0b84780134fb02525ef29ddcb88c3d560ba88a9c
mm/mglru: fix div-by-zero in vmpressure_calc_level()

evict_folios() uses a second pass to reclaim folios that have gone through
page writeback and become clean before it finishes the first pass, since
folio_rotate_reclaimable() cannot handle those folios due to the
isolation.

The second pass tries to avoid potential double counting by deducting
scan_control->nr_scanned.  However, this can result in underflow of
nr_scanned, under a condition where shrink_folio_list() does not increment
nr_scanned, i.e., when folio_trylock() fails.

The underflow can cause the divisor, i.e., scale=scanned+reclaimed in
vmpressure_calc_level(), to become zero, resulting in the following crash:

  [exception RIP: vmpressure_work_fn+101]
  process_one_work at ffffffffa3313f2b

Since scan_control->nr_scanned has no established semantics, the potential
double counting has minimal risks.  Therefore, fix the problem by not
deducting scan_control->nr_scanned in evict_folios().

Link: https://lkml.kernel.org/r/20240711191957.939105-1-yuzhao@google.com
Fixes: 359a5e1416ca ("mm: multi-gen LRU: retry folios written back while isolated")
Reported-by: Wei Xu <weixugc@google.com>
Signed-off-by: Yu Zhao <yuzhao@google.com>
Cc: Alexander Motin <mav@ixsystems.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
mm/vmscan.c