mm, hwpoison: skip raw hwpoison page in freeing 1GB hugepage

Currently if memory_failure() (modified to remove blocking code) is called
on a page in some 1GB hugepage, memory error handling returns failure and
the raw error page gets into undesirable state.  The impact is small in
production systems (just leaked single 4kB page), but this limits the test
efficiency because unpoison doesn't work for it.  So we can no longer
create 1GB hugepage on the 1GB physical address range with such hwpoison
pages, that could be an issue in testing on small systems.

When a hwpoison page in a 1GB hugepage is handled, it's caught by the
PageHWPoison check in free_pages_prepare() because the hugepage is broken
down into raw error page and order is 0:

        if (unlikely(PageHWPoison(page)) && !order) {
                ...
                return false;
        }

Then, the page is not sent to buddy and the page refcount is left 0.

Originally this check is supposed to work when the error page is freed
from page_handle_poison() (that is called from soft-offline), but now we
are opening another path to call it, so the callers of
__page_handle_poison() need to handle the case by considering the return
value 0 as success.  Then page refcount for hwpoison is properly
incremented and now unpoison works.

Link: https://lkml.kernel.org/r/20220602050631.771414-5-naoya.horiguchi@linux.dev
Signed-off-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Liu Shixin <liushixin2@huawei.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Muchun Song <songmuchun@bytedance.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Yang Shi <shy828301@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 08cc757e76ef0bfc901ba727f71de2702339f30b..3cae7a81a878b24e2663668b963787eef1b9755f 100644 (file)
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1046,7 +1046,6 @@ static int me_huge_page(struct page_state *ps, struct page *p)
                res = truncate_error_page(hpage, page_to_pfn(p), mapping);
                unlock_page(hpage);
        } else {
-               res = MF_FAILED;
                unlock_page(hpage);
                /*
                 * migration entry prevents later access on error hugepage,
@@ -1054,9 +1053,11 @@ static int me_huge_page(struct page_state *ps, struct page *p)
                 * subpages.
                 */
                put_page(hpage);
-               if (__page_handle_poison(p) > 0) {
+               if (__page_handle_poison(p) >= 0) {
                        page_ref_inc(p);
                        res = MF_RECOVERED;
+               } else {
+                       res = MF_FAILED;
                }
        }
 
@@ -1604,9 +1605,11 @@ retry:
         */
        if (res == 0) {
                unlock_page(head);
-               if (__page_handle_poison(p) > 0) {
+               if (__page_handle_poison(p) >= 0) {
                        page_ref_inc(p);
                        res = MF_RECOVERED;
+               } else {
+                       res = MF_FAILED;
                }
                action_result(pfn, MF_MSG_FREE_HUGE, res);
                return res == MF_RECOVERED ? 0 : -EBUSY;