Re: [BUG] memcg: panic when rmdir()

[KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>]

On Fri, 16 Jan 2009 17:26:51 +0900
Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp> wrote:

> On Fri, 16 Jan 2009 17:07:24 +0900, KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> wrote:
> > From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
> > 
> > Now, at swapoff, even while try_charge() fails, commit is executed.
> > This is bug and make refcnt of cgroup_subsys_state minus, finally.
> > 
> Nice catch!
> 
> I think this bug can explain this problem I've seen.
> Commiting on trycharge failure will add the pc to the lru
> without a corresponding charge and refcnt.
> And rmdir uncharges the pc(so we get WARNING: at kernel/res_counter.c:71)
> and decrements the refcnt(so we get BUG at kernel/cgroup.c:2517).
> 
> Even if the problem cannot be fixed by this patch, this patch is valid and needed.
> 
> > Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
> Reviewed-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
> 
> I'll test it.
> 
> 
I finally get how-to-reprocuce and confirmed this fixes the problem.

How-to-reproduce.

In shell-A
  #mount -t cgroup none /opt/cgroup
  #mkdir /opt/cgroup/xxx/
  #echo 0 > /opt/cgroup/xxx/tasks
  #Run malloc 100M on this and sleep. ---(*)

In shell-B.
  #echo 40M > /opt/cgroup/xxx/memory.limit_in_bytes.
  Then, you'll see 60M of swap.
  #/sbin/swapoff -a 
  Then, you'll see OOM-Kill against (*)
  #echo shell-A > /opt/cgroup/tasks
  make /opt/cgroup/xxx/ empty
  #rmdir /opt/cgroup/xxx

=> panics.

I'll add this swap-off test to memcg-debug.txt later.

BTW, OOM against (*) itself seems also probelmatic.
But simply disable oom-at-swapoff cannot be a workaround...


-Kame

















> Thanks,
> Daisuke Nishimura.
> 
> > ---
> > Index: mmotm-2.6.29-Jan14/mm/swapfile.c
> > ===================================================================
> > --- mmotm-2.6.29-Jan14.orig/mm/swapfile.c
> > +++ mmotm-2.6.29-Jan14/mm/swapfile.c
> > @@ -698,8 +698,10 @@ static int unuse_pte(struct vm_area_stru
> >  	pte_t *pte;
> >  	int ret = 1;
> >  
> > -	if (mem_cgroup_try_charge_swapin(vma->vm_mm, page, GFP_KERNEL, &ptr))
> > +	if (mem_cgroup_try_charge_swapin(vma->vm_mm, page, GFP_KERNEL, &ptr)) {
> >  		ret = -ENOMEM;
> > +		goto out_nolock;
> > +	}
> >  
> >  	pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
> >  	if (unlikely(!pte_same(*pte, swp_entry_to_pte(entry)))) {
> > @@ -723,6 +725,7 @@ static int unuse_pte(struct vm_area_stru
> >  	activate_page(page);
> >  out:
> >  	pte_unmap_unlock(pte, ptl);
> > +out_nolock:
> >  	return ret;
> >  }
> >  
> 

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>