[PATCH] fix unused/stale swap cache handling on memcg v3

[KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>]

I'll test this one in this week end.
Maybe much simpler than previous ones. Thank you for all your help!

-Kame
==
From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>

Nishimura reported that, in racy case, swap cache is not freed even if
it will be never used. For making use of laziness of LRU, some racy pages
are not freed _interntionally_ and the kernel expects the global LRU will
reclaim it later.

When it comes to memcg, if well controlled, global LRU will not work very
often and above "ok, it's busy, reclaim it later by Global LRU" logic means
leak of swp_entry. Nishimura found that this can cause OOM.

This patch tries to fix this by calling try_to_free_swap() againt the
stale page caches.

Reported-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
---
 include/linux/swap.h |    2 ++
 mm/memcontrol.c      |   41 +++++++++++++++++++++++++++++++++++++++++
 mm/swapfile.c        |   23 ++++++++++++++++++-----
 mm/vmscan.c          |    9 +++++++++
 4 files changed, 70 insertions(+), 5 deletions(-)

Index: mmotm-2.6.29-Mar11/mm/memcontrol.c
===================================================================
--- mmotm-2.6.29-Mar11.orig/mm/memcontrol.c
+++ mmotm-2.6.29-Mar11/mm/memcontrol.c
@@ -1550,8 +1550,49 @@ void mem_cgroup_uncharge_swap(swp_entry_
 	}
 	rcu_read_unlock();
 }
+
 #endif
 
+/* For handle some racy case. */
+struct memcg_swap_validate {
+	struct work_struct work;
+	struct page *page;
+};
+
+static void mem_cgroup_validate_swapcache_cb(struct work_struct *work)
+{
+	struct memcg_swap_validate *mywork;
+	struct page *page;
+
+	mywork = container_of(work, struct memcg_swap_validate, work);
+	page = mywork->page;
+	/* We can wait lock now....validate swap is still alive or not */
+	lock_page(page);
+	try_to_free_swap(page);
+	unlock_page(page);
+	put_page(page);
+	kfree(mywork);
+	return;
+}
+
+void mem_cgroup_validate_swapcache(struct page *page)
+{
+	struct memcg_swap_validate *work;
+	/*
+	 * Unfortunately, we cannot lock this page here. So, schedule this
+	 * again later.
+	 */
+	get_page(page);
+	work = kmalloc(sizeof(*work), GFP_ATOMIC);
+	if (work) {
+		INIT_WORK(&work->work, mem_cgroup_validate_swapcache_cb);
+		work->page = page;
+		schedule_work(&work->work);
+	} else /* If this small kmalloc() fails, LRU will work and find this */
+		put_page(page);
+	return;
+}
+
 /*
  * Before starting migration, account PAGE_SIZE to mem_cgroup that the old
  * page belongs to.
Index: mmotm-2.6.29-Mar11/mm/swapfile.c
===================================================================
--- mmotm-2.6.29-Mar11.orig/mm/swapfile.c
+++ mmotm-2.6.29-Mar11/mm/swapfile.c
@@ -578,6 +578,7 @@ int free_swap_and_cache(swp_entry_t entr
 {
 	struct swap_info_struct *p;
 	struct page *page = NULL;
+	struct page *check = NULL;
 
 	if (is_migration_entry(entry))
 		return 1;
@@ -586,9 +587,11 @@ int free_swap_and_cache(swp_entry_t entr
 	if (p) {
 		if (swap_entry_free(p, entry) == 1) {
 			page = find_get_page(&swapper_space, entry.val);
-			if (page && !trylock_page(page)) {
-				page_cache_release(page);
-				page = NULL;
+			if (page) {
+				if (!trylock_page(page)) {
+					check = page;
+					page = NULL;
+				}
 			}
 		}
 		spin_unlock(&swap_lock);
@@ -602,10 +605,20 @@ int free_swap_and_cache(swp_entry_t entr
 				(!page_mapped(page) || vm_swap_full())) {
 			delete_from_swap_cache(page);
 			SetPageDirty(page);
-		}
+		} else
+			check = page;
 		unlock_page(page);
-		page_cache_release(page);
+		if (!check)
+			page_cache_release(page);
 	}
+
+	if (check) {
+		/* Check accounting of this page in lazy way.*/
+		if (PageSwapCache(check) && !page_mapped(check))
+			mem_cgroup_validate_swapcache(check);
+		page_cache_release(check);
+	}
+
 	return p != NULL;
 }
 
Index: mmotm-2.6.29-Mar11/mm/vmscan.c
===================================================================
--- mmotm-2.6.29-Mar11.orig/mm/vmscan.c
+++ mmotm-2.6.29-Mar11/mm/vmscan.c
@@ -782,6 +782,15 @@ activate_locked:
 		SetPageActive(page);
 		pgactivate++;
 keep_locked:
+		/*
+		 * This can happen under racy case between unmap and us. If
+		 * a page is added to swapcache while it's unmmaped, the page
+		 * may reach here. Check again this page(swap) is worth to be
+		 * kept.
+		 * (Is this needed to be only under memcg ?
+		 */
+		if (PageSwapCache(page) && !page_mapped(page))
+			try_to_free_swap(page);
 		unlock_page(page);
 keep:
 		list_add(&page->lru, &ret_pages);
Index: mmotm-2.6.29-Mar11/include/linux/swap.h
===================================================================
--- mmotm-2.6.29-Mar11.orig/include/linux/swap.h
+++ mmotm-2.6.29-Mar11/include/linux/swap.h
@@ -337,11 +337,13 @@ static inline void disable_swap_token(vo
 
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR
 extern void mem_cgroup_uncharge_swapcache(struct page *page, swp_entry_t ent);
+extern void mem_cgroup_validate_swapcache(struct page *page);
 #else
 static inline void
 mem_cgroup_uncharge_swapcache(struct page *page, swp_entry_t ent)
 {
 }
+static inline void mem_cgroup_validate_swapcache(struct page *page) {}
 #endif
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP
 extern void mem_cgroup_uncharge_swap(swp_entry_t ent);

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>