[3.8.y.z extended stable] Patch "hwpoison, hugetlb: lock_page/unlock_page does not match for handling a free hugepage" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    hwpoison, hugetlb: lock_page/unlock_page does not match for handling a free hugepage

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

This patch is scheduled to be released in version 3.8.13.25.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From ac2e27cc697a1cc2bc23e1957931d3076b361c43 Mon Sep 17 00:00:00 2001
From: Chen Yucong <slaoub at gmail.com>
Date: Thu, 22 May 2014 11:54:15 -0700
Subject: [PATCH 40/66] hwpoison, hugetlb: lock_page/unlock_page does not match
 for handling a free hugepage

commit b985194c8c0a130ed155b71662e39f7eaea4876f upstream.

For handling a free hugepage in memory failure, the race will happen if
another thread hwpoisoned this hugepage concurrently.  So we need to
check PageHWPoison instead of !PageHWPoison.

If hwpoison_filter(p) returns true or a race happens, then we need to
unlock_page(hpage).

Signed-off-by: Chen Yucong <slaoub at gmail.com>
Reviewed-by: Naoya Horiguchi <n-horiguchi at ah.jp.nec.com>
Tested-by: Naoya Horiguchi <n-horiguchi at ah.jp.nec.com>
Reviewed-by: Andi Kleen <ak at linux.intel.com>
Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
[ kamal: backport to 3.8-stable: no renamed mce_bad_pages ]
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 mm/memory-failure.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index c6e4dd3..12b57b7 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1063,15 +1063,16 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
 			return 0;
 		} else if (PageHuge(hpage)) {
 			/*
-			 * Check "just unpoisoned", "filter hit", and
-			 * "race with other subpage."
+			 * Check "filter hit" and "race with other subpage."
 			 */
 			lock_page(hpage);
-			if (!PageHWPoison(hpage)
-			    || (hwpoison_filter(p) && TestClearPageHWPoison(p))
-			    || (p != hpage && TestSetPageHWPoison(hpage))) {
-				atomic_long_sub(nr_pages, &mce_bad_pages);
-				return 0;
+			if (PageHWPoison(hpage)) {
+				if ((hwpoison_filter(p) && TestClearPageHWPoison(p))
+				    || (p != hpage && TestSetPageHWPoison(hpage))) {
+					atomic_long_sub(nr_pages, &mce_bad_pages);
+					unlock_page(hpage);
+					return 0;
+				}
 			}
 			set_page_hwpoison_huge_page(hpage);
 			res = dequeue_hwpoisoned_huge_page(hpage);
--
1.9.1