SHM_UNLOCK: fix Unevictable pages stranded after swap

Commit cc39c6a9bbde ("mm: account skipped entries to avoid looping in
find_get_pages") correctly fixed an infinite loop; but left a problem
that find_get_pages() on shmem would return 0 (appearing to callers to
mean end of tree) when it meets a run of nr_pages swap entries.

The only uses of find_get_pages() on shmem are via pagevec_lookup(),
called from invalidate_mapping_pages(), and from shmctl SHM_UNLOCK's
scan_mapping_unevictable_pages().  The first is already commented, and
not worth worrying about; but the second can leave pages on the
Unevictable list after an unusual sequence of swapping and locking.

Fix that by using shmem_find_get_pages_and_swap() (then ignoring the
swap) instead of pagevec_lookup().

But I don't want to contaminate vmscan.c with shmem internals, nor
shmem.c with LRU locking.  So move scan_mapping_unevictable_pages() into
shmem.c, renaming it shmem_unlock_mapping(); and rename
check_move_unevictable_page() to check_move_unevictable_pages(), looping
down an array of pages, oftentimes under the same lock.

Leave out the "rotate unevictable list" block: that's a leftover from
when this was used for /proc/sys/vm/scan_unevictable_pages, whose flawed
handling involved looking at pages at tail of LRU.

Was there significance to the sequence first ClearPageUnevictable, then
test page_evictable, then SetPageUnevictable here? I think not, we're
under LRU lock, and have no barriers between those.

Signed-off-by: Hugh Dickins <hughd@google.com>
Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Minchan Kim <minchan.kim@gmail.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Shaohua Li <shaohua.li@intel.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michel Lespinasse <walken@google.com>
Cc: <stable@vger.kernel.org> [back to 3.1 but will need respins]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 41 insertions, 5 deletions

diff --git a/mm/shmem.c b/mm/shmem.c
index 4aaa53abe302..269d049294ab 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -379,7 +379,7 @@ static int shmem_free_swap(struct address_space *mapping,
 /*
  * Pagevec may contain swap entries, so shuffle up pages before releasing.
  */
-static void shmem_pagevec_release(struct pagevec *pvec)
+static void shmem_deswap_pagevec(struct pagevec *pvec)
 {
         int i, j;
 
@@ -389,7 +389,36 @@ static void shmem_pagevec_release(struct pagevec *pvec)
                         pvec->pages[j++] = page;
         }
         pvec->nr = j;
-        pagevec_release(pvec);
+}
+
+/*
+ * SysV IPC SHM_UNLOCK restore Unevictable pages to their evictable lists.
+ */
+void shmem_unlock_mapping(struct address_space *mapping)
+{
+        struct pagevec pvec;
+        pgoff_t indices[PAGEVEC_SIZE];
+        pgoff_t index = 0;
+
+        pagevec_init(&pvec, 0);
+        /*
+         * Minor point, but we might as well stop if someone else SHM_LOCKs it.
+         */
+        while (!mapping_unevictable(mapping)) {
+                /*
+                 * Avoid pagevec_lookup(): find_get_pages() returns 0 as if it
+                 * has finished, if it hits a row of PAGEVEC_SIZE swap entries.
+                 */
+                pvec.nr = shmem_find_get_pages_and_swap(mapping, index,
+                                        PAGEVEC_SIZE, pvec.pages, indices);
+                if (!pvec.nr)
+                        break;
+                index = indices[pvec.nr - 1] + 1;
+                shmem_deswap_pagevec(&pvec);
+                check_move_unevictable_pages(pvec.pages, pvec.nr);
+                pagevec_release(&pvec);
+                cond_resched();
+        }
 }
 
 /*
@@ -440,7 +469,8 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
                         }
                         unlock_page(page);
                 }
-                shmem_pagevec_release(&pvec);
+                shmem_deswap_pagevec(&pvec);
+                pagevec_release(&pvec);
                 mem_cgroup_uncharge_end();
                 cond_resched();
                 index++;
@@ -470,7 +500,8 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
                         continue;
                 }
                 if (index == start && indices[0] > end) {
-                        shmem_pagevec_release(&pvec);
+                        shmem_deswap_pagevec(&pvec);
+                        pagevec_release(&pvec);
                         break;
                 }
                 mem_cgroup_uncharge_start();
@@ -494,7 +525,8 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
                         }
                         unlock_page(page);
                 }
-                shmem_pagevec_release(&pvec);
+                shmem_deswap_pagevec(&pvec);
+                pagevec_release(&pvec);
                 mem_cgroup_uncharge_end();
                 index++;
         }
@@ -2438,6 +2470,10 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)
         return 0;
 }
 
+void shmem_unlock_mapping(struct address_space *mapping)
+{
+}
+
 void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
 {
         truncate_inode_pages_range(inode->i_mapping, lstart, lend);