Merge remote-tracking branch 'stable/linux-5.15.y' into rpi-5.15.y

[platform/kernel/linux-rpi.git] / mm / zsmalloc.c

diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 68e8831..439deb8 100644 (file)
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -1743,11 +1743,40 @@ static enum fullness_group putback_zspage(struct size_class *class,
  */
 static void lock_zspage(struct zspage *zspage)
 {
-       struct page *page = get_first_page(zspage);
+       struct page *curr_page, *page;
 
-       do {
-               lock_page(page);
-       } while ((page = get_next_page(page)) != NULL);
+       /*
+        * Pages we haven't locked yet can be migrated off the list while we're
+        * trying to lock them, so we need to be careful and only attempt to
+        * lock each page under migrate_read_lock(). Otherwise, the page we lock
+        * may no longer belong to the zspage. This means that we may wait for
+        * the wrong page to unlock, so we must take a reference to the page
+        * prior to waiting for it to unlock outside migrate_read_lock().
+        */
+       while (1) {
+               migrate_read_lock(zspage);
+               page = get_first_page(zspage);
+               if (trylock_page(page))
+                       break;
+               get_page(page);
+               migrate_read_unlock(zspage);
+               wait_on_page_locked(page);
+               put_page(page);
+       }
+
+       curr_page = page;
+       while ((page = get_next_page(curr_page))) {
+               if (trylock_page(page)) {
+                       curr_page = page;
+               } else {
+                       get_page(page);
+                       migrate_read_unlock(zspage);
+                       wait_on_page_locked(page);
+                       put_page(page);
+                       migrate_read_lock(zspage);
+               }
+       }
+       migrate_read_unlock(zspage);
 }
 
 static int zs_init_fs_context(struct fs_context *fc)
@@ -1830,10 +1859,11 @@ static inline void zs_pool_dec_isolated(struct zs_pool *pool)
        VM_BUG_ON(atomic_long_read(&pool->isolated_pages) <= 0);
        atomic_long_dec(&pool->isolated_pages);
        /*
-        * There's no possibility of racing, since wait_for_isolated_drain()
-        * checks the isolated count under &class->lock after enqueuing
-        * on migration_wait.
+        * Checking pool->destroying must happen after atomic_long_dec()
+        * for pool->isolated_pages above. Paired with the smp_mb() in
+        * zs_unregister_migration().
         */
+       smp_mb__after_atomic();
        if (atomic_long_read(&pool->isolated_pages) == 0 && pool->destroying)
                wake_up_all(&pool->migration_wait);
 }