[PATCH] loop: Fix OOM and oops

The loop driver takes a copy of the data which it is writing.  When this
happens on the try_to_free_pages() path, loop can easily consume ALL memory
and bio_copy() will fail to allocate a page.

Loop forgets to check the bio_copy() return value and oopses.

Fix this by dropping PF_MEMALLOC and throttling to the block writeout speed.

The patch exports blk_congestion_wait() to modules for this.  This is a
needed export: several filesystems have a "try to allocate and yield if it
failed" loop and blk_congestion_wait() is a more appropriate way of
implementing the sleep in this situation.

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 85636a00c3c69b45dee1c98cad79b19f492d98c0..6c841086ed2ec3c9890abcdd03c7c84c44b503aa 100644 (file)
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -447,7 +447,22 @@ static struct bio *loop_get_buffer(struct loop_device *lo, struct bio *rbh)
                goto out_bh;
        }
 
-       bio = bio_copy(rbh, GFP_NOIO, rbh->bi_rw & WRITE);
+       /*
+        * When called on the page reclaim -> writepage path, this code can
+        * trivially consume all memory.  So we drop PF_MEMALLOC to avoid
+        * stealing all the page reserves and throttle to the writeout rate.
+        * pdflush will have been woken by page reclaim.  Let it do its work.
+        */
+       do {
+               int flags = current->flags;
+
+               current->flags &= ~PF_MEMALLOC;
+               bio = bio_copy(rbh, (GFP_ATOMIC & ~__GFP_HIGH) | __GFP_NOWARN,
+                                       rbh->bi_rw & WRITE);
+               current->flags = flags;
+               if (bio == NULL)
+                       blk_congestion_wait(WRITE, HZ/10);
+       } while (bio == NULL);
 
        bio->bi_end_io = loop_end_io_transfer;
        bio->bi_private = rbh;

diff --git a/kernel/ksyms.c b/kernel/ksyms.c
index f30934957b8268d554965ae266907561c83ba407..aff3e9298b77fb7461e28d917c7a3dbcdec142be 100644 (file)
--- a/kernel/ksyms.c
+++ b/kernel/ksyms.c
@@ -119,6 +119,7 @@ EXPORT_SYMBOL(find_vma);
 EXPORT_SYMBOL(get_unmapped_area);
 EXPORT_SYMBOL(init_mm);
 EXPORT_SYMBOL(blk_queue_bounce);
+EXPORT_SYMBOL(blk_congestion_wait);
 #ifdef CONFIG_HIGHMEM
 EXPORT_SYMBOL(kmap_high);
 EXPORT_SYMBOL(kunmap_high);