From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59A28EB64DC for ; Sat, 8 Jul 2023 08:57:45 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id BD7D48D0005; Sat, 8 Jul 2023 04:57:38 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 9D5AD8D0006; Sat, 8 Jul 2023 04:57:38 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 78A918D0005; Sat, 8 Jul 2023 04:57:38 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 5BDA58D0002 for ; Sat, 8 Jul 2023 04:57:38 -0400 (EDT) Received: from smtpin27.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 36EAF16013C for ; Sat, 8 Jul 2023 08:57:38 +0000 (UTC) X-FDA: 80987841396.27.E1B4B87 Received: from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255]) by imf03.hostedemail.com (Postfix) with ESMTP id E5A8D2000B for ; Sat, 8 Jul 2023 08:57:35 +0000 (UTC) Authentication-Results: imf03.hostedemail.com; dkim=none; dmarc=pass (policy=quarantine) header.from=huawei.com; spf=pass (imf03.hostedemail.com: domain of linmiaohe@huawei.com designates 45.249.212.255 as permitted sender) smtp.mailfrom=linmiaohe@huawei.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1688806656; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Qv7v0MakVggbJJx0U+5+eQj6+hfyeFZeeQvIWRA1lsE=; b=tS2jFwnCCIPhfwyVqilaqclMNK2ST5+rDJT7ZilPDeBHoVoGgFdxcksMETYIXnR/Ng2Ppj JgHvMDbAISJJ1ORijTVDtBqeSJ8GUgLxtM6QN0iOtHO9PO9hBgljxGMVqDRNJaCJVvcayE y7oIjTm4XpGGZwhi3iSapyk4VlI0TsQ= ARC-Authentication-Results: i=1; imf03.hostedemail.com; dkim=none; dmarc=pass (policy=quarantine) header.from=huawei.com; spf=pass (imf03.hostedemail.com: domain of linmiaohe@huawei.com designates 45.249.212.255 as permitted sender) smtp.mailfrom=linmiaohe@huawei.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1688806656; a=rsa-sha256; cv=none; b=TT3wDWXeZbTm89wT+nlrbsqa7DEQM47QNEh8TCyE1wU2cGuh2FiCV37i2Tlce/PctI18tV 0pDCFRBmigOcLI+f4mw2etAusXE6kci5CjARugX2xcikCDhfs2ca9/0ILuKaz5XKd9EwSh 8jg4z57uIH/YOtIT/sFvsuNgkWChd1k= Received: from canpemm500002.china.huawei.com (unknown [172.30.72.57]) by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4QykfQ5qvgz1FDgw; Sat, 8 Jul 2023 16:57:02 +0800 (CST) Received: from huawei.com (10.174.151.185) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Sat, 8 Jul 2023 16:57:31 +0800 From: Miaohe Lin To: , CC: , , Subject: [PATCH 8/8] mm: memory-failure: fix race window when trying to get hugetlb folio Date: Sat, 8 Jul 2023 16:57:44 +0800 Message-ID: <20230708085744.3599311-9-linmiaohe@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20230708085744.3599311-1-linmiaohe@huawei.com> References: <20230708085744.3599311-1-linmiaohe@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Originating-IP: [10.174.151.185] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To canpemm500002.china.huawei.com (7.192.104.244) X-CFilter-Loop: Reflected X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: E5A8D2000B X-Stat-Signature: r9ho5d8sazk5jpkjak8uw7696fdoik6r X-Rspam-User: X-HE-Tag: 1688806655-639610 X-HE-Meta: U2FsdGVkX1+jfjBcUvlwRwHJaIsfi9qaqC96Z3mDBVC3uSMGoMDCBzq26PLYbf3a8lNziOkmJSy7MNS1nwkZ+XUoZ//1HMTjiWFv1P+Uj6E6ubPnU1ASGe7dp1L9wqBll4KUPO/WbkG0WCH2rSNnXPTlQdrbGYDulkYJyLKIpQhYLthUPemlZJmwGJ/S9VqM2DFa82uQ6itagD1T2SlYOHXs0r6nK+lcpHS93mkYLoO622DP9+3dNZ4HuV8xA0Gu8W3l284pm6LsbA5tsv418Gs2CsV3O8XcC4C3Z2okDeMqSui6paKcHssxLL2tL3HDFdb3tQPslhVU3aYAqU5PnvENCR83mcng1JHuKj4P3jwreMFSPE4UVK5e+BWbhvE9nYizVu6QwVAfwFLOkbC2PuJNWoSde45FjQeWyAP/zZCQW3eZufoe6cfvqTxL7ub8QDoiuDRb8QXntuWZ0CuZsTXp1ggtU6tABELbZy646c1LCblOHK4QihAcjZn5Lk3A/W4VtN77UXLDwUX73UfoI5KQAz6h1aluxAwRBvjZL/+vKZBL4XS2Y/kmcsCpZc1IAaNPi1eKUkGT48lCF+vFVkxEaklE6/WrP/6pc6II9Jw8iC2ppKqBA7jRg21BwM5Mqjv5xO5CUGLZhAlbBEx1Xe4b7mz8Md7WNdSe1tw10GSKB3h6Am6POzHB8Ifs5WmimKD0OfEPSICMOWTDfAV0p8k8ti6KTgtWPS+EZxqkUQYqgv8WF/etNJYzPwh9z3MRnWLpdN8AiPvbeKCmbP5BFyEk+pQn0bdD8Utq0soPD+K9m1BQCSFlW/wP2mBNY5XpSH7Tfzw8WsycojxHl4eIxt/YdlIroxdMk7xa4CHfDIF+qYouO14jQNFgUyd/b72UNaucGHAK/Ar5G4tEa4BN8b4gvJURXIEWGsD06vbY7FzqoSUgDRfvrGutpCKSXnt4RIQ3RX+siJ9CFDnClkh h5C2s18L TNB3DFiWThZFAbaxy2odQ+GyfR9Nxpyedk4AvbNrwX50nvhAqtzu5oJ+s1lzBlE988jyg4nCsOfOvq20CVrnBywZZux6H65ECUejVbTW1N4OXMXuOnKBaiCiEp0PQCdtITqE7EzNWQBkIkKg= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: page_folio() is fetched before calling get_hwpoison_hugetlb_folio() without hugetlb_lock being held. So hugetlb page could be demoted before get_hwpoison_hugetlb_folio() holding hugetlb_lock but after page_folio() is fetched. So get_hwpoison_hugetlb_folio() will hold unexpected extra refcnt of hugetlb folio while leaving demoted page un-refcnted. Fixes: 25182f05ffed ("mm,hwpoison: fix race with hugetlb page allocation") Signed-off-by: Miaohe Lin --- mm/memory-failure.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 76d88d27cdbe..066bf57f2d22 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1388,8 +1388,14 @@ static int __get_hwpoison_page(struct page *page, unsigned long flags) bool hugetlb = false; ret = get_hwpoison_hugetlb_folio(folio, &hugetlb, false); - if (hugetlb) - return ret; + if (hugetlb) { + if (folio == page_folio(page)) + return ret; + if (ret > 0) { + folio_put(folio); + folio = page_folio(page); + } + } /* * This check prevents from calling folio_try_get() for any @@ -1478,8 +1484,12 @@ static int __get_unpoison_page(struct page *page) bool hugetlb = false; ret = get_hwpoison_hugetlb_folio(folio, &hugetlb, true); - if (hugetlb) - return ret; + if (hugetlb) { + if (folio == page_folio(page)) + return ret; + if (ret > 0) + folio_put(folio); + } /* * PageHWPoisonTakenOff pages are not only marked as PG_hwpoison, -- 2.33.0