Patch "mm: fix page reference leak in soft_offline_page()" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    mm: fix page reference leak in soft_offline_page()

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mm-fix-page-reference-leak-in-soft_offline_page.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit bf84cd0c490086b98cd0a7f26e86c44077b40ab2
Author: Dan Williams <dan.j.williams@xxxxxxxxx>
Date:   Sat Jan 23 21:01:52 2021 -0800

    mm: fix page reference leak in soft_offline_page()
    
    [ Upstream commit dad4e5b390866ca902653df0daa864ae4b8d4147 ]
    
    The conversion to move pfn_to_online_page() internal to
    soft_offline_page() missed that the get_user_pages() reference taken by
    the madvise() path needs to be dropped when pfn_to_online_page() fails.
    
    Note the direct sysfs-path to soft_offline_page() does not perform a
    get_user_pages() lookup.
    
    When soft_offline_page() is handed a pfn_valid() && !pfn_to_online_page()
    pfn the kernel hangs at dax-device shutdown due to a leaked reference.
    
    Link: https://lkml.kernel.org/r/161058501210.1840162.8108917599181157327.stgit@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    Fixes: feec24a6139d ("mm, soft-offline: convert parameter to pfn")
    Signed-off-by: Dan Williams <dan.j.williams@xxxxxxxxx>
    Reviewed-by: David Hildenbrand <david@xxxxxxxxxx>
    Reviewed-by: Oscar Salvador <osalvador@xxxxxxx>
    Reviewed-by: Naoya Horiguchi <naoya.horiguchi@xxxxxxx>
    Cc: Michal Hocko <mhocko@xxxxxxxx>
    Cc: Qian Cai <cai@xxxxxx>
    Cc: <stable@xxxxxxxxxxxxxxx>
    Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
    Stable-dep-of: e2c1ab070fdc ("mm: memory-failure: fix unexpected return value in soft_offline_page()")
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 71fd546dbdc37..e3c0fa2464ff8 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1867,6 +1867,12 @@ static int soft_offline_free_page(struct page *page)
 	return rc;
 }
 
+static void put_ref_page(struct page *page)
+{
+	if (page)
+		put_page(page);
+}
+
 /**
  * soft_offline_page - Soft offline a page.
  * @pfn: pfn to soft-offline
@@ -1892,20 +1898,26 @@ static int soft_offline_free_page(struct page *page)
 int soft_offline_page(unsigned long pfn, int flags)
 {
 	int ret;
-	struct page *page;
 	bool try_again = true;
+	struct page *page, *ref_page = NULL;
+
+	WARN_ON_ONCE(!pfn_valid(pfn) && (flags & MF_COUNT_INCREASED));
 
 	if (!pfn_valid(pfn))
 		return -ENXIO;
+	if (flags & MF_COUNT_INCREASED)
+		ref_page = pfn_to_page(pfn);
+
 	/* Only online pages can be soft-offlined (esp., not ZONE_DEVICE). */
 	page = pfn_to_online_page(pfn);
-	if (!page)
+	if (!page) {
+		put_ref_page(ref_page);
 		return -EIO;
+	}
 
 	if (PageHWPoison(page)) {
 		pr_info("%s: %#lx page already poisoned\n", __func__, pfn);
-		if (flags & MF_COUNT_INCREASED)
-			put_page(page);
+		put_ref_page(ref_page);
 		return 0;
 	}