On Wed, Aug 07, 2024 at 11:58:53AM +0800, Miaohe Lin wrote: > There is a potential race between __update_and_free_hugetlb_folio() and > try_memory_failure_hugetlb(): > > CPU1 CPU2 > __update_and_free_hugetlb_folio try_memory_failure_hugetlb > folio_test_hugetlb > -- It's still hugetlb folio. > folio_clear_hugetlb_hwpoison > spin_lock_irq(&hugetlb_lock); > __get_huge_page_for_hwpoison > folio_set_hugetlb_hwpoison > spin_unlock_irq(&hugetlb_lock); > spin_lock_irq(&hugetlb_lock); > __folio_clear_hugetlb(folio); > -- Hugetlb flag is cleared but too late. > spin_unlock_irq(&hugetlb_lock); > > When the above race occurs, raw error page info will be leaked. Even > worse, raw error pages won't have hwpoisoned flag set and hit > pcplists/buddy. Fix this issue by deferring > folio_clear_hugetlb_hwpoison() until __folio_clear_hugetlb() is done. So > all raw error pages will have hwpoisoned flag set. > > Link: https://lkml.kernel.org/r/20240708025127.107713-1-linmiaohe@xxxxxxxxxx > Fixes: 32c877191e02 ("hugetlb: do not clear hugetlb dtor until allocating vmemmap") > Signed-off-by: Miaohe Lin <linmiaohe@xxxxxxxxxx> > Acked-by: Muchun Song <muchun.song@xxxxxxxxx> > Reviewed-by: Oscar Salvador <osalvador@xxxxxxx> > Cc: <stable@xxxxxxxxxxxxxxx> > Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> > (cherry picked from commit 5596d9e8b553dacb0ac34bcf873cbbfb16c3ba3e) > Signed-off-by: Miaohe Lin <linmiaohe@xxxxxxxxxx> > --- > mm/hugetlb.c | 14 +++++++------- > 1 file changed, 7 insertions(+), 7 deletions(-) > Backports now queued up, thanks. greg k-h
