From nobody Sun Feb 8 19:03:21 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2BE4CEB64DD for ; Tue, 11 Jul 2023 05:50:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230419AbjGKFuV (ORCPT ); Tue, 11 Jul 2023 01:50:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34844 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229964AbjGKFuI (ORCPT ); Tue, 11 Jul 2023 01:50:08 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2F61A1B2 for ; Mon, 10 Jul 2023 22:50:05 -0700 (PDT) Received: from canpemm500002.china.huawei.com (unknown [172.30.72.56]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4R0VLc1cl3zqSHf; Tue, 11 Jul 2023 13:49:28 +0800 (CST) Received: from huawei.com (10.174.151.185) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Tue, 11 Jul 2023 13:50:01 +0800 From: Miaohe Lin To: , CC: , , Subject: [PATCH v2 1/8] mm: memory-failure: remove unneeded PageHuge() check Date: Tue, 11 Jul 2023 13:50:09 +0800 Message-ID: <20230711055016.2286677-2-linmiaohe@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20230711055016.2286677-1-linmiaohe@huawei.com> References: <20230711055016.2286677-1-linmiaohe@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.174.151.185] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To canpemm500002.china.huawei.com (7.192.104.244) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" PageHuge() check in me_huge_page() is just for potential problems. Remove it as it's actually dead code and won't catch anything. Signed-off-by: Miaohe Lin Acked-by: Naoya Horiguchi --- mm/memory-failure.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 64d7d34c177a..913fcf02ad38 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1187,9 +1187,6 @@ static int me_huge_page(struct page_state *ps, struct= page *p) struct address_space *mapping; bool extra_pins =3D false; =20 - if (!PageHuge(hpage)) - return MF_DELAYED; - mapping =3D page_mapping(hpage); if (mapping) { res =3D truncate_error_page(hpage, page_to_pfn(p), mapping); --=20 2.33.0 From nobody Sun Feb 8 19:03:21 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 721F5EB64DD for ; Tue, 11 Jul 2023 05:50:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231133AbjGKFuh (ORCPT ); Tue, 11 Jul 2023 01:50:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34850 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230063AbjGKFuJ (ORCPT ); Tue, 11 Jul 2023 01:50:09 -0400 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8D0A9E49 for ; Mon, 10 Jul 2023 22:50:07 -0700 (PDT) Received: from canpemm500002.china.huawei.com (unknown [172.30.72.53]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4R0VJb4QvVzPk2m; Tue, 11 Jul 2023 13:47:43 +0800 (CST) Received: from huawei.com (10.174.151.185) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Tue, 11 Jul 2023 13:50:02 +0800 From: Miaohe Lin To: , CC: , , Subject: [PATCH v2 2/8] mm: memory-failure: ensure moving HWPoison flag to the raw error pages Date: Tue, 11 Jul 2023 13:50:10 +0800 Message-ID: <20230711055016.2286677-3-linmiaohe@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20230711055016.2286677-1-linmiaohe@huawei.com> References: <20230711055016.2286677-1-linmiaohe@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.174.151.185] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To canpemm500002.china.huawei.com (7.192.104.244) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" If hugetlb_vmemmap_optimized is enabled, folio_clear_hugetlb_hwpoison() called from try_memory_failure_hugetlb() won't transfer HWPoison flag to subpages while folio's HWPoison flag is cleared. So when trying to free this hugetlb page into buddy, folio_clear_hugetlb_hwpoison() is not called to move HWPoison flag from head page to the raw error pages even if now hugetlb_vmemmap_optimized is cleared. This will results in HWPoisoned page being used again and raw_hwp_page leak. Fixes: ac5fcde0a96a ("mm, hwpoison: make unpoison aware of raw error info i= n hwpoisoned hugepage") Signed-off-by: Miaohe Lin Acked-by: Naoya Horiguchi --- mm/memory-failure.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 913fcf02ad38..feca3c4068a5 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1920,6 +1920,8 @@ void folio_clear_hugetlb_hwpoison(struct folio *folio) { if (folio_test_hugetlb_raw_hwp_unreliable(folio)) return; + if (folio_test_hugetlb_vmemmap_optimized(folio)) + return; folio_clear_hwpoison(folio); folio_free_raw_hwp(folio, true); } --=20 2.33.0 From nobody Sun Feb 8 19:03:21 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0CDA1C001B0 for ; Tue, 11 Jul 2023 05:50:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230180AbjGKFuK (ORCPT ); Tue, 11 Jul 2023 01:50:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34822 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229659AbjGKFuH (ORCPT ); Tue, 11 Jul 2023 01:50:07 -0400 Received: from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CA1B71A4 for ; Mon, 10 Jul 2023 22:50:05 -0700 (PDT) Received: from canpemm500002.china.huawei.com (unknown [172.30.72.54]) by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4R0VLd6GMlz1FDpF; Tue, 11 Jul 2023 13:49:29 +0800 (CST) Received: from huawei.com (10.174.151.185) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Tue, 11 Jul 2023 13:50:02 +0800 From: Miaohe Lin To: , CC: , , Subject: [PATCH v2 3/8] mm: memory-failure: Don't account hwpoison_filter() filtered pages Date: Tue, 11 Jul 2023 13:50:11 +0800 Message-ID: <20230711055016.2286677-4-linmiaohe@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20230711055016.2286677-1-linmiaohe@huawei.com> References: <20230711055016.2286677-1-linmiaohe@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.174.151.185] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To canpemm500002.china.huawei.com (7.192.104.244) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" mf_generic_kill_procs() will return -EOPNOTSUPP when hwpoison_filter() filtered dax page. In that case, action_result() isn't expected to be called to update mf_stats. This will results in inaccurate but benign memory failure handling statistics. Signed-off-by: Miaohe Lin Acked-by: Naoya Horiguchi --- mm/memory-failure.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index feca3c4068a5..c80b7d9505d8 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -2108,7 +2108,8 @@ static int memory_failure_dev_pagemap(unsigned long p= fn, int flags, out: /* drop pgmap ref acquired in caller */ put_dev_pagemap(pgmap); - action_result(pfn, MF_MSG_DAX, rc ? MF_FAILED : MF_RECOVERED); + if (rc !=3D -EOPNOTSUPP) + action_result(pfn, MF_MSG_DAX, rc ? MF_FAILED : MF_RECOVERED); return rc; } =20 --=20 2.33.0 From nobody Sun Feb 8 19:03:21 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BBF0FC001B0 for ; Tue, 11 Jul 2023 05:50:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230327AbjGKFuT (ORCPT ); Tue, 11 Jul 2023 01:50:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34824 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229798AbjGKFuH (ORCPT ); Tue, 11 Jul 2023 01:50:07 -0400 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2B1D11A7 for ; Mon, 10 Jul 2023 22:50:05 -0700 (PDT) Received: from canpemm500002.china.huawei.com (unknown [172.30.72.57]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4R0VHV6bLdzMqSB; Tue, 11 Jul 2023 13:46:46 +0800 (CST) Received: from huawei.com (10.174.151.185) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Tue, 11 Jul 2023 13:50:02 +0800 From: Miaohe Lin To: , CC: , , Subject: [PATCH v2 4/8] mm: memory-failure: use local variable huge to check hugetlb page Date: Tue, 11 Jul 2023 13:50:12 +0800 Message-ID: <20230711055016.2286677-5-linmiaohe@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20230711055016.2286677-1-linmiaohe@huawei.com> References: <20230711055016.2286677-1-linmiaohe@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.174.151.185] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To canpemm500002.china.huawei.com (7.192.104.244) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Use local variable huge to check whether page is hugetlb page to avoid calling PageHuge() multiple times to save cpu cycles. PageHuge() will be stable while extra page refcnt is held. Signed-off-by: Miaohe Lin Acked-by: Naoya Horiguchi --- mm/memory-failure.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index c80b7d9505d8..239e0711f832 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -2628,7 +2628,7 @@ static int soft_offline_in_use_page(struct page *page) } =20 lock_page(page); - if (!PageHuge(page)) + if (!huge) wait_on_page_writeback(page); if (PageHWPoison(page)) { unlock_page(page); @@ -2637,7 +2637,7 @@ static int soft_offline_in_use_page(struct page *page) return 0; } =20 - if (!PageHuge(page) && PageLRU(page) && !PageSwapCache(page)) + if (!huge && PageLRU(page) && !PageSwapCache(page)) /* * Try to invalidate first. This should work for * non dirty unmapped page cache pages. --=20 2.33.0 From nobody Sun Feb 8 19:03:21 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 728B2C001B0 for ; Tue, 11 Jul 2023 05:50:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230490AbjGKFuY (ORCPT ); Tue, 11 Jul 2023 01:50:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34842 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229906AbjGKFuI (ORCPT ); Tue, 11 Jul 2023 01:50:08 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2E1071AC for ; Mon, 10 Jul 2023 22:50:05 -0700 (PDT) Received: from canpemm500002.china.huawei.com (unknown [172.30.72.56]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4R0VLf0T5QzqVZY; Tue, 11 Jul 2023 13:49:30 +0800 (CST) Received: from huawei.com (10.174.151.185) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Tue, 11 Jul 2023 13:50:03 +0800 From: Miaohe Lin To: , CC: , , Subject: [PATCH v2 5/8] mm: memory-failure: remove unneeded header files Date: Tue, 11 Jul 2023 13:50:13 +0800 Message-ID: <20230711055016.2286677-6-linmiaohe@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20230711055016.2286677-1-linmiaohe@huawei.com> References: <20230711055016.2286677-1-linmiaohe@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.174.151.185] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To canpemm500002.china.huawei.com (7.192.104.244) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Remove some unneeded header files. No functional change intended. Signed-off-by: Miaohe Lin Acked-by: Naoya Horiguchi --- mm/memory-failure.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 239e0711f832..0da6ddbdd718 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -39,7 +39,6 @@ #include #include #include -#include #include #include #include @@ -50,7 +49,6 @@ #include #include #include -#include #include #include #include @@ -59,7 +57,6 @@ #include #include #include -#include #include #include #include --=20 2.33.0 From nobody Sun Feb 8 19:03:21 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6447AEB64DD for ; Tue, 11 Jul 2023 05:50:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231127AbjGKFu0 (ORCPT ); Tue, 11 Jul 2023 01:50:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34848 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229990AbjGKFuI (ORCPT ); Tue, 11 Jul 2023 01:50:08 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 48FFCE40 for ; Mon, 10 Jul 2023 22:50:07 -0700 (PDT) Received: from canpemm500002.china.huawei.com (unknown [172.30.72.56]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4R0VHt1MsqztQvN; Tue, 11 Jul 2023 13:47:06 +0800 (CST) Received: from huawei.com (10.174.151.185) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Tue, 11 Jul 2023 13:50:03 +0800 From: Miaohe Lin To: , CC: , , Subject: [PATCH v2 6/8] mm: memory-failure: minor cleanup for comments and codestyle Date: Tue, 11 Jul 2023 13:50:14 +0800 Message-ID: <20230711055016.2286677-7-linmiaohe@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20230711055016.2286677-1-linmiaohe@huawei.com> References: <20230711055016.2286677-1-linmiaohe@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.174.151.185] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To canpemm500002.china.huawei.com (7.192.104.244) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Fix some wrong function names and grammar error in comments. Also remove unneeded space after for_each_process. No functional change intended. Signed-off-by: Miaohe Lin Acked-by: Naoya Horiguchi --- mm/memory-failure.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 0da6ddbdd718..db4c530944d6 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -608,7 +608,7 @@ static void collect_procs_anon(struct page *page, struc= t list_head *to_kill, =20 pgoff =3D page_to_pgoff(page); read_lock(&tasklist_lock); - for_each_process (tsk) { + for_each_process(tsk) { struct anon_vma_chain *vmac; struct task_struct *t =3D task_early_kill(tsk, force_early); =20 @@ -652,7 +652,7 @@ static void collect_procs_file(struct page *page, struc= t list_head *to_kill, /* * Send early kill signal to tasks where a vma covers * the page but the corrupted page is not necessarily - * mapped it in its pte. + * mapped in its pte. * Assume applications who requested early kill want * to be informed of all such data corruptions. */ @@ -2127,7 +2127,7 @@ static DEFINE_MUTEX(mf_mutex); * detected by a background scrubber) * * Must run in process context (e.g. a work queue) with interrupts - * enabled and no spinlocks hold. + * enabled and no spinlocks held. * * Return: 0 for successfully handled the memory error, * -EOPNOTSUPP for hwpoison_filter() filtered the error event, @@ -2232,7 +2232,7 @@ int memory_failure(unsigned long pfn, int flags) * otherwise it may race with THP split. * And the flag can't be set in get_hwpoison_page() since * it is called by soft offline too and it is just called - * for !MF_COUNT_INCREASE. So here seems to be the best + * for !MF_COUNT_INCREASED. So here seems to be the best * place. * * Don't need care about the above error handling paths for @@ -2589,10 +2589,10 @@ static bool isolate_page(struct page *page, struct = list_head *pagelist) =20 /* * If we succeed to isolate the page, we grabbed another refcount on - * the page, so we can safely drop the one we got from get_any_pages(). + * the page, so we can safely drop the one we got from get_any_page(). * If we failed to isolate the page, it means that we cannot go further * and we will return an error, so drop the reference we got from - * get_any_pages() as well. + * get_any_page() as well. */ put_page(page); return isolated; --=20 2.33.0 From nobody Sun Feb 8 19:03:21 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 952BAEB64DC for ; Tue, 11 Jul 2023 05:50:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231185AbjGKFuc (ORCPT ); Tue, 11 Jul 2023 01:50:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34844 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230035AbjGKFuJ (ORCPT ); Tue, 11 Jul 2023 01:50:09 -0400 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3EAA81BB for ; Mon, 10 Jul 2023 22:50:06 -0700 (PDT) Received: from canpemm500002.china.huawei.com (unknown [172.30.72.54]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4R0VJd66LkzPk1v; Tue, 11 Jul 2023 13:47:45 +0800 (CST) Received: from huawei.com (10.174.151.185) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Tue, 11 Jul 2023 13:50:04 +0800 From: Miaohe Lin To: , CC: , , Subject: [PATCH v2 7/8] mm: memory-failure: fetch compound head after extra page refcnt is held Date: Tue, 11 Jul 2023 13:50:15 +0800 Message-ID: <20230711055016.2286677-8-linmiaohe@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20230711055016.2286677-1-linmiaohe@huawei.com> References: <20230711055016.2286677-1-linmiaohe@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.174.151.185] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To canpemm500002.china.huawei.com (7.192.104.244) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Page might become thp, huge page or being splited after compound head is fetched but before page refcnt is bumped. So hpage might be a tail page leading to VM_BUG_ON_PAGE(PageTail(page)) in PageTransHuge(). Fixes: 415c64c1453a ("mm/memory-failure: split thp earlier in memory error = handling") Signed-off-by: Miaohe Lin Acked-by: Naoya Horiguchi --- mm/memory-failure.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index db4c530944d6..af34fd4669d3 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -2186,8 +2186,6 @@ int memory_failure(unsigned long pfn, int flags) goto unlock_mutex; } =20 - hpage =3D compound_head(p); - /* * We need/can do nothing about count=3D0 pages. * 1) it's a free page, and therefore in safe hand: @@ -2226,6 +2224,7 @@ int memory_failure(unsigned long pfn, int flags) } } =20 + hpage =3D compound_head(p); if (PageTransHuge(hpage)) { /* * The flag must be set after the refcount is bumped --=20 2.33.0 From nobody Sun Feb 8 19:03:21 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13802EB64DD for ; Tue, 11 Jul 2023 05:50:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230379AbjGKFu3 (ORCPT ); Tue, 11 Jul 2023 01:50:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34846 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230015AbjGKFuI (ORCPT ); Tue, 11 Jul 2023 01:50:08 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3FF441BC for ; Mon, 10 Jul 2023 22:50:07 -0700 (PDT) Received: from canpemm500002.china.huawei.com (unknown [172.30.72.55]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4R0VHv0DmQztR5C; Tue, 11 Jul 2023 13:47:07 +0800 (CST) Received: from huawei.com (10.174.151.185) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Tue, 11 Jul 2023 13:50:04 +0800 From: Miaohe Lin To: , CC: , , Subject: [PATCH v2 8/8] mm: memory-failure: fix race window when trying to get hugetlb folio Date: Tue, 11 Jul 2023 13:50:16 +0800 Message-ID: <20230711055016.2286677-9-linmiaohe@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20230711055016.2286677-1-linmiaohe@huawei.com> References: <20230711055016.2286677-1-linmiaohe@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.174.151.185] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To canpemm500002.china.huawei.com (7.192.104.244) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" page_folio() is fetched before calling get_hwpoison_hugetlb_folio() without hugetlb_lock being held. So hugetlb page could be demoted before get_hwpoison_hugetlb_folio() holding hugetlb_lock but after page_folio() is fetched. So get_hwpoison_hugetlb_folio() will hold unexpected extra refcnt of hugetlb folio while leaving demoted page un-refcnted. Fixes: 25182f05ffed ("mm,hwpoison: fix race with hugetlb page allocation") Signed-off-by: Miaohe Lin Acked-by: Naoya Horiguchi --- mm/memory-failure.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index af34fd4669d3..9ab97016877e 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1383,8 +1383,15 @@ static int __get_hwpoison_page(struct page *page, un= signed long flags) bool hugetlb =3D false; =20 ret =3D get_hwpoison_hugetlb_folio(folio, &hugetlb, false); - if (hugetlb) - return ret; + if (hugetlb) { + /* Make sure hugetlb demotion did not happen from under us. */ + if (folio =3D=3D page_folio(page)) + return ret; + if (ret > 0) { + folio_put(folio); + folio =3D page_folio(page); + } + } =20 /* * This check prevents from calling folio_try_get() for any @@ -1473,8 +1480,13 @@ static int __get_unpoison_page(struct page *page) bool hugetlb =3D false; =20 ret =3D get_hwpoison_hugetlb_folio(folio, &hugetlb, true); - if (hugetlb) - return ret; + if (hugetlb) { + /* Make sure hugetlb demotion did not happen from under us. */ + if (folio =3D=3D page_folio(page)) + return ret; + if (ret > 0) + folio_put(folio); + } =20 /* * PageHWPoisonTakenOff pages are not only marked as PG_hwpoison, --=20 2.33.0