From nobody Sun Feb 8 00:03:27 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A174C04A6A for ; Thu, 27 Jul 2023 11:57:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233609AbjG0L5B (ORCPT ); Thu, 27 Jul 2023 07:57:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44128 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233573AbjG0L44 (ORCPT ); Thu, 27 Jul 2023 07:56:56 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 84B0A2738 for ; Thu, 27 Jul 2023 04:56:52 -0700 (PDT) Received: from canpemm500002.china.huawei.com (unknown [172.30.72.55]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4RBTk351PczrS0M; Thu, 27 Jul 2023 19:55:55 +0800 (CST) Received: from huawei.com (10.174.151.185) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Thu, 27 Jul 2023 19:56:50 +0800 From: Miaohe Lin To: , CC: , , , Subject: [PATCH v2 1/4] mm/swapfile: fix wrong swap entry type for hwpoisoned swapcache page Date: Thu, 27 Jul 2023 19:56:40 +0800 Message-ID: <20230727115643.639741-2-linmiaohe@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20230727115643.639741-1-linmiaohe@huawei.com> References: <20230727115643.639741-1-linmiaohe@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.174.151.185] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To canpemm500002.china.huawei.com (7.192.104.244) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Hwpoisoned dirty swap cache page is kept in the swap cache and there's simple interception code in do_swap_page() to catch it. But when trying to swapoff, unuse_pte() will wrongly install a general sense of "future accesses are invalid" swap entry for hwpoisoned swap cache page due to unaware of such type of page. The user will receive SIGBUS signal without expected BUS_MCEERR_AR payload. BTW, typo 'hwposioned' is fixed. Fixes: 6b970599e807 ("mm: hwpoison: support recovery from ksm_might_need_to= _copy()") Signed-off-by: Miaohe Lin --- mm/ksm.c | 2 ++ mm/swapfile.c | 8 ++++---- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/mm/ksm.c b/mm/ksm.c index 97a9627116fa..74804158ee02 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -2794,6 +2794,8 @@ struct page *ksm_might_need_to_copy(struct page *page, anon_vma->root =3D=3D vma->anon_vma->root) { return page; /* still no need to copy it */ } + if (PageHWPoison(page)) + return ERR_PTR(-EHWPOISON); if (!PageUptodate(page)) return page; /* let do_swap_page report the error */ =20 diff --git a/mm/swapfile.c b/mm/swapfile.c index e04eb9c0482d..0df94c4000ea 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -1744,7 +1744,7 @@ static int unuse_pte(struct vm_area_struct *vma, pmd_= t *pmd, struct page *swapcache; spinlock_t *ptl; pte_t *pte, new_pte, old_pte; - bool hwposioned =3D false; + bool hwpoisoned =3D PageHWPoison(page); int ret =3D 1; =20 swapcache =3D page; @@ -1752,7 +1752,7 @@ static int unuse_pte(struct vm_area_struct *vma, pmd_= t *pmd, if (unlikely(!page)) return -ENOMEM; else if (unlikely(PTR_ERR(page) =3D=3D -EHWPOISON)) - hwposioned =3D true; + hwpoisoned =3D true; =20 pte =3D pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl); if (unlikely(!pte || !pte_same_as_swp(ptep_get(pte), @@ -1763,11 +1763,11 @@ static int unuse_pte(struct vm_area_struct *vma, pm= d_t *pmd, =20 old_pte =3D ptep_get(pte); =20 - if (unlikely(hwposioned || !PageUptodate(page))) { + if (unlikely(hwpoisoned || !PageUptodate(page))) { swp_entry_t swp_entry; =20 dec_mm_counter(vma->vm_mm, MM_SWAPENTS); - if (hwposioned) { + if (hwpoisoned) { swp_entry =3D make_hwpoison_entry(swapcache); page =3D swapcache; } else { --=20 2.33.0 From nobody Sun Feb 8 00:03:27 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8C37EC04A94 for ; Thu, 27 Jul 2023 11:57:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233626AbjG0L5D (ORCPT ); Thu, 27 Jul 2023 07:57:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44138 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233574AbjG0L44 (ORCPT ); Thu, 27 Jul 2023 07:56:56 -0400 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8B1A52D4B for ; Thu, 27 Jul 2023 04:56:53 -0700 (PDT) Received: from canpemm500002.china.huawei.com (unknown [172.30.72.57]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4RBTh66H48zLntw; Thu, 27 Jul 2023 19:54:14 +0800 (CST) Received: from huawei.com (10.174.151.185) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Thu, 27 Jul 2023 19:56:50 +0800 From: Miaohe Lin To: , CC: , , , Subject: [PATCH v2 2/4] mm: memory-failure: fix potential unexpected return value from unpoison_memory() Date: Thu, 27 Jul 2023 19:56:41 +0800 Message-ID: <20230727115643.639741-3-linmiaohe@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20230727115643.639741-1-linmiaohe@huawei.com> References: <20230727115643.639741-1-linmiaohe@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.174.151.185] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To canpemm500002.china.huawei.com (7.192.104.244) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" If unpoison_memory() fails to clear page hwpoisoned flag, return value ret is expected to be -EBUSY. But when get_hwpoison_page() returns 1 and fails to clear page hwpoisoned flag due to races, return value will be unexpected 1 leading to users being confused. And there's a code smell that the variable "ret" is used not only to save the return value of unpoison_memory(), but also the return value from get_hwpoison_page(). Make a further cleanup by using another auto-variable solely to save the return value of get_hwpoison_page() as suggested by Naoya. Fixes: bf181c582588 ("mm/hwpoison: fix unpoison_memory()") Signed-off-by: Miaohe Lin --- mm/memory-failure.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index a114c8c3039c..4a3e88c15631 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -2502,7 +2502,7 @@ int unpoison_memory(unsigned long pfn) { struct folio *folio; struct page *p; - int ret =3D -EBUSY; + int ret =3D -EBUSY, ghp; unsigned long count =3D 1; bool huge =3D false; static DEFINE_RATELIMIT_STATE(unpoison_rs, DEFAULT_RATELIMIT_INTERVAL, @@ -2550,29 +2550,28 @@ int unpoison_memory(unsigned long pfn) if (folio_test_slab(folio) || PageTable(&folio->page) || folio_test_reser= ved(folio)) goto unlock_mutex; =20 - ret =3D get_hwpoison_page(p, MF_UNPOISON); - if (!ret) { + ghp =3D get_hwpoison_page(p, MF_UNPOISON); + if (!ghp) { if (PageHuge(p)) { huge =3D true; count =3D folio_free_raw_hwp(folio, false); - if (count =3D=3D 0) { - ret =3D -EBUSY; + if (count =3D=3D 0) goto unlock_mutex; - } } ret =3D folio_test_clear_hwpoison(folio) ? 0 : -EBUSY; - } else if (ret < 0) { - if (ret =3D=3D -EHWPOISON) { + } else if (ghp < 0) { + if (ghp =3D=3D -EHWPOISON) { ret =3D put_page_back_buddy(p) ? 0 : -EBUSY; - } else + } else { + ret =3D ghp; unpoison_pr_info("Unpoison: failed to grab page %#lx\n", pfn, &unpoison_rs); + } } else { if (PageHuge(p)) { huge =3D true; count =3D folio_free_raw_hwp(folio, false); if (count =3D=3D 0) { - ret =3D -EBUSY; folio_put(folio); goto unlock_mutex; } --=20 2.33.0 From nobody Sun Feb 8 00:03:27 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35ADDC0015E for ; Thu, 27 Jul 2023 11:57:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233654AbjG0L5J (ORCPT ); Thu, 27 Jul 2023 07:57:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44174 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233589AbjG0L46 (ORCPT ); Thu, 27 Jul 2023 07:56:58 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D0F122D54 for ; Thu, 27 Jul 2023 04:56:54 -0700 (PDT) Received: from canpemm500002.china.huawei.com (unknown [172.30.72.55]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4RBTgN0WB2ztRc7; Thu, 27 Jul 2023 19:53:36 +0800 (CST) Received: from huawei.com (10.174.151.185) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Thu, 27 Jul 2023 19:56:51 +0800 From: Miaohe Lin To: , CC: , , , Subject: [PATCH v2 3/4] mm: memory-failure: avoid false hwpoison page mapped error info Date: Thu, 27 Jul 2023 19:56:42 +0800 Message-ID: <20230727115643.639741-4-linmiaohe@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20230727115643.639741-1-linmiaohe@huawei.com> References: <20230727115643.639741-1-linmiaohe@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.174.151.185] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To canpemm500002.china.huawei.com (7.192.104.244) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" folio->_mapcount is overloaded in SLAB, so folio_mapped() has to be done after folio_test_slab() is checked. Otherwise slab folio might be treated as a mapped folio leading to false 'Someone maps the hwpoison page' error info. Fixes: 230ac719c500 ("mm/hwpoison: don't try to unpoison containment-failed= pages") Signed-off-by: Miaohe Lin Reviewed-by: Matthew Wilcox (Oracle) Acked-by: Naoya Horiguchi --- mm/memory-failure.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 4a3e88c15631..d975a6b224f7 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -2535,6 +2535,13 @@ int unpoison_memory(unsigned long pfn) goto unlock_mutex; } =20 + if (folio_test_slab(folio) || PageTable(&folio->page) || folio_test_reser= ved(folio)) + goto unlock_mutex; + + /* + * Note that folio->_mapcount is overloaded in SLAB, so the simple test + * in folio_mapped() has to be done after folio_test_slab() is checked. + */ if (folio_mapped(folio)) { unpoison_pr_info("Unpoison: Someone maps the hwpoison page %#lx\n", pfn, &unpoison_rs); @@ -2547,9 +2554,6 @@ int unpoison_memory(unsigned long pfn) goto unlock_mutex; } =20 - if (folio_test_slab(folio) || PageTable(&folio->page) || folio_test_reser= ved(folio)) - goto unlock_mutex; - ghp =3D get_hwpoison_page(p, MF_UNPOISON); if (!ghp) { if (PageHuge(p)) { --=20 2.33.0 From nobody Sun Feb 8 00:03:27 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59B39C0015E for ; Thu, 27 Jul 2023 11:57:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233645AbjG0L5H (ORCPT ); Thu, 27 Jul 2023 07:57:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44168 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233580AbjG0L46 (ORCPT ); Thu, 27 Jul 2023 07:56:58 -0400 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5DD122D4E for ; Thu, 27 Jul 2023 04:56:54 -0700 (PDT) Received: from canpemm500002.china.huawei.com (unknown [172.30.72.55]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4RBTgD4yQxzNmV5; Thu, 27 Jul 2023 19:53:28 +0800 (CST) Received: from huawei.com (10.174.151.185) by canpemm500002.china.huawei.com (7.192.104.244) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.27; Thu, 27 Jul 2023 19:56:51 +0800 From: Miaohe Lin To: , CC: , , , Subject: [PATCH v2 4/4] mm: memory-failure: add PageOffline() check Date: Thu, 27 Jul 2023 19:56:43 +0800 Message-ID: <20230727115643.639741-5-linmiaohe@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20230727115643.639741-1-linmiaohe@huawei.com> References: <20230727115643.639741-1-linmiaohe@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.174.151.185] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To canpemm500002.china.huawei.com (7.192.104.244) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Memory failure is not interested in logically offlined page. Skip this type of pages. Signed-off-by: Miaohe Lin Acked-by: Naoya Horiguchi --- mm/memory-failure.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index d975a6b224f7..e4c4b9dc852f 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1561,7 +1561,7 @@ static bool hwpoison_user_mappings(struct page *p, un= signed long pfn, * Here we are interested only in user-mapped pages, so skip any * other types of pages. */ - if (PageReserved(p) || PageSlab(p) || PageTable(p)) + if (PageReserved(p) || PageSlab(p) || PageTable(p) || PageOffline(p)) return true; if (!(PageLRU(hpage) || PageHuge(p))) return true; @@ -2535,7 +2535,8 @@ int unpoison_memory(unsigned long pfn) goto unlock_mutex; } =20 - if (folio_test_slab(folio) || PageTable(&folio->page) || folio_test_reser= ved(folio)) + if (folio_test_slab(folio) || PageTable(&folio->page) || + folio_test_reserved(folio) || PageOffline(&folio->page)) goto unlock_mutex; =20 /* --=20 2.33.0