linux-kernel - Re: [PATCH RESEND v2 4/4] mm/hwpoison: fix unpoison

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211027022937.GB2707645@u2004>
Date:   Wed, 27 Oct 2021 11:29:37 +0900
From:   Naoya Horiguchi <naoya.horiguchi@...ux.dev>
To:     Ding Hui <dinghui@...gfor.com.cn>
Cc:     Naoya Horiguchi <nao.horiguchi@...il.com>, linux-mm@...ck.org,
        Andrew Morton <akpm@...ux-foundation.org>,
        David Hildenbrand <david@...hat.com>,
        Oscar Salvador <osalvador@...e.de>,
        Michal Hocko <mhocko@...e.com>,
        Tony Luck <tony.luck@...el.com>,
        "Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com>,
        Miaohe Lin <linmiaohe@...wei.com>,
        Yang Shi <shy828301@...il.com>, Peter Xu <peterx@...hat.com>,
        Naoya Horiguchi <naoya.horiguchi@....com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH RESEND v2 4/4] mm/hwpoison: fix unpoison_memory()

On Wed, Oct 27, 2021 at 09:26:08AM +0800, Ding Hui wrote:
> On 2021/10/26 7:27, Naoya Horiguchi wrote:
> > (Please ignore previous patch 4/4 which leaves the replied message at
> > the end of body, this was due to my wrong manual edit, sorry about noise.
> > I resend 4/4.)
> > 
> > From: Naoya Horiguchi <naoya.horiguchi@....com>
> > 
> > After recent soft-offline rework, error pages can be taken off from
> > buddy allocator, but the existing unpoison_memory() does not properly
> > undo the operation.  Moreover, due to the recent change on
> > __get_hwpoison_page(), get_page_unless_zero() is hardly called for
> > hwpoisoned pages.  So __get_hwpoison_page() highly likely returns zero
> 
> Sorry, can you explain that __get_hwpoison_page() likely go which branch to
> return zero for hwpoisoned pages ?
> 
> not returns -EBUSY because HWPoisonHandlable() is false ?

Sorry, you're right, the return value mentioned here was changed since v1,
so I should have updated the description.

...
> > @@ -1958,9 +2023,7 @@ int unpoison_memory(unsigned long pfn)
> >   {
> >   	struct page *page;
> >   	struct page *p;
> > -	int freeit = 0;
> > -	int ret = 0;
> > -	unsigned long flags = 0;
> > +	int ret = -EBUSY;
> >   	static DEFINE_RATELIMIT_STATE(unpoison_rs, DEFAULT_RATELIMIT_INTERVAL,
> >   					DEFAULT_RATELIMIT_BURST);
> > @@ -1996,24 +2059,27 @@ int unpoison_memory(unsigned long pfn)
> >   		goto unlock_mutex;
> >   	}
> > -	if (!get_hwpoison_page(p, flags)) {
> > -		if (TestClearPageHWPoison(p))
> > -			num_poisoned_pages_dec();
> > -		unpoison_pr_info("Unpoison: Software-unpoisoned free page %#lx\n",
> > -				 pfn, &unpoison_rs);
> > +	if (PageSlab(page))
> 
> As I reported before [1], get refcount to a PageTable(page) is not safe,
> maybe let huge_pmd_unshare() go to wrong branch, so can you also avoid
> PageTable(page) here ?
> 
> [1]: https://lore.kernel.org/linux-mm/271d0f41-0599-9d5d-0555-47189f476243@sangfor.com.cn/

Sure, I'll add it.

> 
> >   		goto unlock_mutex;
> > -	}
> > -	if (TestClearPageHWPoison(page)) {
> > -		unpoison_pr_info("Unpoison: Software-unpoisoned page %#lx\n",
> > -				 pfn, &unpoison_rs);
> > -		num_poisoned_pages_dec();
> > -		freeit = 1;
> > -	}
> > +	ret = get_hwpoison_page(p, MF_UNPOISON);
> > +	if (!ret) {
> > +		ret = clear_page_hwpoison(&unpoison_rs, p);
> 
> in this case, the page p has zero refcount, with HWPoison flag, but without
> MAGIC_HWPOISON, where it come from ? race condition or normal case ? Is
> there any examples please ?

memory_failure() could set HWPoison flag at any time, so if a memory error happens
on a page which a just being freed, that could be linked to buddy freelist with
HWPoison flag.

Another example is hugetlb's case, if memory_failrue() is called for a free hugetlb
page and somehow dissolve_free_huge_page() fails in handling path, the hugepage
remains with HWPoison flag set and refcount 0.
BTW, considering this case, I found that clear_page_hwpoison() should be called
for "page" instead of "p", which will be fixed in the next version.

Thanks,
Naoya Horiguchi