linux-kernel - Re: [PATCH 3/3] mm/memory-failure.c: dissolve truncated hugetlb page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 11 Apr 2022 13:13:45 +0000
From:   HORIGUCHI NAOYA(堀口　直也) 
        <naoya.horiguchi@....com>
To:     Miaohe Lin <linmiaohe@...wei.com>
CC:     "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
        "shy828301@...il.com" <shy828301@...il.com>,
        "mike.kravetz@...cle.com" <mike.kravetz@...cle.com>,
        "david@...hat.com" <david@...hat.com>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 3/3] mm/memory-failure.c: dissolve truncated hugetlb page

Hi Miaohe,

On Thu, Apr 07, 2022 at 09:03:52PM +0800, Miaohe Lin wrote:
> If me_huge_page meets a truncated huge page, hpage won't be dissolved

I might not understand correctly what "truncated huge page" means.  If it
means the page passed to me_huge_page() and truncate_error_page() is called
on it, the else branch you're trying to update is not chosen, so maybe it
sounds irrelevant to me?  Could you elaborate it or share the procedure to
reproduce the case you care about?

> even if we hold the last refcnt. It's because the truncated huge page
> has NULL page_mapping while it's not anonymous page too. Thus we lose
> the last chance to dissolve it into buddy to save healthy subpages.
> Remove PageAnon check to handle these huge pages too.
> 
> Signed-off-by: Miaohe Lin <linmiaohe@...wei.com>
> ---
>  mm/memory-failure.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/mm/memory-failure.c b/mm/memory-failure.c
> index bd563f47630c..3f054dbb169d 100644
> --- a/mm/memory-failure.c
> +++ b/mm/memory-failure.c
> @@ -1046,8 +1046,7 @@ static int me_huge_page(struct page_state *ps, struct page *p)
>  		 * hugepage, so we can free and dissolve it into buddy to
>  		 * save healthy subpages.
>  		 */
> -		if (PageAnon(hpage))
> -			put_page(hpage);

I think that the reason of this "if (PageAnon(hpage))" is to not remove
hugepages for hugetlbfs files.  Unlike anonymous hugepage, it can be
accessed from file after error handling, so we can't simply dissolve it
because otherwise another process reading the hugepage sees zeroed one
without knowing the memory error.

Thanks,
Naoya Horiguchi

> +		put_page(hpage);
>  		if (__page_handle_poison(p)) {
>  			page_ref_inc(p);
>  			res = MF_RECOVERED;
> -- 
> 2.23.0