linux-kernel - Re: [PATCH v1] mm: Fix for negative counter: nr_file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20231106102635.55bdf0cd99baad5c1fc8617a@linux-foundation.org>
Date:   Mon, 6 Nov 2023 10:26:35 -0800
From:   Andrew Morton <akpm@...ux-foundation.org>
To:     Stefan Roesch <shr@...kernel.io>
Cc:     kernel-team@...com, hannes@...xchg.org, riel@...riel.com,
        linux-kernel@...r.kernel.org, linux-mm@...ck.org
Subject: Re: [PATCH v1] mm: Fix for negative counter: nr_file_hugepages

On Mon,  6 Nov 2023 10:19:18 -0800 Stefan Roesch <shr@...kernel.io> wrote:

> While qualifiying the 6.4 release, the following warning was detected in
> messages:
> 
> vmstat_refresh: nr_file_hugepages -15664
> 
> The warning is caused by the incorrect updating of the NR_FILE_THPS
> counter in the function split_huge_page_to_list. The if case is checking
> for folio_test_swapbacked, but the else case is missing the check for
> folio_test_pmd_mappable. The other functions that manipulate the counter
> like __filemap_add_folio and filemap_unaccount_folio have the
> corresponding check.
> 
> I have a test case, which reproduces the problem. It can be found here:
>   https://github.com/sroeschus/testcase/blob/main/vmstat_refresh/madv.c
> 
> The test case reproduces on an XFS filesystem. Running the same test
> case on a BTRFS filesystem does not reproduce the problem.
> 
> AFAIK version 6.1 until 6.6 are affected by this problem.

I'm thinking a cc:stable is justified.

> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -2740,7 +2740,8 @@ int split_huge_page_to_list(struct page *page, struct list_head *list)
>  			if (folio_test_swapbacked(folio)) {
>  				__lruvec_stat_mod_folio(folio, NR_SHMEM_THPS,
>  							-nr);
> -			} else {
> +			} else if (folio_test_pmd_mappable(folio)) {
> +
>  				__lruvec_stat_mod_folio(folio, NR_FILE_THPS,
>  							-nr);
>  				filemap_nr_thps_dec(mapping);
> 

I expect this will backport OK until it hits 3e9a13daa ("huge_memory:
convert split_huge_page_to_list() to use a folio") at which point the
-stable maintainers might request a reworked version.