linux-kernel - Re: [PATCH v2] fs/hugetlbfs/inode.c: mm/memory-failure.c: fix hugetlbfs hwpoison handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1e59e3c8-63d5-bba1-9c00-218c3cc8f5ff@huawei.com>
Date: Tue, 16 Jan 2024 10:36:08 +0800
From: Miaohe Lin <linmiaohe@...wei.com>
To: Sidhartha Kumar <sidhartha.kumar@...cle.com>,
	<linux-kernel@...r.kernel.org>, <linux-mm@...ck.org>
CC: <akpm@...ux-foundation.org>, <usama.anjum@...labora.com>,
	<muchun.song@...ux.dev>, <jiaqiyan@...gle.com>, <willy@...radead.org>,
	<naoya.horiguchi@....com>, <shy828301@...il.com>, <jthoughton@...gle.com>,
	<jane.chu@...cle.com>, <stable@...r.kernel.org>
Subject: Re: [PATCH v2] fs/hugetlbfs/inode.c: mm/memory-failure.c: fix
 hugetlbfs hwpoison handling

On 2024/1/13 2:08, Sidhartha Kumar wrote:
> has_extra_refcount() makes the assumption that the page cache adds a ref
> count of 1 and subtracts this in the extra_pins case. Commit a08c7193e4f1
> (mm/filemap: remove hugetlb special casing in filemap.c) modifies
> __filemap_add_folio() by calling folio_ref_add(folio, nr); for all cases
> (including hugtetlb) where nr is the number of pages in the folio. We
> should adjust the number of references coming from the page cache by
> subtracing the number of pages rather than 1.
> 
> In hugetlbfs_read_iter(), folio_test_has_hwpoisoned() is testing the wrong
> flag as, in the hugetlb case, memory-failure code calls
> folio_test_set_hwpoison() to indicate poison. folio_test_hwpoison() is the
> correct function to test for that flag.
> 
> After these fixes, the hugetlb hwpoison read selftest passes all cases.
> 
> Fixes: a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in filemap.c")
> Closes: https://lore.kernel.org/linux-mm/20230713001833.3778937-1-jiaqiyan@google.com/T/#m8e1469119e5b831bbd05d495f96b842e4a1c5519
> Cc: <stable@...r.kernel.org> # 6.7+
> Signed-off-by: Sidhartha Kumar <sidhartha.kumar@...cle.com>
> Reported-by: Muhammad Usama Anjum <usama.anjum@...labora.com>
> ---
> 
> v1 -> v2:
>     move ref_count adjustment to if(extra_pins) block as that represents
>     ref counts from the page cache per Miaohe Lin.

Thanks for your update of patch.

> 
>  fs/hugetlbfs/inode.c | 2 +-
>  mm/memory-failure.c  | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
> index 36132c9125f9..3a248e4f7e93 100644
> --- a/fs/hugetlbfs/inode.c
> +++ b/fs/hugetlbfs/inode.c
> @@ -340,7 +340,7 @@ static ssize_t hugetlbfs_read_iter(struct kiocb *iocb, struct iov_iter *to)
>  		} else {
>  			folio_unlock(folio);
>  
> -			if (!folio_test_has_hwpoisoned(folio))
> +			if (!folio_test_hwpoison(folio))
>  				want = nr;
>  			else {
>  				/*
> diff --git a/mm/memory-failure.c b/mm/memory-failure.c
> index d8c853b35dbb..ef7ae73b65bd 100644
> --- a/mm/memory-failure.c
> +++ b/mm/memory-failure.c
> @@ -976,7 +976,7 @@ static bool has_extra_refcount(struct page_state *ps, struct page *p,
>  	int count = page_count(p) - 1;
>  
>  	if (extra_pins)
> -		count -= 1;
> +		count -= folio_nr_pages(page_folio(p));

I think this should be the right solution. @extra_pins indicates the extra page refcnt from page cache.

Acked-by: Miaohe Lin <linmiaohe@...wei.com>
Thanks.

>  
>  	if (count > 0) {
>  		pr_err("%#lx: %s still referenced by %d users\n",
>