linux-kernel - [RFC PATCH v1 2/2] mm/hugetlb: immature fix to handle HWPoisoned folio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250119180608.2132296-3-jiaqiyan@google.com>
Date: Sun, 19 Jan 2025 18:06:08 +0000
From: Jiaqi Yan <jiaqiyan@...gle.com>
To: nao.horiguchi@...il.com, linmiaohe@...wei.com, sidhartha.kumar@...cle.com, 
	muchun.song@...ux.dev
Cc: jane.chu@...cle.com, akpm@...ux-foundation.org, osalvador@...e.de, 
	rientjes@...gle.com, jthoughton@...gle.com, linux-mm@...ck.org, 
	linux-kernel@...r.kernel.org, Jiaqi Yan <jiaqiyan@...gle.com>
Subject: [RFC PATCH v1 2/2] mm/hugetlb: immature fix to handle HWPoisoned folio

The fix has two steps
1. Decrement HWPoison HugeTLB huge folio's refcount when it is 1. It is
   done in folios_put_refs during truncating or eviting HugeTLB file.
2. Dissolve HugeTLB HWpoison folio in free_huge_folio.

Again, just for demo purpose, not a proper fix, especially step 1.

Signed-off-by: Jiaqi Yan <jiaqiyan@...gle.com>
---
 mm/hugetlb.c | 6 ++++++
 mm/swap.c    | 9 ++++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 87761b042ed04..b28e0bc7f199f 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1818,6 +1818,7 @@ void free_huge_folio(struct folio *folio)
 	int nid = folio_nid(folio);
 	struct hugepage_subpool *spool = hugetlb_folio_subpool(folio);
 	bool restore_reserve;
+	bool hwpoison = folio_test_hwpoison(folio);
 	unsigned long flags;
 
 	VM_BUG_ON_FOLIO(folio_ref_count(folio), folio);
@@ -1869,6 +1870,11 @@ void free_huge_folio(struct folio *folio)
 		remove_hugetlb_folio(h, folio, true);
 		spin_unlock_irqrestore(&hugetlb_lock, flags);
 		update_and_free_hugetlb_folio(h, folio, true);
+	} else if (hwpoison) {
+		remove_hugetlb_folio(h, folio, false);
+		h->max_huge_pages--;
+		spin_unlock_irqrestore(&hugetlb_lock, flags);
+		update_and_free_hugetlb_folio(h, folio, true);
 	} else {
 		arch_clear_hugetlb_flags(folio);
 		enqueue_hugetlb_folio(h, folio);
diff --git a/mm/swap.c b/mm/swap.c
index 746a5ceba42c9..d6b4d4cb4004f 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -961,7 +961,14 @@ void folios_put_refs(struct folio_batch *folios, unsigned int *refs)
 			continue;
 		}
 
-		if (!folio_ref_sub_and_test(folio, nr_refs))
+		folio_ref_sub(folio, nr_refs);
+
+		if (folio_test_hugetlb(folio) &&
+		    folio_ref_count(folio) == 1 &&
+		    folio_test_hwpoison(folio))
+			folio_ref_dec(folio);
+
+		if (folio_ref_count(folio) > 0)
 			continue;
 
 		/* hugetlb has its own memcg */
-- 
2.48.0.rc2.279.g1de40edade-goog