linux-kernel - [PATCH] mm, hugetlb: Reset mapping to TAIL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250415054705.370412-1-osalvador@suse.de>
Date: Tue, 15 Apr 2025 07:47:05 +0200
From: Oscar Salvador <osalvador@...e.de>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: Muchun Song <muchun.song@...ux.dev>,
	David Hildenbrand <david@...hat.com>,
	linux-mm@...ck.org,
	linux-kernel@...r.kernel.org,
	Vlastimil Babka <vbabka@...e.cz>,
	Matthew Wilcox <willy@...radead.org>,
	Oscar Salvador <osalvador@...e.de>
Subject: [PATCH] mm, hugetlb: Reset mapping to TAIL_MAPPING before restoring vmemmap

commit 4eeec8c89a0c ("mm: move hugetlb specific things in folio to page[3]")
shifted hugetlb specific stuff, and now mapping overlaps _hugetlb_cgroup field.

_hugetlb_cgroup is set to NULL when preparing the hugetlb page in
init_new_hugetlb_folio().
For a better picture, this is page->mapping before and after the comming
for the first three tail pages:

before:
page: fffff51a44358040  0000000000000000
page: fffff51a44358080  0000000000000000
page: fffff51a443580c0  dead000000000400

after:
page: fffff1f0042b0040  0000000000000000
page: fffff1f0042b0080  fffff1f0042b0090
page: fffff1f0042b00c0  0000000000000000

Tail#2 has fffff1f0042b0090 because of the _deferred_list initialization,
which was also shifted, but that is not a problem.

For HVO, upon restoring that gets copied in some tail pages (reset_struct_pages)
and so those tail pages will not have TAIL_MAPPING set and the check
in free_tail_page_prepare() will fail:

 kernel: BUG: Bad page state in process kworker/0:3  pfn:10ac40
 kernel: page does not match folio
 kernel: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10ac40
 kernel: flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)
 kernel: raw: 0017ffffc0000000 fffff1f0042b0000 0000000000000000 0000000000000000
 kernel: raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
 kernel: page dumped because: corrupted mapping in tail page

Reset _hugetlb_cgroup to TAIL_MAPPING before restoring so tail pages have the
right value.

Signed-off-by: Oscar Salvador <osalvador@...e.de>
---
Hi guys,

Although I can no longer reproduce the issue with this patch, I'm not entirely
sure this is the right way to fix the problem, so I'm open to
suggestions.
---
 mm/hugetlb_vmemmap.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c
index 9a99dfa3c495..3d763182c834 100644
--- a/mm/hugetlb_vmemmap.c
+++ b/mm/hugetlb_vmemmap.c
@@ -498,6 +498,12 @@ static int __hugetlb_vmemmap_restore_folio(const struct hstate *h,
  */
 int hugetlb_vmemmap_restore_folio(const struct hstate *h, struct folio *folio)
 {
+	/*
+	 * Before restoring vmemmap, make sure to reset mapping to TAIL_MAPPING,
+	 * so tail pages that were reset will have the right thing after being
+	 * restored, and the checks in free_tail_page_prepare() will pass.
+	 */
+	set_hugetlb_cgroup(folio, TAIL_MAPPING);
 	return __hugetlb_vmemmap_restore_folio(h, folio, VMEMMAP_SYNCHRONIZE_RCU);
 }
 
-- 
2.49.0