linux-kernel - Re: [PATCH] mm/huge_memory: fix dereferencing invalid pmd migration entry

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <95e543dd-6b93-9507-d383-1ae91e2e6640@google.com>
Date: Wed, 16 Apr 2025 22:29:56 -0700 (PDT)
From: Hugh Dickins <hughd@...gle.com>
To: Zi Yan <ziy@...dia.com>
cc: Gavin Guo <gavinguo@...lia.com>, linux-mm@...ck.org, 
    akpm@...ux-foundation.org, willy@...radead.org, linmiaohe@...wei.com, 
    hughd@...gle.com, revest@...gle.com, david@...hat.com, 
    kernel-dev@...lia.com, linux-kernel@...r.kernel.org, 
    Naoya Horiguchi <n-horiguchi@...jp.nec.com>
Subject: Re: [PATCH] mm/huge_memory: fix dereferencing invalid pmd migration
 entry

On Tue, 15 Apr 2025, Zi Yan wrote:
> 
> Anyway, we need to figure out why both THP migration and deferred_split_scan()
> hold the THP lock first, which sounds impossible to me. Or some other execution
> interleaving is happening.

I think perhaps you're missing that an anon_vma lookup points to a
location which may contain the folio of interest, but might instead
contain another folio: and weeding out those other folios is precisely
what the "folio != pmd_folio((*pmd)" check (and the "risk of replacing
the wrong folio" comment a few lines above it) is for.

The "BUG: unable to handle page fault" comes about because that other
folio might actually be being migrated at this time, so we encounter
a PMD migration entry instead of a valid PMD entry.  But if it's the
folio we're looking for, our folio lock excludes a racing migration,
so it would never be a PMD migration entry for our folio.

Hugh