linux-kernel - [PATCH V2] mm/memory-failure: Ensure collect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <tencent_EDEED996FC685E61AADA14A23BCE9CCDAF09@qq.com>
Date: Tue, 23 Sep 2025 22:57:09 +0800
From: "shengminghu512" <shengminghu512@...com>
To: "linmiaohe" <linmiaohe@...wei.com>, "nao.horiguchi" <nao.horiguchi@...il.com>, "akpm" <akpm@...ux-foundation.org>
Cc: "linux-mm" <linux-mm@...ck.org>, "linux-kernel" <linux-kernel@...r.kernel.org>, "hu.shengming" <hu.shengming@....com.cn>, "shengminghu512" <shengminghu512@...com>, "zhang.run" <zhang.run@....com.cn>
Subject: [PATCH V2] mm/memory-failure: Ensure collect_procs is retried when  unmap fails

From: Shengming Hu <shengminghu512@...com>
Date: Tue, 23 Sep 2025 20:56:28 +0800
Subject: [PATCH V2] mm/memory-failure: Ensure collect_procs is retried when
 unmap fails

In the memory_failure process, if collect_procs is not executed with the
flag set, the to_kill list may be empty. Even if there are pages that fail
to be unmapped, SIGKILL or SIGBUS cannot be sent to the process via
collect_procs.

This patch fixes the issue by re-executing collect_procs when the to_kill
list is empty and unmap fails. This collects processes with unmap failures
into the to_kill list, allowing SIGBUS or SIGKILL to terminate them in
subsequent code.

V2:
  - Resent as plain text (previous version was HTML).
  - No functional changes.

Signed-off-by: Shengming Hu <hu.shengming@....com.cn>
---
 mm/memory-failure.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index a24806bb8e82..8157823c7fb7 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1600,9 +1600,12 @@ static bool hwpoison_user_mappings(struct folio *folio, struct page *p,
 	collect_procs(folio, p, &tokill, flags & MF_ACTION_REQUIRED);
 
 	unmap_success = !unmap_poisoned_folio(folio, pfn, flags & MF_MUST_KILL);
-	if (!unmap_success)
+	if (!unmap_success) {
 		pr_err("%#lx: failed to unmap page (folio mapcount=%d)\n",
 		       pfn, folio_mapcount(folio));
+		if (list_empty(&tokill))
+			collect_procs(folio, p, &tokill, 1);
+	}
 
 	/*
 	 * try_to_unmap() might put mlocked page in lru cache, so call
-- 
2.25.1