linux-kernel - Re: [PATCH] mm/page_alloc: Fix freeing of failed-split poisoned compound pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3ec3f4de-2c38-5ec4-4b4a-d7a801efe558@huawei.com>
Date: Wed, 28 Jan 2026 10:45:20 +0800
From: Miaohe Lin <linmiaohe@...wei.com>
To: Jiaqi Yan <jiaqiyan@...gle.com>, Boudewijn van der Heide
	<boudewijn@...ta-utec.com>, <ziy@...dia.com>
CC: <akpm@...ux-foundation.org>, <hannes@...xchg.org>, <jackmanb@...gle.com>,
	<linux-kernel@...r.kernel.org>, <linux-mm@...ck.org>, <mhocko@...e.com>,
	<nao.horiguchi@...il.com>, <osalvador@...e.de>, <surenb@...gle.com>,
	<vbabka@...e.cz>
Subject: Re: [PATCH] mm/page_alloc: Fix freeing of failed-split poisoned
 compound pages

On 2026/1/24 12:42, Jiaqi Yan wrote:
> On Fri, Jan 16, 2026 at 6:12 AM Boudewijn van der Heide
> <boudewijn@...ta-utec.com> wrote:
>>
>> Thanks Jiaqi for the feedback, that is very helpful.
>> (and thanks Miaohe for connecting the issues.)
>>
>> After going through the memory_failure(),
>> I can see it indeed puts the PG_HWPoison flag on the specific subpage pointer,
>> and therefore my fix won't work as-is.
>>
>>>>
>>>> Yes, this is also a problematic scenario for Hugetlb HugePage. And Jiaqi works on
>>>> it now [1]. I think Jiaqi's patches might apply to THP scenario too. Add @Jiaqi to
>>>> verify this.
>>>
>>> Yep, I think my work will also help solve the concern when
>>> try_to_split_thp_page() fails.
>>
>> Your fix makes a lot of sense for hugetlb,
>> as it linearly scans through all the pages.
>> From my understanding,
>> your fix also provides the perfect architecture for also checking THP,
>> though it doesn't yet cover the in-use THP case outlined.
> 
> Oh, sorry I went ahead myself and assumed the split-failed folio would
> eventually be released to the buddy allocator at some point when
> userspace processes who owns/maps this THP are killed or exited.
> 
> Zi and Miaohe, am I right about this? or do we need explicitly handle
> in-use and split-failed THP?

IMHO, it's enough to handle poisoned sub-pages when in-use or split-failed THP
eventually be released to the buddy.

Thanks.
.