From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-118.freemail.mail.aliyun.com (out30-118.freemail.mail.aliyun.com [115.124.30.118]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 474DD2405EB for ; Mon, 17 Aug 2026 02:25:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.118 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786933558; cv=none; b=Nr47pvYineZeCnaL3ahwpQZwjo89cki9vvKLrzoxLqOj12Jow3jcwSho3NXnOuttTUiFNRPD2sjkhK+ri2/iJXgDHq6xF+WG5hLphjvZT7jIKNSj4yOXiKtoANFfdRXiIWudkJ+Y2X6eEAoSQgvHZDt9TEmILZTdpYEIcednE6E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786933558; c=relaxed/simple; bh=p5+CPf8Te5gczbvBqVOqKBnQW09dAmOveDZRKXd7MII=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=AekJogMm9ndVAGIiVLc+kcL/v6pi51oUqBX8Hd3Qudh3fZdOMSQacArrAlI8Hc7Mk3tiyLT/VZpmBkIfLI8762EikK1ahAx4+x6ddWxNbEiUlZWJJS3gSWv1DHxqggiHi/eASejRHs+OFkdaDUYV3kh9YSC1RnUV3Ki9HNJ2QZc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=jtswxlDC; arc=none smtp.client-ip=115.124.30.118 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="jtswxlDC" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1786933545; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=WfjW84M8GBMQrv2tnueF8p968fdREO0psJ4VmpyrVQE=; b=jtswxlDCfASdZ24lcWlCDaQOIFbV3ZIiEKToCv51zJvziEN1HzRvAEcWiRZydQEY+JY2QcFRfTl4tjorWCcM5tDS2+rSu0WwNR6lQaoPS6na5fEFT5/xMguLZCDViqSx1Sm+CPx99I08EzghTvfPjTwBV5QsfO0V27S24/XdIvo= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R811e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033045098064;MF=baolin.wang@linux.alibaba.com;NM=1;PH=DS;RN=13;SR=0;TI=SMTPD_---0X91E0N5_1786933544; Received: from 30.74.144.121(mailfrom:baolin.wang@linux.alibaba.com fp:SMTPD_---0X91E0N5_1786933544 cluster:ay36) by smtp.aliyun-inc.com; Mon, 17 Aug 2026 10:25:45 +0800 Message-ID: <0c4125f4-fbaa-43ad-9cc6-b9c5ae4af89f@linux.alibaba.com> Date: Mon, 17 Aug 2026 10:25:44 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2 0/3] mm: khugepaged: fix tracepoint UAF To: Lance Yang Cc: vernon2gm@gmail.com, akpm@linux-foundation.org, david@kernel.org, ljs@kernel.org, nico.pache@linux.dev, ryan.roberts@arm.com, dev.jain@arm.com, baohua@kernel.org, usama.arif@linux.dev, zokeefe@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org References: <20260815174444.4164-1-lance.yang@linux.dev> <20260815181632.21453-1-lance.yang@linux.dev> From: Baolin Wang In-Reply-To: <20260815181632.21453-1-lance.yang@linux.dev> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Hi Lance, On 8/16/26 2:16 AM, Lance Yang wrote: > +Cc Baolin > > On Sun, Aug 16, 2026 at 01:44:44AM +0800, Lance Yang wrote: >> >> On Sat, Aug 15, 2026 at 01:19:21PM +0800, Vernon Yang wrote: >>> From: Vernon Yang >>> >>> The khugepaged tracepoints take a folio pointer and call folio_pfn(), >>> but by then the folio may no longer be valid: freed after folio_put(), >>> folio_unlock() or pte_unmap_unlock(), or not a folio at all but an >>> xarray-encoded swap entry. On classic SPARSEMEM, dereferencing it oopses >>> khugepaged as soon as the trace event is enabled; on other memory models >>> it merely prints a bogus pfn. >>> >>> Pass the pfn to the tracepoints directly, captured while the folio is >>> still pinned, closing the use-after-free windows in >>> mm_khugepaged_scan_file(), mm_khugepaged_scan_pmd() and >>> mm_khugepaged_collapse_file(). >> >> Well spotted! >> >> Gave the series a run on x86_64 (KVM), all good (only classic SPARSEMEM >> untested) :) > > Hmm ... stumbled over something else while testing this ... > > With tmpfs mounted huge=advise, one MADV_HUGEPAGE isn't enough to get > an unregistered mm onto khugepaged's list. Do it twice, and khugepaged > starts scanning right away. > > The pending flags make it into khugepaged just fine: > > int hugepage_madvise(struct vm_area_struct *vma, > vm_flags_t *vm_flags, int advice) > { > switch (advice) { > case MADV_HUGEPAGE: > *vm_flags &= ~VM_NOHUGEPAGE; > *vm_flags |= VM_HUGEPAGE; > ... > khugepaged_enter_vma(vma, *vm_flags); > break; > ... > } > > return 0; > } > > and survive the common eligibility check: > > unsigned long __thp_vma_allowable_orders(struct vm_area_struct *vma, > vm_flags_t vm_flags, > enum tva_type type, > unsigned long orders) > { > ... > /* > * Enabled via shmem mount options or sysfs settings. > * Must be done before hugepage flags check since shmem has its > * own flags. > */ > if (!in_pf && shmem_file(vma->vm_file)) > return orders & shmem_allowable_huge_orders(file_inode(vma->vm_file), > vma, vma_start_pgoff(vma), 0, > forced_collapse); > ... > } > > But then the shmem helper reads them back from the VMA: > > unsigned long shmem_allowable_huge_orders(struct inode *inode, > struct vm_area_struct *vma, pgoff_t index, > loff_t write_end, bool shmem_huge_force) > { > ... > vm_flags_t vm_flags = vma ? vma->vm_flags : 0; > ... > } > > At that point vma->vm_flags still has the old value, so huge=advise > quietly gives us no allowable order. > > First madvise still succeeds, of course. The second one works because it > finds VM_HUGEPAGE already installed by the first call. > > Looked at history too ... we've been here before. 2cf1338454a8 ("mm: fix > khugepaged with shmem_enabled=advise") fixed this exact ordering bug and > tagged cd89fb065099 as the culprit. Then 6beeab870e70 was meant to be > "No functional changes", but moving shmem_huge_global_enabled() into > shmem_allowable_huge_orders() seems to have wired the stale vma->vm_flags > read back in. > > So AFAICT, this regressed in v6.12 with 6beeab870e70. > > @Baolin, does that ring a bell? Any reason shmem_allowable_huge_orders() > can't just take the pending vm_flags as well? Good catch. Sorry for my mistake. Would you like to send a fix? Otherwise, I can fix it. Thanks for your report and analysis.