From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756718Ab2K0VGR (ORCPT ); Tue, 27 Nov 2012 16:06:17 -0500 Received: from mx1.redhat.com ([209.132.183.28]:18059 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753711Ab2K0VGQ (ORCPT ); Tue, 27 Nov 2012 16:06:16 -0500 From: Naoya Horiguchi To: Andrew Morton Cc: Tony Luck , Andi Kleen , Wu Fengguang , linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH] mm, soft offline: split thp at the beginning of soft_offline_page() Date: Tue, 27 Nov 2012 16:05:31 -0500 Message-Id: <1354050331-26844-1-git-send-email-n-horiguchi@ah.jp.nec.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When we try to soft-offline a thp tail page, put_page() is called on the tail page unthinkingly and VM_BUG_ON is triggered in put_compound_page(). This patch splits thp before going into the main body of soft-offlining. The interface of soft-offlining is open for userspace, so this bug can lead to DoS attack and should be fixed immedately. Signed-off-by: Naoya Horiguchi Cc: stable@vger.kernel.org --- mm/memory-failure.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git v3.7-rc7.orig/mm/memory-failure.c v3.7-rc7/mm/memory-failure.c index 8fe3640..e48e235 100644 --- v3.7-rc7.orig/mm/memory-failure.c +++ v3.7-rc7/mm/memory-failure.c @@ -1548,9 +1548,17 @@ int soft_offline_page(struct page *page, int flags) { int ret; unsigned long pfn = page_to_pfn(page); + struct page *hpage = compound_trans_head(page); if (PageHuge(page)) return soft_offline_huge_page(page, flags); + if (PageTransHuge(hpage)) { + if (PageAnon(hpage) && unlikely(split_huge_page(hpage))) { + pr_info("soft offline: %#lx: failed to split THP\n", + pfn); + return -EBUSY; + } + } ret = get_any_page(page, pfn, flags); if (ret < 0) -- 1.7.11.7