From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0D2622C11E2 for ; Sat, 23 May 2026 03:50:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779508244; cv=none; b=Uou4GQINF+qG4ud0av2MxrKfjaprF6yoi/KHXgGm51eCWdARZzhjJ54/Udu7fAW8TYo8TWZO1/AWDl46euMgENKV8BUGShAuc9LMxquuVwZviRrASWG910SHIcBStTmZOukaqqE5QPSDGAkb/st5UMa0H1erMsjjNoZc4I0KkfY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779508244; c=relaxed/simple; bh=oOF8j+gVhMVhx5+dlvuSo9S2ZBFvNzy4O3Dhdx6YFv8=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=KypDfayiQb5CMZzsERdB2E6F11c0cqehYB1sH1bp7kxZ8mHxqqpEwJb91jd60YHp9WJr4j4Xs9RKB92sdZbg3dBenrc0iyikNWKKKEF5xI3U4cdrzTZlM/7LWaUF1I1aUHVqFlOVWJITFhXrwkOaALX29XgGr6h4/yYOAwtuOGU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=TSkBVRf1; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="TSkBVRf1" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 420F11F000E9; Sat, 23 May 2026 03:50:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1779508242; bh=ANd8XjbmBFe5KABDeJm0oSjcuQYcsksOmyFJnc/iJmQ=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=TSkBVRf1BLibispKAaE/lAtO9RdSMBWxhBG/oljs6ScFAE3P6NI9vu0FKf/o8Fh51 8tNtyejcQ1vsExes20KUxbEXVTBncLKLonZHJsx9uo+XXJHXPVKlZlTBt5KfUjZflJ 5paKNWdNx8zIZUN0hGe6rQQsS7onBORm12gVxlg0= Date: Fri, 22 May 2026 20:50:41 -0700 From: Andrew Morton To: Wupeng Ma Cc: , , , , , , , , , , , , Subject: Re: [PATCH resend] mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison Message-Id: <20260522205041.a85237b104d74533c13745e4@linux-foundation.org> In-Reply-To: <20260522010305.4099834-1-mawupeng1@huawei.com> References: <20260522010305.4099834-1-mawupeng1@huawei.com> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Fri, 22 May 2026 09:03:05 +0800 Wupeng Ma wrote: > Two concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page > can trigger a recursive spinlock self-deadlock (AA deadlock) on > hugetlb_lock when racing with a concurrent unmap: Well we don't want that. > Fixes: 405ce051236c ("mm/hwpoison: fix race between hugetlb free/demotion and memory_failure_hugetlb()") So I'll add cc:stable here. AI review didn't like the unlocked page_folio(): https://sashiko.dev/#/patchset/20260522010305.4099834-1-mawupeng1@huawei.com So I'll add a followup patch which addresses that (and which addresses Miaohe's naming nit). Please let's check this - perhaps the locking alteration isn't needed. From: Andrew Morton Subject: mm-memory-failure-fix-hugetlb_lock-aa-deadlock-in-get_huge_page_for_hwpoison-fix Date: Fri May 22 08:44:25 PM PDT 2026 - address possible race identified by Sashiko - s/out/out_unlock/, per Miaohe Link: https://sashiko.dev/#/patchset/20260522010305.4099834-1-mawupeng1@huawei.com Link: https://lore.kernel.org/f39f405e-4b4b-8f79-70fe-a2b5b62114eb@huawei.com Cc: David Hildenbrand Cc: Kefeng Wang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Naoya Horiguchi Cc: Oscar Salvador (SUSE) Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Wupeng Ma Signed-off-by: Andrew Morton --- mm/memory-failure.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/mm/memory-failure.c~mm-memory-failure-fix-hugetlb_lock-aa-deadlock-in-get_huge_page_for_hwpoison-fix +++ a/mm/memory-failure.c @@ -1970,14 +1970,15 @@ static int get_huge_page_for_hwpoison(un bool *migratable_cleared) { struct page *page = pfn_to_page(pfn); - struct folio *folio = page_folio(page); + struct folio *folio; bool count_increased = false; int ret, rc; spin_lock_irq(&hugetlb_lock); + folio = page_folio(page); if (!folio_test_hugetlb(folio)) { ret = MF_HUGETLB_NON_HUGEPAGE; - goto out; + goto out_unlock; } else if (flags & MF_COUNT_INCREASED) { ret = MF_HUGETLB_IN_USED; count_increased = true; @@ -1993,13 +1994,13 @@ static int get_huge_page_for_hwpoison(un } else { ret = MF_HUGETLB_RETRY; if (!(flags & MF_NO_RETRY)) - goto out; + goto out_unlock; } rc = hugetlb_update_hwpoison(folio, page); if (rc >= MF_HUGETLB_FOLIO_PRE_POISONED) { ret = rc; - goto out; + goto out_unlock; } /* @@ -2013,7 +2014,7 @@ static int get_huge_page_for_hwpoison(un spin_unlock_irq(&hugetlb_lock); return ret; -out: +out_unlock: spin_unlock_irq(&hugetlb_lock); if (count_increased) folio_put(folio); _