From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 698093B42CB for ; Wed, 26 Aug 2026 09:08:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787735334; cv=none; b=l0HAr6oYjm0b/Nu0ioF+mjjolZixR8QfhVPp8PZHCwyAqABC2gksM8uaRIPd/irAfRRvi6y/uhW2pU7cp7vNDjx3ZgQWK08hVSvFFCic50/0I25EKnndNeuPrkMI0k7r2FVxEfGNeqPYwG3ez4mWSxHEsxUO1v6KqZRkf+hmKSE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787735334; c=relaxed/simple; bh=J71Rw8rp/R1CpQuUZqlGL/KNAehRlY+Qa59LopVqz94=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=ueGc3ApMb979FcYgteE7USpcHNladyUG0xG3JwjhidC1+KZQWn7IR7KegfZsp/4riLpUyj9x6Go05gomO6NDlWgEbxePopxs+LHB/mH6YcWw5XO+ZXKAb2P55LKFw4ASMj3s/9ZJsvfcIARZgPL8z9jakC50ZOERd6Cz0TUfgZw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dio0J7Vi; arc=none smtp.client-ip=209.85.210.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dio0J7Vi" Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-8520161fdb9so1018118b3a.3 for ; Wed, 26 Aug 2026 02:08:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787735333; x=1788340133; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=wsy4CZwXyrUEQvKaVnRxCtC5ibMuY6bQzne6mmJqiFY=; b=dio0J7ViK8n3SN0lOlUaRIuP8Qtl304JCnNSEymB1mWS/yUQaeG+Yl5ZVG3OTllGja Ze/8I0+0XBlcXDxCY6lxfi+4QkVzwdtmEcmirrU+sWvtok9n1EqtTmdvAz0xmdg67HJ1 DGwilYdae1mNYp5gO3yYF6JfJBf104WR7LRAN74s0bsG3Rr9ZaaCX7+jB9MP3k9ojnVO mBTHPyOi4AUOR+lRkEgk3CcqySIGDWJbRN6T3h0zKEZALp61yYCuEvSU6fkehhf/+hoN I5JAuk/CsX2eMMcw6Gv8bxleS+RTBmi2EUyCl+605qOcDWjtQIbgtgr5fye3AymvWl2w kWMQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787735333; x=1788340133; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=wsy4CZwXyrUEQvKaVnRxCtC5ibMuY6bQzne6mmJqiFY=; b=WoAohT85+LgPVwV4rmD4c1DIpjAKkwqHp6yeE/wgwzOHC+1SD3XMhAWCbUtaXQciob cu9m7IXuV9XaaxSRe0jKvKN/G6ISdBIOEQ4n1oqdRxJMCG9bbCDWnJDiy9XKKNwi4jsO chp8R7wWh7bdDzHeYnh46hl6sAyBH1FxV8SiVNYRS9nBUsJ/1R3iBw5M7R6YKSyVwY4t TERktTlMpMPQ665uAXwtzNIYd2F89GBdEzAVroQ4RY8GWEtwAnBGVq+lVYyVq1fMEAoW CWAzn1NmtQyAOtf1otBJib7I4l5doSKr3Bu1dZQLKAJTO7zn09HPz36OKHFF6gZXohs5 SjFw== X-Forwarded-Encrypted: i=1; AHgh+Rosvc2wsIpRIMgBOWbx700prupuy667X3IFDLKnHH1cG5ASXVphPJmsfptqUgf1wt/6L7a4FXn/plGdzvc=@vger.kernel.org X-Gm-Message-State: AFuF++nmwV4CICoN5drdLBYWzazFNniBlrwhsz3ubpFdoNEqcByfeL+3 GfPUxN9d0Md/coc2d7SJ31LAGkAHSNiecN1EyATRMLztBSGsgZC1Kp8Z X-Gm-Gg: AR+sD11uofVo3RjXOzUr8RSBxiSrFd6/0m0NAILRpzlsjkByrwyipy2BI/og3a398jR RPcgSElgOJQcoQxWuhuE0z8Vx2gsVN0P5z9rX7kouMyYirceXV5CpdceEZ9cYdarZdSAmKR5U75 xBWABHzTFFokVeSDyNcGMQPK7mO5kYX7L7MnxiFFvb8VUtKeUN5JUcSOkq9P0ZDc0qhA8BneWFJ YBr/02NrhEPX0Vj7+lIbRcXOqCjyooe5JAYxuN+m+dz3UkzAJ41V2Ra3TDS3eE5RWwHxRJJUgts lrHFkLcSU8a63C1n2j+tztIud/lq4FUG8TGLHLliLDKRSs2Z6GCzfHU1sweVKFfhJJgUWc4nsqY zrrLNIyo3lBUU1ECuNS6DGKtrdP6vGLheZSlSg4XnbT3Fe29Ma0PmwaPDY6WO1A7D5hJNYDDLF3 E4DLyJhaZNZ4SLvrw12aA5evFIzCdF4l9q0YI3Fv2xFEqo2ovmgSpTFy6ZfO0PPPywzm6zgUs3m b0= X-Received: by 2002:a05:6a00:4149:b0:852:5f99:1866 with SMTP id d2e1a72fcca58-8536e922f5fmr10466435b3a.0.1787735332560; Wed, 26 Aug 2026 02:08:52 -0700 (PDT) Received: from localhost.localdomain ([240e:b8f:1df9:a600:c693:b19f:ada0:748]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8535cd809bdsm669384b3a.28.2026.08.26.02.08.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 26 Aug 2026 02:08:52 -0700 (PDT) Date: Wed, 26 Aug 2026 17:08:44 +0800 From: Vernon Yang To: "David Hildenbrand (Arm)" Cc: akpm@linux-foundation.org, ljs@kernel.org, nico.pache@linux.dev, ryan.roberts@arm.com, dev.jain@arm.com, baohua@kernel.org, lance.yang@linux.dev, usama.arif@linux.dev, zokeefe@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org, Vernon Yang Subject: Re: [PATCH v3 1/3] mm: khugepaged: fix swap entry value to folio_pfn() Message-ID: <50c73754-5e6e-48af-9d8e-148f4596387b@gmail.com> References: <20260824092935.73892-1-vernon2gm@gmail.com> <20260824092935.73892-2-vernon2gm@gmail.com> <6a9c2369-5589-4f2a-bcfe-c6e3b46a1ccd@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Wed, Aug 26, 2026 at 09:57:05AM +0200, David Hildenbrand (Arm) wrote: > On 8/26/26 04:44, Vernon Yang wrote: > > On Mon, Aug 24, 2026 at 01:54:18PM +0200, David Hildenbrand (Arm) wrote: > >> On 8/24/26 11:29, Vernon Yang wrote: > >>> From: Vernon Yang > >>> > >>> When the swap entries found exceed max_ptes_swap, the loop is left via > >>> break with folio still holding the xarray value that encodes the swap > >>> entry, not valid folio pointer. > >>> > >>> That value is passed to trace_mm_khugepaged_scan_file(), which feeds it > >>> to folio_pfn(). On FLATMEM and SPARSEMEM_VMEMMAP, the page_to_pfn() is > >>> plain pointer arithmetic, so the trace event merely prints bogus > >>> scan_pfn. On classic SPARSEMEM, the page_to_pfn() reads page->flags, > >>> dereferencing the tiny encoded integer and oopsing khugepaged whenever > >>> the trace event is enabled. > >>> > >>> So when folio is the swap entry value, simply set pfn to -1, just like > >>> exhausted scan naturally. > >>> > >>> And the folio_put() has maybe dropped the last reference of folio. The > >>> trace_mm_khugepaged_scan_file() is left with a dangling folio pointer. > >>> so using the folio_pfn() before dropping the reference, closing > >>> use-after-free window. > >>> > >>> Fixes: d41fd2016ed0 ("mm/khugepaged: add tracepoint to hpage_collapse_scan_file()") > >>> Cc: stable@vger.kernel.org > >>> Signed-off-by: Vernon Yang > >>> --- > >>> include/trace/events/huge_memory.h | 6 +++--- > >>> mm/khugepaged.c | 5 ++++- > >>> 2 files changed, 7 insertions(+), 4 deletions(-) > >>> > >>> diff --git a/include/trace/events/huge_memory.h b/include/trace/events/huge_memory.h > >>> index 5a48c5406cce..7b526528f85b 100644 > >>> --- a/include/trace/events/huge_memory.h > >>> +++ b/include/trace/events/huge_memory.h > >>> @@ -178,10 +178,10 @@ TRACE_EVENT(mm_collapse_huge_page_swapin, > >>> > >>> TRACE_EVENT(mm_khugepaged_scan_file, > >>> > >>> - TP_PROTO(struct mm_struct *mm, struct folio *folio, struct file *file, > >>> + TP_PROTO(struct mm_struct *mm, unsigned long pfn, struct file *file, > >>> int present, int swap, int result), > >>> > >>> - TP_ARGS(mm, folio, file, present, swap, result), > >>> + TP_ARGS(mm, pfn, file, present, swap, result), > >>> > >>> TP_STRUCT__entry( > >>> __field(struct mm_struct *, mm) > >>> @@ -194,7 +194,7 @@ TRACE_EVENT(mm_khugepaged_scan_file, > >>> > >>> TP_fast_assign( > >>> __entry->mm = mm; > >>> - __entry->pfn = folio ? folio_pfn(folio) : -1; > >>> + __entry->pfn = pfn; > >>> __assign_str(filename); > >>> __entry->present = present; > >>> __entry->swap = swap; > >>> diff --git a/mm/khugepaged.c b/mm/khugepaged.c > >>> index 79effd3f3da4..00337405c0e0 100644 > >>> --- a/mm/khugepaged.c > >>> +++ b/mm/khugepaged.c > >>> @@ -2689,6 +2689,7 @@ static enum scan_result collapse_scan_file(struct mm_struct *mm, > >>> int present, swap; > >>> int node = NUMA_NO_NODE; > >>> enum scan_result result = SCAN_SUCCEED; > >>> + unsigned long pfn; > >>> > >>> present = 0; > >>> swap = 0; > >>> @@ -2719,6 +2720,7 @@ static enum scan_result collapse_scan_file(struct mm_struct *mm, > >>> continue; > >>> } > >>> > >>> + pfn = folio_pfn(folio); > >>> if (is_pmd_order(folio_order(folio))) { > >>> result = SCAN_PTE_MAPPED_HUGEPAGE; > >>> /* > >>> @@ -2779,7 +2781,8 @@ static enum scan_result collapse_scan_file(struct mm_struct *mm, > >>> } > >>> } > >>> > >>> - trace_mm_khugepaged_scan_file(mm, folio, file, present, swap, result); > >>> + trace_mm_khugepaged_scan_file(mm, (!folio || xa_is_value(folio)) ? -1 : pfn, > >>> + file, present, swap, result); > >>> return result; > >>> } > >>> > >> > >> Shouldn't we just reset PFN to -1 at the beginning of the loop (and set it > >> initially)? > > > > When the `xas_for_each()` iteration to terminate and the folio operation > > preceding is normal, but pfn will be incorrect. > > The PFN is only relevant when a folio participated in the failure. Maybe the > following would be cleanest? Yes, this is clearer. I considered this approach before, but it would be quite verbose. LGTM, I will use this in the next version. Thanks! > diff --git a/mm/khugepaged.c b/mm/khugepaged.c > index 75639298efc27..371ee0b16d10c 100644 > --- a/mm/khugepaged.c > +++ b/mm/khugepaged.c > @@ -2683,6 +2683,7 @@ static enum scan_result collapse_scan_file(struct > mm_struct *mm, > int present, swap; > int node = NUMA_NO_NODE; > enum scan_result result = SCAN_SUCCEED; > + unsigned long problematic_pfn = -1; > > present = 0; > swap = 0; > @@ -2714,6 +2715,7 @@ static enum scan_result collapse_scan_file(struct > mm_struct *mm, > } > > if (is_pmd_order(folio_order(folio))) { > + problematic_pfn = folio_pfn(folio); > result = SCAN_PTE_MAPPED_HUGEPAGE; > /* > * PMD-sized THP implies that we can only try > @@ -2725,6 +2727,7 @@ static enum scan_result collapse_scan_file(struct > mm_struct *mm, > > node = folio_nid(folio); > if (collapse_scan_abort(node, cc)) { > + problematic_pfn = folio_pfn(folio); > result = SCAN_SCAN_ABORT; > folio_put(folio); > break; > @@ -2732,12 +2735,14 @@ static enum scan_result collapse_scan_file(struct > mm_struct *mm, > cc->node_load[node]++; > > if (!folio_test_lru(folio)) { > + problematic_pfn = folio_pfn(folio); > result = SCAN_PAGE_LRU; > folio_put(folio); > break; > } > > if (folio_expected_ref_count(folio) + 1 != folio_ref_count(folio)) { > + problematic_pfn = folio_pfn(folio); > result = SCAN_PAGE_COUNT; > folio_put(folio); > break; > @@ -2773,7 +2778,7 @@ static enum scan_result collapse_scan_file(struct > mm_struct *mm, > } > } > > - trace_mm_khugepaged_scan_file(mm, folio, file, present, swap, result); > + trace_mm_khugepaged_scan_file(mm, problematic_pfn, file, present, swap, > result); > return result; > } > > > > -- > Cheers, > > David >