From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D6F3048382F for ; Wed, 5 Aug 2026 16:27:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785947280; cv=none; b=hdtrXUsBihTBLYW4Mwjn0xUIJvGlDDcxzSh/W6CU9NExsD4WsDTcklRqfZN2Aqug6M0EOm1J41le4MzjcKDgWV3sV71gaO/TKth5vF/1PD35v4cqK4okm/mDO/7GG/rm2iKpVaxnhHLvq8xK9dx/As8yFAQ0SM4L+vEHgtvwhX0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785947280; c=relaxed/simple; bh=n9vMBf0UGsL8ND10cOOpX152Pq2cgE8psWYCEn5Vh10=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=p8gYUw/U3+ziD6EOttcfWKwYtHeeTGdK8jFk2a6qQHkdtCv557ridE5V8AXQm8Z4o/zUCQ4KD6fMPDScm2hRW7ALZ+ykZkN6igebYQyWIPxkoj05ZcLQIsYWW0Iil3t34mOcoWPvyrohECBIVLX7+5hWxbZl9jNGALNBKVVRJkU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=mFdanjjY; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="mFdanjjY" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 098BB1F000E9; Wed, 5 Aug 2026 16:27:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1785947276; bh=gcjdpcvuSBVyPfDvA9h6SvDPo3TBbgRAWLcSklwC0PA=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=mFdanjjY4+L1b6Jc7V+v5oQLMPvGxoVZrzBXVHFQb56qYB1IZ/PYRlcpRY3InWwJl gkat7L75KKcyABsb1WmyAKTHmsybzsEBuVPR9LLszpSRn0udYicjjlihmMfSxGxKKF jhsZ7fjGGcCjC3sZGfZGF7TUzmhghfeS8eGGFkvNkYdH0JtwiBrumJH32qVwWNwO2Q rht3aBzwR07eweIxhVtxbTz95/bsn6SJSEIypLpL/4bZwRfc+E/2NlkK9eK7WAvICS rCj8DtyKgZMtqqcfZ2ay96x6Hff+W8rv/F4feec7IcDwXo7tB4DUPTXAJfB1Dzldxc UfpzCGCnE4N1g== Date: Wed, 5 Aug 2026 17:27:40 +0100 From: "Lorenzo Stoakes (ARM)" To: Longlong Xia Cc: "David Hildenbrand (Arm)" , akpm@linux-foundation.org, xu.xin16@zte.com.cn, chengming.zhou@linux.dev, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Longlong Xia Subject: Re: [PATCH 1/1] mm/ksm: validate KSM rmap items before hwpoison kill Message-ID: References: <20260803151151.3472893-1-xialonglong2025@163.com> <72f017f2-89c5-4e4a-9ce3-ab79f70b04a0@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: On Thu, Aug 06, 2026 at 12:21:24AM +0800, Longlong Xia wrote: >   Hi David, > >   Thanks for the review and for suggesting this approach. > >   I will send v2 shortly with your Suggested-by tag. Hang on :) I wanted to look at this (always better to wait at least a day before respins in general). > >   Thanks, >   Longlong > > 在 2026/8/5 20:19, David Hildenbrand (Arm) 写道: > > On 8/3/26 17:11, Longlong Xia wrote: > > > From: Longlong Xia > > > > > > collect_procs_ksm() walks the stable-node rmap list and queues an > > > early kill for every task whose mm appears on the anon_vma chain. > > > > > > That rmap item can be stale by the time memory failure handles the > > > poisoned KSM page. A VMA may have been split, unmapped or remapped > > > after the rmap item was recorded, so matching only vma->vm_mm can send > > > SIGBUS with an address that no longer maps the poisoned page. > > > > > > Check that the saved address still belongs to the VMA and that > > > page_vma_mapped_walk() still finds the poisoned page there before > > > adding the task to the kill list. > > > > > > Fixes: 4248d0083ec5 ("mm: ksm: support hwpoison for ksm page") > > > Signed-off-by: Longlong Xia > > > --- > > > mm/ksm.c | 27 +++++++++++++++++++++++++-- > > > 1 file changed, 25 insertions(+), 2 deletions(-) > > > > > > diff --git a/mm/ksm.c b/mm/ksm.c > > > index 7d5b76478f0b..bc4b2dd894d8 100644 > > > --- a/mm/ksm.c > > > +++ b/mm/ksm.c > > > @@ -3222,6 +3222,27 @@ void rmap_walk_ksm(struct folio *folio, struct rmap_walk_control *rwc) > > > } > > > #ifdef CONFIG_MEMORY_FAILURE > > > +static bool ksm_rmap_item_mapped(const struct page *page, > > > + struct vm_area_struct *vma, > > > + unsigned long addr) > > Two tab indent on second parameter line > > > > struct vm_area_struct *vma, unsigned long addr) > > > > > +{ > > > + struct page_vma_mapped_walk pvmw = { > > > + .pfn = page_to_pfn(page), > > > + .nr_pages = 1, > > > + .vma = vma, > > > + .address = addr, > > > + .flags = PVMW_SYNC, > > > + }; > > > + > > > + if (addr < vma->vm_start || addr >= vma->vm_end) > > > + return false; > > > + if (!page_vma_mapped_walk(&pvmw)) > > > + return false; > > > + page_vma_mapped_walk_done(&pvmw); > > > + > > We have page_mapped_in_vma(). So I wonder whether we can find a way to > > > > 1) Modify to just work with KSM (CCing Lorenzo) > > > > Maybe it already does. I'm confused as so often. > > > > Looking at the existing caller collect_procs_anon(), it's really only called > > on anon folios. Could it already be called on KSM folios? What would happen > > in that case? (does it just work because folio->index is still what we expect) > > > > 2) Do the following > > > > diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c > > index d7670ba4147bf..7eeb3c336cfe9 100644 > > --- a/mm/page_vma_mapped.c > > +++ b/mm/page_vma_mapped.c > > @@ -342,6 +342,27 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw) > > } > > #ifdef CONFIG_MEMORY_FAILURE > > +static unsigned long page_mapped_in_vma_at_address(const struct page *page, > > + struct vm_area_struct *vma, unsigned long addr) > > +{ > > + const struct folio *folio = page_folio(page); > > + struct page_vma_mapped_walk pvmw = { > > + .pfn = page_to_pfn(page), > > + .nr_pages = 1, > > + .vma = vma, > > + .address = addr, > > + .flags = PVMW_SYNC, > > + }; > > + > > + if (addr < vma->vm_start || addr >= vma->vm_end) > > + return -EFAULT; > > + if (!page_vma_mapped_walk(&pvmw)) > > + return -EFAULT; > > + page_vma_mapped_walk_done(&pvmw); > > +out: > > + return pvmw.address; > > +} > > + > > /** > > * page_mapped_in_vma - check whether a page is really mapped in a VMA > > * @page: the page to test > > @@ -355,21 +376,10 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw) > > unsigned long page_mapped_in_vma(const struct page *page, > > struct vm_area_struct *vma) > > { > > - const struct folio *folio = page_folio(page); > > - struct page_vma_mapped_walk pvmw = { > > - .pfn = page_to_pfn(page), > > - .nr_pages = 1, > > - .vma = vma, > > - .flags = PVMW_SYNC, > > - }; > > + const unsigned long addr = vma_address(vma, page_pgoff(folio, page), 1); > > - pvmw.address = vma_address(vma, page_pgoff(folio, page), 1); > > - if (pvmw.address == -EFAULT) > > - goto out; > > - if (!page_vma_mapped_walk(&pvmw)) > > + if (addr == -EFAULT) > > return -EFAULT; > > - page_vma_mapped_walk_done(&pvmw); > > -out: > > - return pvmw.address; > > + return page_mapped_in_vma_at_address(page, vma, addr); > > } > > #endif > > > > > > > + return true; > > > +} > > > + > > > /* > > > * Collect processes when the error hit an ksm page. > > > */ > > > @@ -3237,13 +3258,13 @@ void collect_procs_ksm(const struct folio *folio, const struct page *page, > > > if (!stable_node) > > > return; > > > hlist_for_each_entry(rmap_item, &stable_node->hlist, hlist) { > > > + unsigned long addr = rmap_item->address & PAGE_MASK; > > Can be const. > > > > > struct anon_vma *av = rmap_item->anon_vma; > > > anon_vma_lock_read(av); > > > rcu_read_lock(); > > > for_each_process(tsk) { > > > struct anon_vma_chain *vmac; > > > - unsigned long addr; > > > struct task_struct *t = > > > task_early_kill(tsk, force_early); > > > if (!t) > > > @@ -3253,7 +3274,9 @@ void collect_procs_ksm(const struct folio *folio, const struct page *page, > > > { > > > vma = vmac->vma; > > > if (vma->vm_mm == t->mm) { > > > - addr = rmap_item->address & PAGE_MASK; > > > + if (!ksm_rmap_item_mapped(page, vma, > > > + addr)) > > jut put that onto a single line, please: easier to read. > > > > > + continue; > > > add_to_kill_ksm(t, page, vma, to_kill, > > > addr); > > > } > > > -- Cheers, Lorenzo