From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from canpmsgout04.his.huawei.com (canpmsgout04.his.huawei.com [113.46.200.219]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C1C18389DEC for ; Fri, 22 May 2026 09:14:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.219 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779441255; cv=none; b=oSpG+o7NAU2vQYaIdzuHqft5bwuwZKcaE/yZRwOxfnM05OomALyuXogKeCMML2Gtp/PKBK2MPGcGiz6kNIPxcoEQg4hI8/GsORUf1u3FCIQC6Z+XCcusHBKE0NEEueJ1E/NRheGMNXagvw2UkhxmKUetPY5ggt7khJNn3C1qHxQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779441255; c=relaxed/simple; bh=s/fuVr15HHMPviv1qmBQgSTzQrlPK52LuW3h3mKY1JU=; h=Message-ID:Date:MIME-Version:Subject:To:CC:References:From: In-Reply-To:Content-Type; b=I3Fhf4YyAG+fRW7N6+7cs7G7HGlX+OF1UNgo+hc95G8u0Fs7+2dXJBbCQo/67ydsY9iAZnf1xXwFcUVZh64K2sL+8O0zl2kf8uOVN6D6PfP1GzVpcPETlc2SFQ7DPoWTv1CEBQL3ugbzaMjqajMy7wFogFuLez5VoTZ2FzQnf6s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=XGJDlEgX; arc=none smtp.client-ip=113.46.200.219 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="XGJDlEgX" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=7dBb2VYJICvfFkLah3xJP2KmNvEisma78ZK5+vFaSHI=; b=XGJDlEgXWC/F3oYkUOKNYV3aK+0LIry2t0TpBsaGz6kas6NM/98NyHnYz7ilQ3mokqM+wrIKx bb/mthb1Rxp1ujL/m7qWnwi3KyQNxhmwWDvI7pcV6CX/jBpDuNKnZ7XajtZdYWC2U31cFfUgyQm XdCS3wRWy33n/HQi+5Je2zI= Received: from mail.maildlp.com (unknown [172.19.163.104]) by canpmsgout04.his.huawei.com (SkyGuard) with ESMTPS id 4gMKC00k2zz1prKm; Fri, 22 May 2026 17:06:20 +0800 (CST) Received: from dggpemf100008.china.huawei.com (unknown [7.185.36.138]) by mail.maildlp.com (Postfix) with ESMTPS id 36EE34048F; Fri, 22 May 2026 17:14:05 +0800 (CST) Received: from [10.174.177.243] (10.174.177.243) by dggpemf100008.china.huawei.com (7.185.36.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Fri, 22 May 2026 17:14:04 +0800 Message-ID: Date: Fri, 22 May 2026 17:14:02 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH resend] mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison To: Wupeng Ma , , , , , , , , , , , , CC: , References: <20260522010305.4099834-1-mawupeng1@huawei.com> Content-Language: en-US From: Kefeng Wang In-Reply-To: <20260522010305.4099834-1-mawupeng1@huawei.com> Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 7bit X-ClientProxiedBy: kwepems500001.china.huawei.com (7.221.188.70) To dggpemf100008.china.huawei.com (7.185.36.138) On 5/22/2026 9:03 AM, Wupeng Ma wrote: > Two concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page > can trigger a recursive spinlock self-deadlock (AA deadlock) on > hugetlb_lock when racing with a concurrent unmap: > > thread#0 thread#1 > -------- -------- > madvise(folio, MADV_HWPOISON) > -> poisons the folio successfully > madvise(folio, MADV_HWPOISON) unmap(folio) > try_memory_failure_hugetlb > get_huge_page_for_hwpoison > spin_lock_irq(&hugetlb_lock) <- held > __get_huge_page_for_hwpoison > hugetlb_update_hwpoison() > -> MF_HUGETLB_FOLIO_PRE_POISONED > goto out: > folio_put() > refcount: 1 -> 0 > free_huge_folio() > spin_lock_irqsave(&hugetlb_lock) > -> AA DEADLOCK! > > The out: path in __get_huge_page_for_hwpoison() calls folio_put() to > drop the GUP reference while the hugetlb_lock is still held by the > hugetlb.c wrapper get_huge_page_for_hwpoison(). If concurrent unmap > has released the page table mapping reference, folio_put() drops the > folio refcount to zero, triggering free_huge_folio() which attempts > to re-acquire the non-recursive hugetlb_lock. > > Fix this by moving hugetlb_lock acquisition from the hugetlb.c wrapper > into get_huge_page_for_hwpoison(). Place spin_unlock_irq() before the > folio_put() at the out: label so the folio is always released outside > the lock. > > Fixes: 405ce051236c ("mm/hwpoison: fix race between hugetlb free/demotion and memory_failure_hugetlb()") > Signed-off-by: Wupeng Ma Reviewed-by: Kefeng Wang