From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from szxga07-in.huawei.com (szxga07-in.huawei.com [45.249.212.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 03F1023A0 for ; Fri, 24 Jan 2025 02:12:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.35 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737684754; cv=none; b=AB8fNpaf2X0HpzIOgRdijbO9wQbdRzo6aRDu+nGHlnoP2sD7s3AF/MCMLWe4AJgAw+YGXzQyRqU9ygn3gkGyDXZGABwZiVDNtrZU1jv9TL4+oxbA+vNWMWkVwEAx9vCxi0AZLQlNtoiFi6gdZjWrNlVTFQAi0ISArI3BdJVLwc0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737684754; c=relaxed/simple; bh=jotxu2dux6cfd8yoFxpzELHv9FLYUMnL0VtRY+tfXFQ=; h=Subject:To:References:CC:From:Message-ID:Date:MIME-Version: In-Reply-To:Content-Type; b=GNMaJRYh58CxwGU2q3MgwHAc8plBLddUGgFKQIUG5Qqfg2U4VeYBVDHlNQl0oK43eSPc2D6Il6o2yMccYReMg/BDkDPaaoFbGf2FxZGUSw/FvmFfCcvPSErR6u4XuRZeihHJUPYQq1u1AIKZH581qSBBGt1KPjPuTgDT6PWuQDg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.35 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.88.163]) by szxga07-in.huawei.com (SkyGuard) with ESMTP id 4YfLpM59Knz1V5V8; Fri, 24 Jan 2025 10:08:59 +0800 (CST) Received: from kwepemg200013.china.huawei.com (unknown [7.202.181.64]) by mail.maildlp.com (Postfix) with ESMTPS id 998C5180216; Fri, 24 Jan 2025 10:12:21 +0800 (CST) Received: from [10.174.179.24] (10.174.179.24) by kwepemg200013.china.huawei.com (7.202.181.64) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Fri, 24 Jan 2025 10:12:20 +0800 Subject: Re: [PATCH] mm: page_isolation: avoid call folio_hstate() without hugetlb_lock To: Oscar Salvador References: <20250122061151.578768-1-liushixin2@huawei.com> CC: Andrew Morton , Kefeng Wang , Muchun Song , David Hildenbrand , Zi Yan , Johannes Weiner , "Kirill A . Shutemov" , Nanyong Sun , , From: Liu Shixin Message-ID: Date: Fri, 24 Jan 2025 10:12:19 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To kwepemg200013.china.huawei.com (7.202.181.64) On 2025/1/23 17:55, Oscar Salvador wrote: > On Wed, Jan 22, 2025 at 02:11:51PM +0800, Liu Shixin wrote: >> I found a NULL pointer dereference as followed: >> >> BUG: kernel NULL pointer dereference, address: 0000000000000028 >> #PF: supervisor read access in kernel mode >> #PF: error_code(0x0000) - not-present page >> PGD 0 P4D 0 >> Oops: Oops: 0000 [#1] SMP PTI >> CPU: 5 UID: 0 PID: 5964 Comm: sh Kdump: loaded Not tainted 6.13.0-dirty #20 >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1. >> RIP: 0010:has_unmovable_pages+0x184/0x360 >> ... >> Call Trace: >> >> set_migratetype_isolate+0xd1/0x180 >> start_isolate_page_range+0xd2/0x170 >> alloc_contig_range_noprof+0x101/0x660 >> alloc_contig_pages_noprof+0x238/0x290 >> alloc_gigantic_folio.isra.0+0xb6/0x1f0 >> only_alloc_fresh_hugetlb_folio.isra.0+0xf/0x60 >> alloc_pool_huge_folio+0x80/0xf0 >> set_max_huge_pages+0x211/0x490 >> __nr_hugepages_store_common+0x5f/0xe0 >> nr_hugepages_store+0x77/0x80 >> kernfs_fop_write_iter+0x118/0x200 >> vfs_write+0x23c/0x3f0 >> ksys_write+0x62/0xe0 >> do_syscall_64+0x5b/0x170 >> entry_SYSCALL_64_after_hwframe+0x76/0x7e >> >> As has_unmovable_pages() call folio_hstate() without hugetlb_lock, there >> is a race to free the HugeTLB page between PageHuge() and folio_hstate(). >> There is no need to add hugetlb_lock here as the HugeTLB page can be freed >> in lot of places. So it's enough to unfold folio_hstate() and add a check >> to avoid NULL pointer dereference for hugepage_migration_supported(). >> >> Fixes: 464c7ffbcb16 ("mm/hugetlb: filter out hugetlb pages if HUGEPAGE migration is not supported.") >> Signed-off-by: Liu Shixin > I wonder whether we should place a comment in hugepage_migration_supported stating > that the hstate _must_ be valid, as we do not perform any sanity check further > down the road. Most of the functions in hugetlb.h imply that hstate is valid, and in fact it does. So maybe it's enough to comment just in the special caller. > > Reviewed-by: Oscar Salvador Thanks for the review. > >