From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from canpmsgout08.his.huawei.com (canpmsgout08.his.huawei.com [113.46.200.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E701D3C1F for ; Wed, 27 May 2026 03:28:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.223 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779852509; cv=none; b=AEdXpUulPj3Mps8OVOoR1BHBwST6PCgiSQwfbHF0PtZr3n7mW20NmDTgHzMTfZU0irw6mKniZDz1gzZhazIFbtTjHlJxwvzkgq3TswZvr5XjEzSSzCfN0oezTCuk/AxGx4+gwnEkJDpU8bNg6dGf5PqG7i0WyWJJgRZEzRJyM5o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779852509; c=relaxed/simple; bh=YsFEUYMTPsi19Pyauj//RFI/CA8GhR1tVCPmdpFLboA=; h=Message-ID:Date:MIME-Version:CC:Subject:To:References:From: In-Reply-To:Content-Type; b=danR+8czrHD8I4OPRzl273oEPraei9heODlsgH4YaQGhMa3hbjbTzn7BAldAectEKzo9h1IeAutMDd1+45UDC2706lfzUfLusskyMAT/0FmKrZqYMsarR+bmjTcpxg8+jc3CNJgN3oOc7XiAjh4tfDx+iVuP9QA3D4kvIcuBEXo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=vxS6Gf+C; arc=none smtp.client-ip=113.46.200.223 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="vxS6Gf+C" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=8xm27aHRyRrQdqIYE1aIWgOYbESWRNrtkj5Qor33G2U=; b=vxS6Gf+Cc901CR4CW+oPMFdkTvgem+UrfX5puCn/KLmIQ4iJQkw7n6w6kp6j8VZYbILqtZQOz 0F+NME38TwHIHvifM7JKN5ojJqbJW+FP1DZ3oZYmTlslN9aR3oiEivW/WYKhuxRnFcOWSxtgtag qA9tI0nLrYmfnMOtW1WlDOU= Received: from mail.maildlp.com (unknown [172.19.163.200]) by canpmsgout08.his.huawei.com (SkyGuard) with ESMTPS id 4gQFHg4HXPzmV64; Wed, 27 May 2026 11:20:31 +0800 (CST) Received: from kwepemj100016.china.huawei.com (unknown [7.202.194.10]) by mail.maildlp.com (Postfix) with ESMTPS id 51B924055B; Wed, 27 May 2026 11:28:18 +0800 (CST) Received: from [10.174.177.15] (10.174.177.15) by kwepemj100016.china.huawei.com (7.202.194.10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.36; Wed, 27 May 2026 11:28:17 +0800 Message-ID: Date: Wed, 27 May 2026 11:28:16 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird CC: , , , , , , , , , , , , , Subject: Re: [PATCH resend] mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison To: References: <20260522010305.4099834-1-mawupeng1@huawei.com> <20260522205041.a85237b104d74533c13745e4@linux-foundation.org> From: mawupeng In-Reply-To: <20260522205041.a85237b104d74533c13745e4@linux-foundation.org> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To kwepemj100016.china.huawei.com (7.202.194.10) On 周六 2026-5-23 11:50, Andrew Morton wrote: > On Fri, 22 May 2026 09:03:05 +0800 Wupeng Ma wrote: > >> Two concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page >> can trigger a recursive spinlock self-deadlock (AA deadlock) on >> hugetlb_lock when racing with a concurrent unmap: > > Well we don't want that. > >> Fixes: 405ce051236c ("mm/hwpoison: fix race between hugetlb free/demotion and memory_failure_hugetlb()") > > So I'll add cc:stable here. > > AI review didn't like the unlocked page_folio(): > > https://sashiko.dev/#/patchset/20260522010305.4099834-1-mawupeng1@huawei.com > > So I'll add a followup patch which addresses that (and which addresses > Miaohe's naming nit). > > Please let's check this - perhaps the locking alteration isn't needed. Thanks for your modifcation, this looks reasonable to me. > > > From: Andrew Morton > Subject: mm-memory-failure-fix-hugetlb_lock-aa-deadlock-in-get_huge_page_for_hwpoison-fix > Date: Fri May 22 08:44:25 PM PDT 2026 > > - address possible race identified by Sashiko > > - s/out/out_unlock/, per Miaohe > > Link: https://sashiko.dev/#/patchset/20260522010305.4099834-1-mawupeng1@huawei.com > Link: https://lore.kernel.org/f39f405e-4b4b-8f79-70fe-a2b5b62114eb@huawei.com > Cc: David Hildenbrand > Cc: Kefeng Wang > Cc: Liam Howlett > Cc: Lorenzo Stoakes > Cc: Miaohe Lin > Cc: Michal Hocko > Cc: Mike Rapoport > Cc: Muchun Song > Cc: Naoya Horiguchi > Cc: Oscar Salvador (SUSE) > Cc: Suren Baghdasaryan > Cc: Vlastimil Babka > Cc: Wupeng Ma > Signed-off-by: Andrew Morton > --- > > mm/memory-failure.c | 11 ++++++----- > 1 file changed, 6 insertions(+), 5 deletions(-) > > --- a/mm/memory-failure.c~mm-memory-failure-fix-hugetlb_lock-aa-deadlock-in-get_huge_page_for_hwpoison-fix > +++ a/mm/memory-failure.c > @@ -1970,14 +1970,15 @@ static int get_huge_page_for_hwpoison(un > bool *migratable_cleared) > { > struct page *page = pfn_to_page(pfn); > - struct folio *folio = page_folio(page); > + struct folio *folio; > bool count_increased = false; > int ret, rc; > > spin_lock_irq(&hugetlb_lock); > + folio = page_folio(page); > if (!folio_test_hugetlb(folio)) { > ret = MF_HUGETLB_NON_HUGEPAGE; > - goto out; > + goto out_unlock; > } else if (flags & MF_COUNT_INCREASED) { > ret = MF_HUGETLB_IN_USED; > count_increased = true; > @@ -1993,13 +1994,13 @@ static int get_huge_page_for_hwpoison(un > } else { > ret = MF_HUGETLB_RETRY; > if (!(flags & MF_NO_RETRY)) > - goto out; > + goto out_unlock; > } > > rc = hugetlb_update_hwpoison(folio, page); > if (rc >= MF_HUGETLB_FOLIO_PRE_POISONED) { > ret = rc; > - goto out; > + goto out_unlock; > } > > /* > @@ -2013,7 +2014,7 @@ static int get_huge_page_for_hwpoison(un > > spin_unlock_irq(&hugetlb_lock); > return ret; > -out: > +out_unlock: > spin_unlock_irq(&hugetlb_lock); > if (count_increased) > folio_put(folio); > _ > >