FAILED: patch "[PATCH] mm/hugetlb: fix use-after-free of a new anon folio" failed to apply to 6.12-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x 824cc56bf43c714319992bad3558803cac6e77c0
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026110456-remix-oversold-9ee1@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 824cc56bf43c714319992bad3558803cac6e77c0 Mon Sep 17 00:00:00 2001
From: Josef Bacik <[email protected]>
Date: Thu, 15 Oct 2026 18:07:08 +0200
Subject: [PATCH] mm/hugetlb: fix use-after-free of a new anon folio
For a fault in a private mapping with nothing in the page cache, hugetlb_no_page() allocates a folio, locks it and maps it. The folio has one reference, which belongs to the page table entry from then on. After dropping the page table lock the function still sets the migratable flag of the folio and unlocks it.
Whoever zaps the entry in between frees the folio. The fault holds the fault mutex and the lock of the vma. MADV_DONTNEED and the first unmap of a hole punch, hugetlb_vmdelete_list(), do not take the fault mutex, and a private vma only has a lock if it owns a reservation map: not with MAP_NORESERVE, and not in the child after fork().
Then the flag is set in, and folio_unlock() is called on, a folio that is free or has a new owner. A surplus page goes back to the page allocator while it is locked:
BUG: Bad page state in process init pfn:108e00 flags: 0x200000000000059(locked|uptodate|dirty|head|node=0|zone=2) page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
A page of the pool can be given to the next user, of any file, who locks it and loses the lock to the late folio_unlock():
kernel BUG at mm/filemap.c:1532!
hugetlb_no_page+0x111b/0x23e0 hugetlb_fault+0x3a9/0x14a0
An unprivileged process is enough: threads that write to a MAP_PRIVATE | MAP_NORESERVE hugetlb mapping, threads that call MADV_DONTNEED on it, and one that takes the freed pages for another file.
Until commit 3a47c54f09c4 ("hugetlbfs: revert use i_mmap_rwsem for more pmd sharing synchronization") the fault held i_mmap_rwsem for reading, which everybody who zaps takes for writing. The lock that commit bf4916922c60 ("hugetlbfs: extend hugetlb_vma_lock to private VMAs") gave to private vmas closed the window again, but only for those with a reservation map.
Be done with the folio before the page table lock is dropped, as hugetlb_wp() is with its copy. The function already unlocks page cache folios under that lock.
Original fix generated by an LLM and sent in private by Josef.
mm/hugetlb.c +6 -2
@@ -5991,8 +5991,6 @@ static vm_fault_t hugetlb_no_page(struct address_space *mapping, ret =hugetlb_wp (vmf); } -spin_unlock (vmf->ptl); -/* * Only set hugetlb_migratable in newly allocated pages. Existing pages * found in the pagecache may not have hugetlb_migratable if they have
@@ -6003,6 +6001,12 @@ static vm_fault_t hugetlb_no_page(struct address_space *mapping,if (folio_locked)folio_unlock (folio); + +/* +* Hold the PTL until we're done with the folio: the page table owns the +* folio reference now. +*/ +spin_unlock (vmf->ptl); out:hugetlb_vma_unlock_read (vma);
Sasha Levin
maintainerPATCH 1/5 mm/hugetlb: stop using avoid_reserve flag in fork()
From: Peter Xu <[email protected]>
[ Upstream commit be8d7314b18ede1c6cdebbb982c9659020e2f1f2 ]
When fork() and stumble on top of a dma-pinned hugetlb private page, CoW must happen during fork() to guarantee dma coherency.
In this specific path, hugetlb pages need to be allocated for the child process. Stop using avoid_reserve=1 flag here: it's not required to be used here, as dest_vma (which is destined to be a MAP_PRIVATE hugetlb vma) will have no private vma resv map, and that will make sure it won't be able to use a vma reservation later.
No functional change intended with this change. Said that, it's still wanted to do this, so as to reduce the usage of avoid_reserve to the only one user, which is also why this flag was introduced initially in commit 04f2cbe35699 ("hugetlb: guarantee that COW faults for a process that called mmap(MAP_PRIVATE) on hugetlbfs will succeed"). I don't see whoever else should set it at all.
Further patch will clean up resv accounting based on this.
Stable-dep-of: 824cc56bf43c ("mm/hugetlb: fix use-after-free of a new anon folio")
--- mm/hugetlb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/hugetlb.c +1 -1
@@ -5366,7 +5366,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,spin_unlock (src_ptl);spin_unlock (dst_ptl);/* Do not use reserve as it's private owned */ - new_folio =alloc_hugetlb_folio (dst_vma, addr,1 ); + new_folio =alloc_hugetlb_folio (dst_vma, addr,0 );if (IS_ERR (new_folio)) {folio_put (pte_folio); ret =PTR_ERR (new_folio);
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/5 mm/hugetlb: rename avoid_reserve to cow_from_owner
From: Peter Xu <[email protected]>
[ Upstream commit 30cef82bc6e8975a360ec05b707f7fb194c875ed ]
The old name "avoid_reserve" can be too generic and can be used wrongly in the new call sites that want to allocate a hugetlb folio.
It's confusing on two things: (1) whether one can opt-in to avoid global reservation, and (2) whether it should take more than one count.
In reality, this flag is only used in an extremely hacky path, in an extremely hacky way in hugetlb CoW path only, and always use with 1 saying "skip global reservation". Rename the flag to avoid future abuse of this flag, making it a boolean so as to reflect its true representation that it's not a counter. To make it even harder to abuse, add a comment above the function to explain it.
Stable-dep-of: 824cc56bf43c ("mm/hugetlb: fix use-after-free of a new anon folio")
--- fs/hugetlbfs/inode.c | 2 +- include/linux/hugetlb.h | 4 ++-- mm/hugetlb.c | 33 ++++++++++++++++++++------------- 3 files changed, 23 insertions(+), 16 deletions(-)
fs/hugetlbfs/inode.c +1 -1
@@ -884,7 +884,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,* folios in these areas, we need to consume the reserves * to keep reservation accounting consistent. */ - folio =alloc_hugetlb_folio (&pseudo_vma, addr,0 ); + folio =alloc_hugetlb_folio (&pseudo_vma, addr, false);if (IS_ERR (folio)) {mutex_unlock (&hugetlb_fault_mutex_table[hash]); error =PTR_ERR (folio);
include/linux/hugetlb.h +2 -2
@@ -691,7 +691,7 @@ struct huge_bootmem_page {int isolate_or_dissolve_huge_page (struct page *page,struct list_head *list);void wait_for_freed_hugetlb_folios (void );struct folio *alloc_hugetlb_folio (struct vm_area_struct *vma, -unsigned long addr,int avoid_reserve); +unsigned long addr,bool cow_from_owner);struct folio *alloc_hugetlb_folio_nodemask (struct hstate *h,int preferred_nid,nodemask_t *nmask,gfp_t gfp_mask,bool allow_alloc_fallback);
@@ -1083,7 +1083,7 @@ static inline void wait_for_freed_hugetlb_folios(void)static inline struct folio *alloc_hugetlb_folio (struct vm_area_struct *vma,unsigned long addr, -int avoid_reserve) +bool cow_from_owner) {return NULL ; }
mm/hugetlb.c +20 -13
@@ -2991,8 +2991,15 @@ void wait_for_freed_hugetlb_folios(void)flush_work (&free_hpage_work); } +/* +* NOTE! "cow_from_owner" represents a very hacky usage only used in CoW +* faults of hugetlb private mappings on top of a non-page-cache folio (in +* which case even if there's a private vma resv map it won't cover such +* allocation). New call sites should (probably) never set it to true!! +* When it's set, the allocation will bypass all vma level reservations. +*/ struct folio *alloc_hugetlb_folio (struct vm_area_struct *vma, -unsigned long addr,int avoid_reserve) +unsigned long addr,bool cow_from_owner) {struct hugepage_subpool *spool =subpool_vma (vma);struct hstate *h =hstate_vma (vma);
@@ -3034,7 +3041,7 @@ struct folio *alloc_hugetlb_folio(struct vm_area_struct *vma,* Allocations for MAP_NORESERVE mappings also need to be * checked against any subpool limit. */ -if (map_chg || avoid_reserve) { +if (map_chg || cow_from_owner) { gbl_chg =hugepage_subpool_get_pages (spool,1 );if (gbl_chg <0 ) goto out_end_reservation;
@@ -3042,7 +3049,7 @@ struct folio *alloc_hugetlb_folio(struct vm_area_struct *vma,/* If this allocation is not consuming a reservation, charge it now. */ - deferred_reserve = map_chg || avoid_reserve; + deferred_reserve = map_chg || cow_from_owner;if (deferred_reserve) { ret =hugetlb_cgroup_charge_cgroup_rsvd ( idx,pages_per_huge_page (h), &h_cg_rsvd);
@@ -3067,7 +3074,7 @@ struct folio *alloc_hugetlb_folio(struct vm_area_struct *vma,if (!folio) goto out_uncharge_cgroup;spin_lock_irq (&hugetlb_lock); -if (!avoid_reserve &&vma_has_reserves (vma, gbl_chg)) { +if (!cow_from_owner &&vma_has_reserves (vma, gbl_chg)) {folio_set_hugetlb_restore_reserve (folio); h->resv_huge_pages--; }
@@ -3125,7 +3132,7 @@ struct folio *alloc_hugetlb_folio(struct vm_area_struct *vma,hugetlb_cgroup_uncharge_cgroup_rsvd (idx,pages_per_huge_page (h), h_cg_rsvd); out_subpool_put: -if (map_chg || avoid_reserve) +if (map_chg || cow_from_owner)hugepage_subpool_put_pages (spool,1 ); out_end_reservation:vma_end_reservation (h, vma, addr);
@@ -5366,7 +5373,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,spin_unlock (src_ptl);spin_unlock (dst_ptl);/* Do not use reserve as it's private owned */ - new_folio =alloc_hugetlb_folio (dst_vma, addr,0 ); + new_folio =alloc_hugetlb_folio (dst_vma, addr, false);if (IS_ERR (new_folio)) {folio_put (pte_folio); ret =PTR_ERR (new_folio);
@@ -5827,7 +5834,7 @@ static vm_fault_t hugetlb_wp(struct folio *pagecache_folio,struct hstate *h =hstate_vma (vma);struct folio *old_folio;struct folio *new_folio; -int outside_reserve =0 ; +bool cow_from_owner =0 ;vm_fault_t ret =0 ;struct mmu_notifier_range range;
@@ -5896,7 +5903,7 @@ static vm_fault_t hugetlb_wp(struct folio *pagecache_folio,*/ if (is_vma_resv_set (vma,HPAGE_RESV_OWNER ) && old_folio != pagecache_folio) - outside_reserve =1 ; + cow_from_owner = true;folio_get (old_folio);
@@ -5905,7 +5912,7 @@ static vm_fault_t hugetlb_wp(struct folio *pagecache_folio,* be acquired again before returning to the caller, as expected. */ spin_unlock (vmf->ptl); - new_folio =alloc_hugetlb_folio (vma, vmf->address, outside_reserve); + new_folio =alloc_hugetlb_folio (vma, vmf->address, cow_from_owner);if (IS_ERR (new_folio)) {/*
@@ -5915,7 +5922,7 @@ static vm_fault_t hugetlb_wp(struct folio *pagecache_folio,* reliability, unmap the page from child processes. The child * may get SIGKILLed if it later faults. */ -if (outside_reserve) { +if (cow_from_owner) {struct address_space *mapping = vma->vm_file->f_mapping;pgoff_t idx;u32 hash;
@@ -6166,7 +6173,7 @@ static vm_fault_t hugetlb_no_page(struct address_space *mapping, goto out; } - folio =alloc_hugetlb_folio (vma, vmf->address,0 ); + folio =alloc_hugetlb_folio (vma, vmf->address, false);if (IS_ERR (folio)) {/* * Returning error will result in faulting task being
@@ -6630,7 +6637,7 @@ int hugetlb_mfill_atomic_pte(pte_t *dst_pte, goto out; } - folio =alloc_hugetlb_folio (dst_vma, dst_addr,0 ); + folio =alloc_hugetlb_folio (dst_vma, dst_addr, false);if (IS_ERR (folio)) { ret = -ENOMEM ; goto out;
@@ -6672,7 +6679,7 @@ int hugetlb_mfill_atomic_pte(pte_t *dst_pte, goto out; } - folio =alloc_hugetlb_folio (dst_vma, dst_addr,0 ); + folio =alloc_hugetlb_folio (dst_vma, dst_addr, false);if (IS_ERR (folio)) {folio_put (*foliop); ret = -ENOMEM ;
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 3/5 mm,hugetlb: change mechanism to detect a COW on private mapping
In reply to Sasha LevinFrom: Oscar Salvador <[email protected]>
[ Upstream commit 2ae1ab9934c785b855583e3eabd208d6f3ac91e1 ]
Patch series "Misc rework on hugetlb faulting path", v4.
This patchset aims to give some love to the hugetlb faulting path, doing so by removing obsolete comments that are no longer true, sorting out the folio lock, and changing the mechanism we use to determine whether we are COWing a private mapping already.
The most important patch of the series is #1, as it fixes a deadlock that was described in [1], where two processes were holding the same lock for the folio in the pagecache, and then deadlocked in the mutex. Note that this can also happen for anymous folios. This has been tested using this reproducer, below
Looking up and locking the folio in the pagecache was done to check whether that folio was the same folio we had mapped in our pagetables, meaning that if it was different we knew that we already mapped that folio privately, so any further CoW would be made on a private mapping, which lead us to the question: __Was the reservation for that address consumed?__ That is all we care about, because if it was indeed consumed and we are the owner and we cannot allocate more folios, we need to unmap the folio from the processes pagetables and make it exclusive for us.
We figured we do not need to look up the folio at all, and it is just enough to check whether the folio we have mapped is anonymous, which means we mapped it privately, so the reservation was indeed consumed.
Patch#2 sorts out folio locking in the faulting path, reducing the scope of it ,only taking it when we are dealing with an anonymous folio and document it. More details in the patch.
Patch#3-5 are cleanups.
Here is the reproducer:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#include <sys/wait.h>
#define PROTECTION (PROT_READ | PROT_WRITE)
#define LENGTH (2UL*1024*1024)
#define ADDR (void *)(0x0UL)
#define FLAGS (MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB)
void __read(char *addr)
{
int i = 0;
printf("a[%d]: %c\n", i, addr[i]);
}
void fill(char *addr)
{
addr[0] = 'd';
printf("addr: %c\n", addr[0]);
}
int main(void)
{
void *addr;
pid_t pid, wpid;
int status;
addr = mmap(ADDR, LENGTH, PROTECTION, FLAGS, -1, 0); if (addr == MAP_FAILED) {
perror("mmap");
return -1;
}
printf("Parent faulting in RO\n");
__read(addr);
sleep (10);
printf("Forking\n");
pid = fork();
switch (pid) {
case -1:
perror("fork");
break;
case 0:
sleep (4);
printf("Child: Faulting in\n"); fill(addr);
exit(0);
break;
default:
printf("Parent: Faulting in\n"); fill(addr);
while((wpid = wait(&status)) > 0); if (munmap(addr, LENGTH))
perror("munmap");
}
return 0;
}
You will also have to add a delay in hugetlb_wp, after releasing the mutex and before unmapping, so the window is large enough to reproduce it reliably.
: --- a/mm/hugetlb.c : +++ b/mm/hugetlb.c : @@ -38,6 +38,7 @@ : #include <linux/memory.h> : #include <linux/mm_inline.h> : #include <linux/padata.h>
: +#include <linux/delay.h>
:
: #include <asm/page.h>
: #include <asm/pgalloc.h>
: @@ -6261,6 +6262,8 @@ static vm_fault_t hugetlb_wp(struct vm_fault *vmf)
: hugetlb_vma_unlock_read(vma);
: mutex_unlock(&hugetlb_fault_mutex_table[hash]);
:
: + mdelay(8000);
: +
: unmap_ref_private(mm, vma, old_folio, vmf->address);
:
: mutex_lock(&hugetlb_fault_mutex_table[hash]);
This patch (of 5):
hugetlb_wp() checks whether the process is trying to COW on a private mapping in order to know whether the reservation for that address was already consumed. If it was consumed and we are the ownner of the mapping, the folio will have to be unmapped from the other processes.
Currently, that check is done by looking up the folio in the pagecache and compare it to the folio which is mapped in our pagetables. If it differs, it means we already mapped it privately before, consuming a reservation on the way. All we are interested in is whether the mapped folio is anonymous, so we can simplify and check for that instead.
:
: #include <asm/page.h>
: #include <asm/pgalloc.h>
: @@ -6261,6 +6262,8 @@ static vm_fault_t hugetlb_wp(struct vm_fault *vmf)
: hugetlb_vma_unlock_read(vma);
: mutex_unlock(&hugetlb_fault_mutex_table[hash]);
:
: + mdelay(8000);
: +
: unmap_ref_private(mm, vma, old_folio, vmf->address);
:
Stable-dep-of: 824cc56bf43c ("mm/hugetlb: fix use-after-free of a new anon folio")
--- mm/hugetlb.c | 88 ++++++++++++++++++++-------------------------------- 1 file changed, 34 insertions(+), 54 deletions(-)
mm/hugetlb.c +34 -54
@@ -5824,8 +5824,7 @@ static void unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,* cannot race with other handlers or page migration. * Keep the pte_same checks anyway to make transition from the mutex easier. */ -static vm_fault_t hugetlb_wp (struct folio *pagecache_folio, -struct vm_fault *vmf) +static vm_fault_t hugetlb_wp (struct vm_fault *vmf) {struct vm_area_struct *vma = vmf->vma;struct mm_struct *mm = vma->vm_mm;
@@ -5893,16 +5892,17 @@ static vm_fault_t hugetlb_wp(struct folio *pagecache_folio, PageAnonExclusive(&old_folio->page), &old_folio->page);/* -* If the process that created a MAP_PRIVATE mapping is about to -* perform a COW due to a shared page count, attempt to satisfy -* the allocation without using the existing reserves. The pagecache -* page is used to determine if the reserve at this address was -* consumed or not. If reserves were used, a partial faulted mapping -* at the time of fork() could consume its reserves on COW instead -* of the full address range. +* If the process that created a MAP_PRIVATE mapping is about to perform +* a COW due to a shared page count, attempt to satisfy the allocation +* without using the existing reserves. +* In order to determine where this is a COW on a MAP_PRIVATE mapping it +* is enough to check whether the old_folio is anonymous. This means that +* the reserve for this address was consumed. If reserves were used, a +* partial faulted mapping at the fime of fork() could consume its reserves +* on COW instead of the full address range. */ if (is_vma_resv_set (vma,HPAGE_RESV_OWNER ) && - old_folio != pagecache_folio) +folio_test_anon (old_folio)) cow_from_owner = true;folio_get (old_folio);
@@ -6283,7 +6283,7 @@ static vm_fault_t hugetlb_no_page(struct address_space *mapping,hugetlb_count_add (pages_per_huge_page (h), mm);if ((vmf->flags &FAULT_FLAG_WRITE ) && !(vma->vm_flags &VM_SHARED )) {/* Optimization, do the COW without a second fault */ - ret =hugetlb_wp (folio, vmf); + ret =hugetlb_wp (vmf); }spin_unlock (vmf->ptl);
@@ -6351,10 +6351,9 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,vm_fault_t ret;u32 hash;struct folio *folio =NULL ; -struct folio *pagecache_folio =NULL ;struct hstate *h =hstate_vma (vma);struct address_space *mapping; -int need_wait_lock =0 ; +bool need_wait_lock = false;struct vm_fault vmf = { .vma = vma, .address = address &huge_page_mask (h),
@@ -6445,8 +6444,7 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,* If we are going to COW/unshare the mapping later, we examine the * pending reservations for this page now. This will ensure that any * allocations necessary to record that reservation occur outside the -* spinlock. Also lookup the pagecache page now as it is used to -* determine if a reservation has been consumed. +* spinlock. */ if ((flags & (FAULT_FLAG_WRITE |FAULT_FLAG_UNSHARE )) && !(vma->vm_flags &VM_MAYSHARE ) && !huge_pte_write (vmf.orig_pte)) {
@@ -6456,11 +6454,6 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, }/* Just decrements count, does not deallocate */ vma_end_reservation (h, vma, vmf.address); - - pagecache_folio =filemap_lock_hugetlb_folio (h, mapping, - vmf.pgoff); -if (IS_ERR (pagecache_folio)) - pagecache_folio =NULL ; } vmf.ptl =huge_pte_lock (h, mm, vmf.pte);
@@ -6474,10 +6467,6 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, (flags & FAULT_FLAG_WRITE) && !huge_pte_write(vmf.orig_pte)) {if (!userfaultfd_wp_async (vma)) {spin_unlock (vmf.ptl); -if (pagecache_folio) { -folio_unlock (pagecache_folio); -folio_put (pagecache_folio); - }hugetlb_vma_unlock_read (vma);mutex_unlock (&hugetlb_fault_mutex_table[hash]);return handle_userfault (&vmf,VM_UFFD_WP );
@@ -6489,24 +6478,19 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,/* Fallthrough to CoW */ } -/* -* hugetlb_wp() requires page locks of pte_page(vmf.orig_pte) and -* pagecache_folio, so here we need take the former one -* when folio != pagecache_folio or !pagecache_folio. -*/ - folio =page_folio (pte_page (vmf.orig_pte)); -if (folio != pagecache_folio) -if (!folio_trylock (folio)) { - need_wait_lock =1 ; - goto out_ptl; - } - -folio_get (folio); -if (flags & (FAULT_FLAG_WRITE |FAULT_FLAG_UNSHARE )) {if (!huge_pte_write (vmf.orig_pte)) { - ret =hugetlb_wp (pagecache_folio, &vmf); - goto out_put_page; +/* hugetlb_wp() requires page locks of pte_page(vmf.orig_pte) */ + folio =page_folio (pte_page (vmf.orig_pte)); +if (!folio_trylock (folio)) { + need_wait_lock = true; + goto out_ptl; + } +folio_get (folio); + ret =hugetlb_wp (&vmf); +folio_unlock (folio); +folio_put (folio); + goto out_ptl; }else if (likely (flags &FAULT_FLAG_WRITE )) { vmf.orig_pte =huge_pte_mkdirty (vmf.orig_pte); }
@@ -6515,17 +6499,8 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,if (huge_ptep_set_access_flags (vma, vmf.address, vmf.pte, vmf.orig_pte, flags &FAULT_FLAG_WRITE ))update_mmu_cache (vma, vmf.address, vmf.pte); -out_put_page: -if (folio != pagecache_folio) -folio_unlock (folio); -folio_put (folio); out_ptl:spin_unlock (vmf.ptl); - -if (pagecache_folio) { -folio_unlock (pagecache_folio); -folio_put (pagecache_folio); - } out_mutex:hugetlb_vma_unlock_read (vma);
@@ -6538,11 +6513,16 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,mutex_unlock (&hugetlb_fault_mutex_table[hash]);/* -* Generally it's safe to hold refcount during waiting page lock. But -* here we just wait to defer the next page fault to avoid busy loop and -* the page is not used after unlocked before returning from the current -* page fault. So we are safe from accessing freed page, even if we wait -* here without taking refcount. +* hugetlb_wp drops all the locks, but the folio lock, before trying to +* unmap the folio from other processes. During that window, if another +* process mapping that folio faults in, it will take the mutex and then +* it will wait on folio_lock, causing an ABBA deadlock. +* Use trylock instead and bail out if we fail. +* +* Ideally, we should hold a refcount on the folio we wait for, but we do +* not want to use the folio after it becomes unlocked, but rather just +* wait for it to become unlocked, so hopefully next fault successes on +* the trylock. */ if (need_wait_lock)folio_wait_locked (folio);
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 4/5 mm,hugetlb: sort out folio locking in the faulting path
In reply to Sasha LevinFrom: Oscar Salvador <[email protected]>
[ Upstream commit 9293fb4765527c0d2375eb441d045a5a75f5210d ]
Recent conversations showed that there was a misunderstanding about why we were locking the folio prior to call in hugetlb_wp(). In fact, as soon as we have the folio mapped into the pagetables, we no longer need to hold it locked, because we know that no concurrent truncation could have happened.
There is only one case where the folio needs to be locked, and that is when we are handling an anonymous folio, because hugetlb_wp() will check whether it can re-use it exclusively for the process that is faulting it in.
So, pass the folio locked to hugetlb_wp() when that is the case.
Stable-dep-of: 824cc56bf43c ("mm/hugetlb: fix use-after-free of a new anon folio")
--- mm/hugetlb.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)
mm/hugetlb.c +19 -4
@@ -6116,6 +6116,7 @@ static vm_fault_t hugetlb_no_page(struct address_space *mapping,pte_t new_pte;bool new_folio, new_pagecache_folio = false;u32 hash =hugetlb_fault_mutex_hash (mapping, vmf->pgoff); +bool folio_locked = true;/* * Currently, we are forced to kill the process in the event the
@@ -6282,6 +6283,14 @@ static vm_fault_t hugetlb_no_page(struct address_space *mapping,hugetlb_count_add (pages_per_huge_page (h), mm);if ((vmf->flags &FAULT_FLAG_WRITE ) && !(vma->vm_flags &VM_SHARED )) { +/* +* No need to keep file folios locked. See comment in +* hugetlb_fault(). +*/ +if (!anon_rmap) { + folio_locked = false; +folio_unlock (folio); + }/* Optimization, do the COW without a second fault */ ret =hugetlb_wp (vmf); }
@@ -6296,7 +6305,8 @@ static vm_fault_t hugetlb_no_page(struct address_space *mapping,if (new_folio)folio_set_hugetlb_migratable (folio); -folio_unlock (folio); +if (folio_locked) +folio_unlock (folio); out:hugetlb_vma_unlock_read (vma);
@@ -6480,15 +6490,20 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,if (flags & (FAULT_FLAG_WRITE |FAULT_FLAG_UNSHARE )) {if (!huge_pte_write (vmf.orig_pte)) { -/* hugetlb_wp() requires page locks of pte_page(vmf.orig_pte) */ +/* +* Anonymous folios need to be lock since hugetlb_wp() +* checks whether we can re-use the folio exclusively +* for us in case we are the only user of it. +*/ folio =page_folio (pte_page (vmf.orig_pte)); -if (!folio_trylock (folio)) { +if (folio_test_anon (folio) && !folio_trylock (folio)) { need_wait_lock = true; goto out_ptl; }folio_get (folio); ret =hugetlb_wp (&vmf); -folio_unlock (folio); +if (folio_test_anon (folio)) +folio_unlock (folio);folio_put (folio); goto out_ptl; }else if (likely (flags &FAULT_FLAG_WRITE )) {
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 5/5 mm/hugetlb: fix use-after-free of a new anon folio
In reply to Sasha LevinFrom: Josef Bacik <[email protected]>
[ Upstream commit 824cc56bf43c714319992bad3558803cac6e77c0 ]
For a fault in a private mapping with nothing in the page cache, hugetlb_no_page() allocates a folio, locks it and maps it. The folio has one reference, which belongs to the page table entry from then on. After dropping the page table lock the function still sets the migratable flag of the folio and unlocks it.
Whoever zaps the entry in between frees the folio. The fault holds the fault mutex and the lock of the vma. MADV_DONTNEED and the first unmap of a hole punch, hugetlb_vmdelete_list(), do not take the fault mutex, and a private vma only has a lock if it owns a reservation map: not with MAP_NORESERVE, and not in the child after fork().
Then the flag is set in, and folio_unlock() is called on, a folio that is free or has a new owner. A surplus page goes back to the page allocator while it is locked:
BUG: Bad page state in process init pfn:108e00 flags: 0x200000000000059(locked|uptodate|dirty|head|node=0|zone=2) page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
A page of the pool can be given to the next user, of any file, who locks it and loses the lock to the late folio_unlock():
kernel BUG at mm/filemap.c:1532!
hugetlb_no_page+0x111b/0x23e0 hugetlb_fault+0x3a9/0x14a0
An unprivileged process is enough: threads that write to a MAP_PRIVATE | MAP_NORESERVE hugetlb mapping, threads that call MADV_DONTNEED on it, and one that takes the freed pages for another file.
Until commit 3a47c54f09c4 ("hugetlbfs: revert use i_mmap_rwsem for more pmd sharing synchronization") the fault held i_mmap_rwsem for reading, which everybody who zaps takes for writing. The lock that commit bf4916922c60 ("hugetlbfs: extend hugetlb_vma_lock to private VMAs") gave to private vmas closed the window again, but only for those with a reservation map.
Be done with the folio before the page table lock is dropped, as hugetlb_wp() is with its copy. The function already unlocks page cache folios under that lock.
Original fix generated by an LLM and sent in private by Josef.
--- mm/hugetlb.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
mm/hugetlb.c +6 -2
@@ -6295,8 +6295,6 @@ static vm_fault_t hugetlb_no_page(struct address_space *mapping, ret =hugetlb_wp (vmf); } -spin_unlock (vmf->ptl); -/* * Only set hugetlb_migratable in newly allocated pages. Existing pages * found in the pagecache may not have hugetlb_migratable if they have
@@ -6307,6 +6305,12 @@ static vm_fault_t hugetlb_no_page(struct address_space *mapping,if (folio_locked)folio_unlock (folio); + +/* +* Hold the PTL until we're done with the folio: the page table owns the +* folio reference now. +*/ +spin_unlock (vmf->ptl); out:hugetlb_vma_unlock_read (vma);
Signature · 1 line
2.53.0