The patch titled Subject: mm,hwpoison: fix race with hugetlb page allocation has been removed from the -mm tree. Its filename was mmhwpoison-fix-race-with-hugetlb-page-allocation.patch

This patch was dropped because an updated version will be merged

------------------------------------------------------ From: Naoya Horiguchi naoya.horiguchi@nec.com Subject: mm,hwpoison: fix race with hugetlb page allocation

When hugetlb page fault (under overcommitting situation) and memory_failure() race, VM_BUG_ON_PAGE() is triggered by the following race:

CPU0: CPU1:

gather_surplus_pages() page = alloc_surplus_huge_page() memory_failure_hugetlb() get_hwpoison_page(page) __get_hwpoison_page(page) get_page_unless_zero(page) zero = put_page_testzero(page) VM_BUG_ON_PAGE(!zero, page) enqueue_huge_page(h, page) put_page(page)

__get_hwpoison_page() only checks the page refcount before taking an additional one for memory error handling, which is wrong because there's a time window where compound pages have non-zero refcount during initialization. So make __get_hwpoison_page() check page status a bit more for hugetlb pages.

Link: https://lkml.kernel.org/r/20210518231259.2553203-2-nao.horiguchi@gmail.com Fixes: ead07f6a867b ("mm/memory-failure: introduce get_hwpoison_page() for consistent refcount handling") Signed-off-by: Naoya Horiguchi naoya.horiguchi@nec.com Reported-by: Muchun Song songmuchun@bytedance.com Cc: Mike Kravetz mike.kravetz@oracle.com Cc: Michal Hocko mhocko@suse.com Cc: Tony Luck tony.luck@intel.com Cc: stable@vger.kernel.org [5.12+] Signed-off-by: Andrew Morton akpm@linux-foundation.org ---

include/linux/hugetlb.h | 6 ++++++ mm/hugetlb.c | 15 +++++++++++++++ mm/memory-failure.c | 8 +++++++- 3 files changed, 28 insertions(+), 1 deletion(-)

--- a/include/linux/hugetlb.h~mmhwpoison-fix-race-with-hugetlb-page-allocation +++ a/include/linux/hugetlb.h @@ -149,6 +149,7 @@ bool hugetlb_reserve_pages(struct inode long hugetlb_unreserve_pages(struct inode *inode, long start, long end, long freed); bool isolate_huge_page(struct page *page, struct list_head *list); +int get_hwpoison_huge_page(struct page *page, bool *hugetlb); void putback_active_hugepage(struct page *page); void move_hugetlb_state(struct page *oldpage, struct page *newpage, int reason); void free_huge_page(struct page *page); @@ -339,6 +340,11 @@ static inline bool isolate_huge_page(str return false; }

+static inline int get_hwpoison_huge_page(struct page *page, bool *hugetlb) +{ + return 0; +} + static inline void putback_active_hugepage(struct page *page) { } --- a/mm/hugetlb.c~mmhwpoison-fix-race-with-hugetlb-page-allocation +++ a/mm/hugetlb.c @@ -5847,6 +5847,21 @@ unlock: return ret; }

+int get_hwpoison_huge_page(struct page *page, bool *hugetlb) +{ + int ret = 0; + + *hugetlb = false; + spin_lock_irq(&hugetlb_lock); + if (PageHeadHuge(page)) { + *hugetlb = true; + if (HPageFreed(page) || HPageMigratable(page)) + ret = get_page_unless_zero(page); + } + spin_unlock_irq(&hugetlb_lock); + return ret; +} + void putback_active_hugepage(struct page *page) { spin_lock_irq(&hugetlb_lock); --- a/mm/memory-failure.c~mmhwpoison-fix-race-with-hugetlb-page-allocation +++ a/mm/memory-failure.c @@ -959,8 +959,14 @@ static int page_action(struct page_state static int __get_hwpoison_page(struct page *page) { struct page *head = compound_head(page); + int ret = 0; + bool hugetlb = false;

- if (!PageHuge(head) && PageTransHuge(head)) { + ret = get_hwpoison_huge_page(head, &hugetlb); + if (hugetlb) + return ret; + + if (PageTransHuge(head)) { /* * Non anonymous thp exists only in allocation/free time. We * can't handle such a case correctly, so let's give it up. _

Patches currently in -mm which might be from naoya.horiguchi@nec.com are

mmhwpoison-make-get_hwpoison_page-call-get_any_page.patch mmhwpoison-send-sigbus-with-error-virutal-address.patch