Linux kernel source tree
Go to file
Steve Sistare c225c4f605 mm/filemap: fix filemap_get_folios_contig THP panic
Patch series "memfd-pin huge page fixes".

Fix multiple bugs that occur when using memfd_pin_folios with hugetlb
pages and THP.  The hugetlb bugs only bite when the page is not yet
faulted in when memfd_pin_folios is called.  The THP bug bites when the
starting offset passed to memfd_pin_folios is not huge page aligned.  See
the commit messages for details.


This patch (of 5):

memfd_pin_folios on memory backed by THP panics if the requested start
offset is not huge page aligned:

BUG: kernel NULL pointer dereference, address: 0000000000000036
RIP: 0010:filemap_get_folios_contig+0xdf/0x290
RSP: 0018:ffffc9002092fbe8 EFLAGS: 00010202
RAX: 0000000000000002 RBX: 0000000000000002 RCX: 0000000000000002

The fault occurs here, because xas_load returns a folio with value 2:

    filemap_get_folios_contig()
        for (folio = xas_load(&xas); folio && xas.xa_index <= end;
                        folio = xas_next(&xas)) {
                ...
                if (!folio_try_get(folio))   <-- BOOM

"2" is an xarray sibling entry.  We get it because memfd_pin_folios does
not round the indices passed to filemap_get_folios_contig to huge page
boundaries for THP, so we load from the middle of a huge page range see a
sibling.  (It does round for hugetlbfs, at the is_file_hugepages test).

To fix, if the folio is a sibling, then return the next index as the
starting point for the next call to filemap_get_folios_contig.

Link: https://lkml.kernel.org/r/1725373521-451395-1-git-send-email-steven.sistare@oracle.com
Link: https://lkml.kernel.org/r/1725373521-451395-2-git-send-email-steven.sistare@oracle.com
Fixes: 89c1905d9c ("mm/gup: introduce memfd_pin_folios() for pinning memfd folios")
Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Jason Gunthorpe <jgg@nvidia.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Peter Xu <peterx@redhat.com>
Cc: Vivek Kasireddy <vivek.kasireddy@intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2024-09-26 14:01:43 -07:00
arch i2c-for-6.12-rc1 2024-09-23 14:34:19 -07:00
block vfs-6.12.blocksize 2024-09-20 17:53:17 -07:00
certs kbuild: use $(src) instead of $(srctree)/$(src) for source directory 2024-05-10 04:34:52 +09:00
crypto crypto: aegis128 - Fix indentation issue in crypto_aegis128_process_crypt() 2024-09-13 18:26:52 +08:00
Documentation media updates for v6.12-rc1 2024-09-23 15:27:58 -07:00
drivers media updates for v6.12-rc1 2024-09-23 15:27:58 -07:00
fs NFSD 6.12 Release Notes 2024-09-23 12:01:45 -07:00
include media updates for v6.12-rc1 2024-09-23 15:27:58 -07:00
init sched_ext: Initial pull request for v6.12 2024-09-21 09:44:57 -07:00
io_uring struct fd layout change (and conversion to accessor helpers) 2024-09-23 09:35:36 -07:00
ipc struct fd layout change (and conversion to accessor helpers) 2024-09-23 09:35:36 -07:00
kernel pci-v6.12-changes 2024-09-23 12:47:06 -07:00
lib The core clk framework is left largely untouched this time around except for 2024-09-23 15:01:48 -07:00
LICENSES LICENSES: add 0BSD license text 2024-09-01 20:43:24 -07:00
mm mm/filemap: fix filemap_get_folios_contig THP panic 2024-09-26 14:01:43 -07:00
net NFSD 6.12 Release Notes 2024-09-23 12:01:45 -07:00
rust Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-09-05 20:37:20 -07:00
samples bpf-next-6.12 2024-09-21 09:27:50 -07:00
scripts bpf-next-6.12 2024-09-21 09:27:50 -07:00
security struct fd layout change (and conversion to accessor helpers) 2024-09-23 09:35:36 -07:00
sound firewire updates for v6.12 2024-09-23 12:55:27 -07:00
tools tools: fix shared radix-tree build 2024-09-26 14:01:43 -07:00
usr initramfs: shorten cmd_initfs in usr/Makefile 2024-07-16 01:07:52 +09:00
virt struct fd layout change (and conversion to accessor helpers) 2024-09-23 09:35:36 -07:00
.clang-format Docs: Move clang-format from process/ to dev-tools/ 2024-06-26 16:36:00 -06:00
.cocciconfig
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-13 16:47:52 +02:00
.get_maintainer.ignore Add Jeff Kirsher to .get_maintainer.ignore 2024-03-08 11:36:54 +00:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore .gitignore: add .gcda files 2024-08-09 13:18:46 +01:00
.mailmap NFSD 6.12 Release Notes 2024-09-23 12:01:45 -07:00
.rustfmt.toml
COPYING
CREDITS MAINTAINERS: Mark powerpc spufs as orphaned 2024-08-19 21:27:56 +10:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig
MAINTAINERS media updates for v6.12-rc1 2024-09-23 15:27:58 -07:00
Makefile Linux 6.11 2024-09-15 16:57:56 +02:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.