| Message ID | 20210322175132.36659-1-peterx@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | userfaultfd/hugetlbfs: Fix minor fault page leak | expand |
On 3/22/21 10:51 AM, Peter Xu wrote: > When uffd-minor enabled, we need to put the page cache before handling the > userfault in hugetlb_no_page(), otherwise the page refcount got leaked. > > This can be reproduced by running userfaultfd selftest with hugetlb_shared > mode, then cat /proc/meminfo. > > Cc: Axel Rasmussen <axelrasmussen@google.com> > Cc: Andrea Arcangeli <aarcange@redhat.com> > Cc: Mike Kravetz <mike.kravetz@oracle.com> > Cc: Mike Rapoport <rppt@linux.vnet.ibm.com> > Cc: Andrew Morton <akpm@linux-foundation.org> > Fixes: f2bf15fb0969 ("userfaultfd: add minor fault registration mode") > Signed-off-by: Peter Xu <peterx@redhat.com> > --- > mm/hugetlb.c | 1 + > 1 file changed, 1 insertion(+) Thanks for finding/fixing. Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com> I think this is just in Andrew's tree. So it will need to be fixed there.
On Mon, Mar 22, 2021 at 10:51 AM Peter Xu <peterx@redhat.com> wrote: > > When uffd-minor enabled, we need to put the page cache before handling the > userfault in hugetlb_no_page(), otherwise the page refcount got leaked. > > This can be reproduced by running userfaultfd selftest with hugetlb_shared > mode, then cat /proc/meminfo. > > Cc: Axel Rasmussen <axelrasmussen@google.com> > Cc: Andrea Arcangeli <aarcange@redhat.com> > Cc: Mike Kravetz <mike.kravetz@oracle.com> > Cc: Mike Rapoport <rppt@linux.vnet.ibm.com> > Cc: Andrew Morton <akpm@linux-foundation.org> > Fixes: f2bf15fb0969 ("userfaultfd: add minor fault registration mode") > Signed-off-by: Peter Xu <peterx@redhat.com> > --- > mm/hugetlb.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/mm/hugetlb.c b/mm/hugetlb.c > index 408dbc08298a..56b78a206913 100644 > --- a/mm/hugetlb.c > +++ b/mm/hugetlb.c > @@ -4449,6 +4449,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, > /* Check for page in userfault range. */ > if (userfaultfd_minor(vma)) { > unlock_page(page); > + put_page(page); > ret = hugetlb_handle_userfault(vma, mapping, idx, > flags, haddr, > VM_UFFD_MINOR); > -- > 2.26.2 > Thanks for the fix, Peter! I applied the patch and verified it does indeed fix the issue. Reviewed-by: Axel Rasmussen <axelrasmussen@google.com>
diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 408dbc08298a..56b78a206913 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -4449,6 +4449,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *mm, /* Check for page in userfault range. */ if (userfaultfd_minor(vma)) { unlock_page(page); + put_page(page); ret = hugetlb_handle_userfault(vma, mapping, idx, flags, haddr, VM_UFFD_MINOR);
When uffd-minor enabled, we need to put the page cache before handling the userfault in hugetlb_no_page(), otherwise the page refcount got leaked. This can be reproduced by running userfaultfd selftest with hugetlb_shared mode, then cat /proc/meminfo. Cc: Axel Rasmussen <axelrasmussen@google.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Mike Kravetz <mike.kravetz@oracle.com> Cc: Mike Rapoport <rppt@linux.vnet.ibm.com> Cc: Andrew Morton <akpm@linux-foundation.org> Fixes: f2bf15fb0969 ("userfaultfd: add minor fault registration mode") Signed-off-by: Peter Xu <peterx@redhat.com> --- mm/hugetlb.c | 1 + 1 file changed, 1 insertion(+)