[0/2] Fix prep_compound_gigantic_page ref count adjustment

Message

Mike Kravetz June 22, 2021, 2:14 a.m. UTC

These patches address the possible race between prep_compound_gigantic_page
and __page_cache_add_speculative as described by Jann Horn in [1].

The first patch simply removes the unnecessary/obsolete helper routine
prep_compound_huge_page to make the actual fix a little simpler.

The second patch is the actual fix and has a detailed explanation in the
commit message.

This potential issue has existed for almost 10 years and I am unaware of
anyone actually hitting the race.  I did not cc stable, but would be
happy to squash the patches and send to stable if anyone thinks that is
a good idea.

I could not think of a reliable way to recreate the issue for testing.
Rather, I 'simulated errors' to exercise all the error paths.

Mike Kravetz (2):
  hugetlb: remove prep_compound_huge_page cleanup
  hugetlb: address ref count racing in prep_compound_gigantic_page

 mm/hugetlb.c    | 99 ++++++++++++++++++++++++++++++++++++-------------
 mm/page_alloc.c |  1 -
 2 files changed, 73 insertions(+), 27 deletions(-)

Comments

Mike Kravetz June 22, 2021, 2:16 a.m. UTC | #1

On 6/21/21 7:14 PM, Mike Kravetz wrote:
> These patches address the possible race between prep_compound_gigantic_page
> and __page_cache_add_speculative as described by Jann Horn in [1].

Oops,

[1] https://lore.kernel.org/linux-mm/[e-mail]/