diff mbox series

[V1,1/5] mm/filemap: fix filemap_get_folios_contig THP panic

Message ID 1725373521-451395-2-git-send-email-steven.sistare@oracle.com (mailing list archive)
State New
Headers show
Series memfd-pin huge page fixes | expand

Commit Message

Steven Sistare Sept. 3, 2024, 2:25 p.m. UTC 
memfd_pin_folios on memory backed by THP panics if the requested start
offset is not huge page aligned:

BUG: kernel NULL pointer dereference, address: 0000000000000036
RIP: 0010:filemap_get_folios_contig+0xdf/0x290
RSP: 0018:ffffc9002092fbe8 EFLAGS: 00010202
RAX: 0000000000000002 RBX: 0000000000000002 RCX: 0000000000000002

The fault occurs here, because xas_load returns a folio with value 2:

    filemap_get_folios_contig()
        for (folio = xas_load(&xas); folio && xas.xa_index <= end;
                        folio = xas_next(&xas)) {
                ...
                if (!folio_try_get(folio))   <-- BOOM

"2" is an xarray sibling entry.  We get it because memfd_pin_folios
does not round the indices passed to filemap_get_folios_contig to huge
page boundaries for THP, so we load from the middle of a huge page range
see a sibling.  (It does round for hugetlbfs, at the is_file_hugepages
test).

To fix, if the folio is a sibling, then return the next index as
the starting point for the next call to filemap_get_folios_contig.

Fixes: 89c1905d9c14 ("mm/gup: introduce memfd_pin_folios() for pinning memfd folios")

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
---
 mm/filemap.c | 4 ++++
 1 file changed, 4 insertions(+)
diff mbox series

Patch

diff --git a/mm/filemap.c b/mm/filemap.c
index af99bf9..c385b7a 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2183,6 +2183,10 @@  unsigned filemap_get_folios_contig(struct address_space *mapping,
 		if (xa_is_value(folio))
 			goto update_start;
 
+		/* If we landed in the middle of a THP, continue at its end. */
+		if (xa_is_sibling(folio))
+			goto update_start;
+
 		if (!folio_try_get(folio))
 			goto retry;