The patch titled Subject: hugetlb, userfaultfd: fix reservation restore on userfaultfd error has been added to the -mm tree. Its filename is hugetlb-userfaultfd-fix-reservation-restore-on-userfaultfd-error.patch
This patch should soon appear at https://ozlabs.org/~akpm/mmots/broken-out/hugetlb-userfaultfd-fix-reservatio... and later at https://ozlabs.org/~akpm/mmotm/broken-out/hugetlb-userfaultfd-fix-reservatio...
Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated there every 3-4 working days
------------------------------------------------------ From: Mina Almasry almasrymina@google.com Subject: hugetlb, userfaultfd: fix reservation restore on userfaultfd error
Currently in the is_continue case in hugetlb_mcopy_atomic_pte(), if we bail out using "goto out_release_unlock;" in the cases where idx >= size, or !huge_pte_none(), the code will detect that new_pagecache_page == false, and so call restore_reserve_on_error(). In this case I see restore_reserve_on_error() delete the reservation, and the following call to remove_inode_hugepages() will increment h->resv_hugepages causing a 100% reproducible leak.
We should treat the is_continue case similar to adding a page into the pagecache and set new_pagecache_page to true, to indicate that there is no reservation to restore on the error path, and we need not call restore_reserve_on_error().
Link: https://lkml.kernel.org/r/20211116235733.3774702-1-almasrymina@google.com Fixes: c7b1850dfb41 ("hugetlb: don't pass page cache pages to restore_reserve_on_error") Signed-off-by: Mina Almasry almasrymina@google.com Reported-by: James Houghton jthoughton@google.com Cc: Wei Xu weixugc@google.com Cc: Mike Kravetz mike.kravetz@oracle.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org ---
mm/hugetlb.c | 8 ++++++++ 1 file changed, 8 insertions(+)
--- a/mm/hugetlb.c~hugetlb-userfaultfd-fix-reservation-restore-on-userfaultfd-error +++ a/mm/hugetlb.c @@ -5743,6 +5743,14 @@ int hugetlb_mcopy_atomic_pte(struct mm_s page = find_lock_page(mapping, idx); if (!page) goto out; + /* + * Set new_pagecache_page to true, as we've added a page to the + * pagecache, but userfaultfd hasn't set up a mapping for this + * page yet. If we bail out before setting up the mapping, we + * want to indicate to restore_reserve_on_error() that we've + * added the page to the page cache. + */ + new_pagecache_page = true; } else if (!*pagep) { /* If a page already exists, then it's UFFDIO_COPY for * a non-missing case. Return -EEXIST. _
Patches currently in -mm which might be from almasrymina@google.com are
hugetlb-userfaultfd-fix-reservation-restore-on-userfaultfd-error.patch