2022-03-17 20:05:06

by Miaohe Lin

Subject: [PATCH v2 11/11] mm/migration: fix possible do_pages_stat_array racing with memory offline

When follow_page peeks a page, the page could be migrated and then be
offlined while it's still being used by the do_pages_stat_array().
Use FOLL_GET to hold the page refcnt to fix this potential race.

Signed-off-by: Miaohe Lin <[email protected]>
---
mm/migrate.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/mm/migrate.c b/mm/migrate.c
index dbd91fbdb127..cd85ba0ab592 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1807,13 +1807,18 @@ static void do_pages_stat_array(struct mm_struct *mm, unsigned long nr_pages,
goto set_status;

/* FOLL_DUMP to ignore special (like zero) pages */
- page = follow_page(vma, addr, FOLL_DUMP);
+ page = follow_page(vma, addr, FOLL_GET | FOLL_DUMP);

err = PTR_ERR(page);
if (IS_ERR(page))
goto set_status;

- err = page ? page_to_nid(page) : -ENOENT;
+ if (page) {
+ err = page_to_nid(page);
+ put_page(page);
+ } else {
+ err = -ENOENT;
+ }
set_status:
*status = err;

--
2.23.0

2022-03-18 07:48:05

by Muchun Song

Subject: Re: [PATCH v2 11/11] mm/migration: fix possible do_pages_stat_array racing with memory offline

On Thu, Mar 17, 2022 at 10:42 PM Miaohe Lin <[email protected]> wrote:
>
> When follow_page peeks a page, the page could be migrated and then be
> offlined while it's still being used by the do_pages_stat_array().
> Use FOLL_GET to hold the page refcnt to fix this potential race.
>
> Signed-off-by: Miaohe Lin <[email protected]>

Reviewed-by: Muchun Song <[email protected]>

2022-03-18 14:49:10

by Huang, Ying

Subject: Re: [PATCH v2 11/11] mm/migration: fix possible do_pages_stat_array racing with memory offline

Miaohe Lin <[email protected]> writes:

> When follow_page peeks a page, the page could be migrated and then be
> offlined while it's still being used by the do_pages_stat_array().
> Use FOLL_GET to hold the page refcnt to fix this potential race.
>
> Signed-off-by: Miaohe Lin <[email protected]>

Acked-by: "Huang, Ying" <[email protected]>

> ---
> mm/migrate.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/mm/migrate.c b/mm/migrate.c
> index dbd91fbdb127..cd85ba0ab592 100644
> --- a/mm/migrate.c
> +++ b/mm/migrate.c
> @@ -1807,13 +1807,18 @@ static void do_pages_stat_array(struct mm_struct *mm, unsigned long nr_pages,
> goto set_status;
>
> /* FOLL_DUMP to ignore special (like zero) pages */
> - page = follow_page(vma, addr, FOLL_DUMP);
> + page = follow_page(vma, addr, FOLL_GET | FOLL_DUMP);
>
> err = PTR_ERR(page);
> if (IS_ERR(page))
> goto set_status;
>
> - err = page ? page_to_nid(page) : -ENOENT;
> + if (page) {
> + err = page_to_nid(page);
> + put_page(page);
> + } else {
> + err = -ENOENT;
> + }
> set_status:
> *status = err;