Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Mike Kravetz <mike.kravetz@oracle.com>
To:     linux-kernel@vger.kernel.org, linux-mm@kvack.org
Cc:     Zi Yan <ziy@nvidia.com>, Davidlohr Bueso <dbueso@suse.de>,
        "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
        Andrea Arcangeli <aarcange@redhat.com>,
        Matthew Wilcox <willy@infradead.org>,
        Oscar Salvador <osalvador@suse.de>,
        Joao Martins <joao.m.martins@oracle.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        Mike Kravetz <mike.kravetz@oracle.com>, stable@vger.kernel.org
Subject: [PATCH 1/2] hugetlb: fix update_and_free_page contig page struct assumption
Date:   Wed, 17 Feb 2021 10:49:25 -0800
Message-Id: <20210217184926.33567-1-mike.kravetz@oracle.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from monkey.oracle.com (50.38.35.18) by MW2PR16CA0050.namprd16.prod.outlook.com (2603:10b6:907:1::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3868.27 via Frontend Transport; Wed, 17 Feb 2021 18:49:36 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 08a07dc0-f47f-4370-149d-08d8d374c65b
X-MS-TrafficTypeDiagnostic: BYAPR10MB3589:
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <BYAPR10MB358959A1069D6A90D06C1FCDE2869@BYAPR10MB3589.namprd10.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:1824;
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: XqIiUK9AiB4tRhs3QNOjIP122WlBy5VzRZEqPaVIkBqhsVKcBR395j05TQDzF6VWBqus1UHCJm2+PBS7FwLKVOINqQ49ylEvRZuO+nQ/evTDnreGQu3xJX1KhGvzJaubI49e0GXAtUYlfyxymo3IkO7O2o2xkKLc/zRfaGjSY2/LdPlSq/NgDyPGXQoD517Vcr5tFCUQKtxQ2So+AXTLExchd0g1+mwvJVGmD5nY7WnQ4sLLDdAGspDqeHH8YTYqOIaojvSYP1iLKgma6EfVxFVVaDfe6Z6iCs0Zn8/lprAkY1QtMtWAV991lZ1JB9ehkh1urYpfvVzo0e3B7ih1depkxmjKCyLIfM0Cx971gHwfxy/dRxEaO/j5uLUZWzUjygj2gQiVOENgSeEYH78qVpHBp7v/i5vbZrLVXq7LpaVV89vfnJfvDG+0Jq/HbbXOxn2+b7dPsjt0EyjvQSNHihiOZLXV3wquN7O/Pa4xJXlNoA7PQeHinQaJ9qi2NZ8O6MRll2+IP/eCi+QvBgbyBh10jQcnqcRORm9NpqXeDm53EmmWWYFWmn+Q5LjslowC+d6IBy4qJB7sTKXj5TGB/1q5hq3XvMi0dfAgciHGptg=
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BY5PR10MB4196.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(346002)(366004)(136003)(39860400002)(396003)(376002)(1076003)(4326008)(83380400001)(36756003)(6486002)(186003)(6666004)(2906002)(26005)(316002)(5660300002)(966005)(2616005)(54906003)(16526019)(7416002)(66946007)(15650500001)(66556008)(478600001)(52116002)(7696005)(8936002)(956004)(8676002)(44832011)(86362001)(66476007);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData: =?utf-8?B?dkxZR2t2WjR3TnRlL2VxejJScjlCVE81d3pjUHI1Tmo1UjVMRnB5S1RSNkNx?=
 =?utf-8?B?SjZsZTQzMjN6SHJtMU9KV2dBV3ZXZ1ZKMFliQzNsQW44UUtydlRhZGJjUEt2?=
 =?utf-8?B?L1gySzJMNW05UFZLZHhnd1hxMjUxYU9tc2xwRTBQVjF0Unk3U0tWZytlUHB0?=
 =?utf-8?B?VFNTLzNaamlxUWxNQk1tRTVGSlEyYVFZVWpMSHpMbmFCSkZyODYzUG1CR0ta?=
 =?utf-8?B?eUNveTUrSTcrUkhRWHgvbkFjalBxKzNsOFMyZlNsbk5UNi9uWHhZN1Azd2V2?=
 =?utf-8?B?c01qMkhoWUxqY0tnajBjZE1TZ0huMEVkR0N0TVhSbnpPTHNxVkt2Yy9xZ0FW?=
 =?utf-8?B?R3duZFMrVTd6MFlpbXpXV3d5cVF5RmFiUk1rL2NwNHBPa3BwVzVNVjlldUNO?=
 =?utf-8?B?VUxlSE4yTVNSRG84UVFqSXJ1M201VTdPWmJDZ2F5MDlvNTJOSzBEcEozd2tU?=
 =?utf-8?B?SFZVMytpaWt3dG93ZWd6ckF6VSs1NkJQbE0xbytRVGgwMHpkZ250ZU84dThp?=
 =?utf-8?B?WmF3U0hhTHVBeWlhTndoVjI1UDFmRmF3ZlRZUHJsNG43N0tJNm9KSjNUZHcz?=
 =?utf-8?B?VG0vdTd4aDhNTWViNXVJczhxUnN2TFJkLzQ2OTZlVDlFdXRpTW9HZG1HQmUw?=
 =?utf-8?B?TDRnaWN1RHJnc3JMWDZWbHN3NHNyRjFXOW5JK0xiWnBMcHhKQ3VkUlp2Q0tD?=
 =?utf-8?B?U2JHT3hwMXNXRUxDTWlEaEtVRE16U1JMU0RqOVdDSGRONFBiN0JIUUlROVdP?=
 =?utf-8?B?TEFvQytEWFlGd3JtUkNzaUd5OThYaGliUktJZHROTEdJdU1KY0QrTVA1eUc1?=
 =?utf-8?B?UVB2Um9EVndSUjhtdklhVXhXcC9aUlZqWnVkWmpmaGhtcVk5ZzZadWkyR2RC?=
 =?utf-8?B?NzU1ZnY1S21XSENBUHdnb2FSN3lJTG5sNlordDFhVWpSeXdDZTF3S0NGYzNS?=
 =?utf-8?B?cmVMME8rcnE0NDd2N0Q4UGNWUFZlQkowVTZyT0ZvY1FrVm80d2V6N1BPdFlj?=
 =?utf-8?B?aTF0VHNFb3BrL0ZnZUFkbnpqVklib1FkbVFUUFFHNUU3RHloeERFT0RNV1FE?=
 =?utf-8?B?dDV3R01GMHV3WmdmYzZ4QldpSzZZb2YwOEJYQm9tY2k5TkRJbTIyODlybnNm?=
 =?utf-8?B?MTIrVWd4OXJOT21XWDh1ajlmMExoTFFNNWdJdXViaVFPRkZocWsxMDRoOE9m?=
 =?utf-8?B?NHVzakRIWGVKa000dnpPTTgzN1NKV3ZOSThaWjJTR3ZMMER5MlNoaHNqVWdS?=
 =?utf-8?B?eVQ1cWRoem5iM1FmU0x2bzBKR2FubjRFMy9IVXcvYWlyZUVJMEpsMmlpb0F5?=
 =?utf-8?B?bk80QzdtNFp5UkZvT2J0Nk1PS056ZkZscXRIQ1FPeFowZ1VRSHd1MFRUbHBt?=
 =?utf-8?B?RXhxMTF1R2FwZUlHRGNGeWpKTHdZZVhYSEpwaU5LVFRmTm5vajgvQWJ2UGg5?=
 =?utf-8?B?TEd1S1EvQzBxdy8wQmV5aTZ3RDUweEhxMURSKzVnaFc2bVN0WTY2cmNQVTdh?=
 =?utf-8?B?aXg4UzhDRDJJOWdJQTh3K1dQRGxtTEl4dktrNUVHYkhzV1J0Y0g5Z29JRS9W?=
 =?utf-8?B?VzlqNnkzY2JpWmZkbkJTcUlLbmpJNUlBTmQwbmdaL01ZMkgvb1JJc2o5M0FM?=
 =?utf-8?B?ajRibWVGUDIzK2JqMlY3Tmo2QzVHejNmYU9tdjI0RExXNzMvRkxaV29KSEhQ?=
 =?utf-8?B?enAvbmUwN3owOGVhVEZCYjlHUXBqay92cXRFRXBsVVh0d2JKdjhTS2FjOEtO?=
 =?utf-8?Q?HqxhqNQzyPH+IdUqXfsAhCYGlZZUy7FCxIpznOj?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 08a07dc0-f47f-4370-149d-08d8d374c65b
X-MS-Exchange-CrossTenant-AuthSource: BY5PR10MB4196.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Feb 2021 18:49:37.3277
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: lrp7fCGvrEBvXH0d162YCN58kGFcC1ODWOX9iyCiumsEX/R+t24tLqDYdCQkMVJE67gRMk6SbzQ1qspLY2Y24w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR10MB3589
X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=9898 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 mlxlogscore=999
 phishscore=0 adultscore=0 mlxscore=0 suspectscore=0 malwarescore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2009150000 definitions=main-2102170135
X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=9898 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 clxscore=1011 impostorscore=0
 mlxscore=0 phishscore=0 mlxlogscore=999 spamscore=0 bulkscore=0
 priorityscore=1501 malwarescore=0 suspectscore=0 adultscore=0
 lowpriorityscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2009150000 definitions=main-2102170135
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

page structs are not guaranteed to be contiguous for gigantic pages.  The
routine update_and_free_page can encounter a gigantic page, yet it assumes
page structs are contiguous when setting page flags in subpages.

If update_and_free_page encounters non-contiguous page structs, we can
see “BUG: Bad page state in process …” errors.

Non-contiguous page structs are generally not an issue.  However, they can
exist with a specific kernel configuration and hotplug operations.  For
example: Configure the kernel with CONFIG_SPARSEMEM and
!CONFIG_SPARSEMEM_VMEMMAP.  Then, hotplug add memory for the area where the
gigantic page will be allocated.
Zi Yan outlined steps to reproduce here [1].

[1] https://lore.kernel.org/linux-mm/16F7C58B-4D79-41C5-9B64-A1A1628F4AF2@nvidia.com/

Fixes: 944d9fec8d7a ("hugetlb: add support for gigantic page allocation at runtime")
Signed-off-by: Zi Yan <ziy@nvidia.com>
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: <stable@vger.kernel.org>
---
 mm/hugetlb.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 4bdb58ab14cb..94e9fa803294 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1312,14 +1312,16 @@ static inline void destroy_compound_gigantic_page(struct page *page,
 static void update_and_free_page(struct hstate *h, struct page *page)
 {
 	int i;
+	struct page *subpage = page;
 
 	if (hstate_is_gigantic(h) && !gigantic_page_runtime_supported())
 		return;
 
 	h->nr_huge_pages--;
 	h->nr_huge_pages_node[page_to_nid(page)]--;
-	for (i = 0; i < pages_per_huge_page(h); i++) {
-		page[i].flags &= ~(1 << PG_locked | 1 << PG_error |
+	for (i = 0; i < pages_per_huge_page(h);
+	     i++, subpage = mem_map_next(subpage, page, i)) {
+		subpage->flags &= ~(1 << PG_locked | 1 << PG_error |
 				1 << PG_referenced | 1 << PG_dirty |
 				1 << PG_active | 1 << PG_private |
 				1 << PG_writeback);
-- 
2.29.2