Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 17 Oct 2022 19:05:48 -0700
From:   Mike Kravetz <mike.kravetz@oracle.com>
To:     Rik van Riel <riel@surriel.com>
Cc:     linux-kernel@vger.kernel.org, linux-mm@kvack.org,
        stable@kernel.org, Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>,
        Glen McCready <gkmccready@meta.com>,
        Muchun Song <songmuchun@bytedance.com>,
        Andrew Morton <akpm@linux-foundation.org>, kernel-team@meta.com
Subject: Re: [PATCH] mm,hugetlb: take hugetlb_lock before decrementing
 h->resv_huge_pages
Message-ID: <Y04J/FxGLAhY+z6O@monkey>
References: <20221017202505.0e6a4fcd@imladris.surriel.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20221017202505.0e6a4fcd@imladris.surriel.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?KR9Ix4w/k/riZ2NH/IbAQYo5/kRcsikSoIsXakX+ua4j8XcxVczFXq9u3mpL?=
 =?us-ascii?Q?EuHDMs8dBfsyrCOJZOycpKmCjNtIw4fEnx4RC9Y4AlFC8e9yJZo3D3I8wXma?=
 =?us-ascii?Q?9YaCCiFrKz3/NB3YL8TIfXM1ars8Fa6SX2xyg+wvsHefg506RJAXljDlHQEY?=
 =?us-ascii?Q?zNpGK8GPo/QcO+bymrNHQuyNaI2fQQT8HJqUekRWDkBcND2g3jvV8szKphnP?=
 =?us-ascii?Q?nEsQ3Ex6PpPN4EJZeWjT5QKMr64UTCdR2GqsDmcc1Ow66wIvu4dyZar3R0K0?=
 =?us-ascii?Q?BubQpEKQbW/B6b2cnxo31KoBV68NYcgKbvcDpsY3gzR3cgygNNIBWvuuSgkH?=
 =?us-ascii?Q?2ByE0syEBpbeyRRkDIebgGfYfupbltyxB/KlyftJJwjqfCAMbp6qLv2DLYNs?=
 =?us-ascii?Q?ZwgeNLGi3/TLPTO49evwHzaTzVAvDu+vpKlGK0veMcEDCkfDiLBjDPYZ53a9?=
 =?us-ascii?Q?MXbWUMkZUb24W0jNZa9U+Ax8aDRbbGctPD7PCpaV9Zgaqa5S2sYmNTvgiCve?=
 =?us-ascii?Q?JzgtDZ+hrP2TEPcN1n066bWk/3ulObrsoxK9jeuJxWSd7YLOBmEeHhM64Zp2?=
 =?us-ascii?Q?ifl/bAOj56BbN62TuV29DTfiwYoGPohwehXacbSqQCdKO5Wt2R7TWwrMz0aw?=
 =?us-ascii?Q?pQ69zg1GMId0O+Jw6VWZoOET/mIjGJfcP7TbsnWaFufWTCSCAIy5TwXoYFZ1?=
 =?us-ascii?Q?LErUX8yJ/slWfLIWXiXyVf0G5OHdSfvdyK1ZrRdMzATmk4YtRVSFCIgwzIZt?=
 =?us-ascii?Q?O/QQR/RoV290/FL2uuU3vXiSiaH2oQxf3/OKWKYmymULYIBy3M50q/BV1gzw?=
 =?us-ascii?Q?9HNFN+J0MM4MXTC4TC2qiU0wVPSJA6PtWQVzl2ahzx9MVjXqJ44QRwerC+LM?=
 =?us-ascii?Q?p1X/poxngy9RDJt0MVXh4tKE74jM5Z8vGzv5CWgWwSQ8JjtqMhrqiBaWLAjY?=
 =?us-ascii?Q?Va0/yY/untkd0NZHoaeUEUOT+OvcU0zFVYVkC9vTriiM/ULabOLg3oUF5dnt?=
 =?us-ascii?Q?MNICRrFf+J4zZeR4oX9x+7KT/8ls7bKC5n5umPoFhWAA0GWyXRjO6Oc4/Zp0?=
 =?us-ascii?Q?iUyYumeor3YZwqRPU9weVDQWNtDJtj5BECj0ERcc68Gsz9iGu+UeTKNvryUo?=
 =?us-ascii?Q?1UBb3y1kLHWG/s71R9+VQWHz6hDuq2JzTcIFajLWhAT60PCgViq/qI/9Fbqe?=
 =?us-ascii?Q?r7u90+JAM53oay2W6EZEV+bFvqHMFK7hfiIwypwyaQZykPDph141NAfPUUtf?=
 =?us-ascii?Q?Gm46uxWz8wL91NGMbApQ8pXGYESB4YLiKMm4+6QQDauaEboHyqplQMzz8nkT?=
 =?us-ascii?Q?P02HDENj2iMRDFbQCA8NK9uxviS/64B/E+up8QydZ9jqCXJizcbyZI/fX5zu?=
 =?us-ascii?Q?PMujOsulAUpf63QHYvCS7JjQa16FYG7/xU4znTsijWpHNyuQXhYOLHh6YE+o?=
 =?us-ascii?Q?4/dqM7ZtiOE15V0+zc4YniCGPahc+PBuSdUplqsVby2GfNWuiNwl2jqsiXnn?=
 =?us-ascii?Q?PDQeMkApJfrFZVaaWrcbZLZGJOGXh2hnGySCpYBl7VevUurLMQ6gqEYRa9+c?=
 =?us-ascii?Q?qgrLVG0fvnoMyjCPYyCFpIH3i9/xNBWtORQiaKazY17EVznRuLSXegSRbIrC?=
 =?us-ascii?Q?Bw=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f9b2223e-ff2e-4cb2-5ab8-08dab0ad4847
X-MS-Exchange-CrossTenant-AuthSource: BY5PR10MB4196.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Oct 2022 02:05:52.2793
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: NXrjhxMp2lZT+O2V+BkpfMg0VGVgcOa4rfnLWbKzj0jja+CI66XxsM5q10Qux3zvl5A+EJYs8r5D+So0489k3Q==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR10MB4143
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-10-17_13,2022-10-17_02,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 adultscore=0 bulkscore=0
 malwarescore=0 phishscore=0 mlxlogscore=999 spamscore=0 mlxscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2209130000
 definitions=main-2210180010
X-Proofpoint-ORIG-GUID: IzODKGqVrJN7m9hI0ZiS8GgJjMuitoz1
X-Proofpoint-GUID: IzODKGqVrJN7m9hI0ZiS8GgJjMuitoz1
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 10/17/22 20:25, Rik van Riel wrote:
> The h->*_huge_pages counters are protected by the hugetlb_lock, but
> alloc_huge_page has a corner case where it can decrement the counter
> outside of the lock.
> 
> This could lead to a corrupted value of h->resv_huge_pages, which we
> have observed on our systems.
> 
> Take the hugetlb_lock before decrementing h->resv_huge_pages to avoid
> a potential race.
> 
> Fixes: a88c76954804 ("mm: hugetlb: fix hugepage memory leak caused by wrong reserve count")
> Cc: stable@kernel.org
> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
> Cc: Glen McCready <gkmccready@meta.com>
> Cc: Mike Kravetz <mike.kravetz@oracle.com>
> Cc: Muchun Song <songmuchun@bytedance.com>
> Cc: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Rik van Riel <riel@surriel.com>
> ---
>  mm/hugetlb.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Thanks Rik!  That case did slip through the cracks.

Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
-- 
Mike Kravetz

> 
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index b586cdd75930..dede0337c07c 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -2924,11 +2924,11 @@ struct page *alloc_huge_page(struct vm_area_struct *vma,
>  		page = alloc_buddy_huge_page_with_mpol(h, vma, addr);
>  		if (!page)
>  			goto out_uncharge_cgroup;
> +		spin_lock_irq(&hugetlb_lock);
>  		if (!avoid_reserve && vma_has_reserves(vma, gbl_chg)) {
>  			SetHPageRestoreReserve(page);
>  			h->resv_huge_pages--;
>  		}
> -		spin_lock_irq(&hugetlb_lock);
>  		list_add(&page->lru, &h->hugepage_activelist);
>  		set_page_refcounted(page);
>  		/* Fall through */
> -- 
> 2.37.2
> 
>