MIME-Version: 1.0
References: <20230218002819.1486479-1-jthoughton@google.com>
 <20230218002819.1486479-36-jthoughton@google.com> <CADrL8HUNO83XtYKxnrm_iWXweP4Wthy2TiodBZ3Tp=FOVa=ZPA@mail.gmail.com>
In-Reply-To: <CADrL8HUNO83XtYKxnrm_iWXweP4Wthy2TiodBZ3Tp=FOVa=ZPA@mail.gmail.com>
From:   James Houghton <jthoughton@google.com>
Date:   Fri, 24 Feb 2023 10:05:11 -0800
Message-ID: <CADrL8HVGFT+pwg1YmJHsADXrUQzYhRiAhQRybTHqW2CjYH0XWA@mail.gmail.com>
Subject: Re: [PATCH v2 35/46] hugetlb: add check to prevent refcount overflow
 via HGM
To:     Mike Kravetz <mike.kravetz@oracle.com>,
        Muchun Song <songmuchun@bytedance.com>,
        Peter Xu <peterx@redhat.com>,
        Andrew Morton <akpm@linux-foundation.org>
Cc:     David Hildenbrand <david@redhat.com>,
        David Rientjes <rientjes@google.com>,
        Axel Rasmussen <axelrasmussen@google.com>,
        Mina Almasry <almasrymina@google.com>,
        "Zach O'Keefe" <zokeefe@google.com>,
        Manish Mishra <manish.mishra@nutanix.com>,
        Naoya Horiguchi <naoya.horiguchi@nec.com>,
        "Dr . David Alan Gilbert" <dgilbert@redhat.com>,
        "Matthew Wilcox (Oracle)" <willy@infradead.org>,
        Vlastimil Babka <vbabka@suse.cz>,
        Baolin Wang <baolin.wang@linux.alibaba.com>,
        Miaohe Lin <linmiaohe@huawei.com>,
        Yang Shi <shy828301@gmail.com>,
        Frank van der Linden <fvdl@google.com>,
        Jiaqi Yan <jiaqiyan@google.com>, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Fri, Feb 24, 2023 at 9:42 AM James Houghton <jthoughton@google.com> wrote:
>
> > @@ -5397,7 +5397,10 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
> >                 } else {
> >                         ptepage = pte_page(entry);
> >                         hpage = compound_head(ptepage);
> > -                       get_page(hpage);
> > +                       if (try_get_page(hpage)) {
> > +                               ret = -EFAULT;
> > +                               break;
>
> spin_unlock(src_ptl) and spin_unlock(dst_ptl) is required here.
>
> I'll make sure there's a selftest that actually makes sure that
> refcount overflowing is handled gracefully for v3.

And this should be !try_get_page(). This hunk was a last-minute
addition to this commit; apparently I hadn't retested fork() after I
made this change. Sorry! The hugetlb-hgm selftest immediately catches
this problem.

- James