diff for duplicates of <92845557-1e54-71b7-0501-4733005a8fc3@google.com> diff --git a/a/1.txt b/N1/1.txt index 66ba1f7..aaee841 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -1,215 +1,136 @@ -On Sun, 17 Nov 2024, gregkh@linuxfoundation.org wrote: -> -> The patch below does not apply to the 6.6-stable tree. -> If someone wants it applied there, or to any other stable or longterm -> tree, then please email the backport, including the original git commit -> id to <stable@vger.kernel.org>. -> -> To reproduce the conflict and resubmit, you may use the following commands: -> -> git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y -> git checkout FETCH_HEAD -> git cherry-pick -x 66edc3a5894c74f8887c8af23b97593a0dd0df4d -> # <resolve conflicts, build, test, etc.> -> git commit -s -> git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2024111714-varsity-grub-d888@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^.. +[ Sasha's backport helper bot ] -For 6.6 and 6.1 please use this replacement patch: +Hi, -From 9de12cbafdf2fae7d5bfdf14f4684ce3244469df Mon Sep 17 00:00:00 2001 -From: Roman Gushchin <roman.gushchin@linux.dev> -Date: Wed, 6 Nov 2024 19:53:54 +0000 -Subject: [PATCH] mm: page_alloc: move mlocked flag clearance into - free_pages_prepare() +The upstream commit SHA1 provided is correct: 66edc3a5894c74f8887c8af23b97593a0dd0df4d -commit 66edc3a5894c74f8887c8af23b97593a0dd0df4d upstream. +WARNING: Author mismatch between patch and upstream commit: +Backport author: Hugh Dickins <hughd@google.com> +Commit author: Roman Gushchin <roman.gushchin@linux.dev> -Syzbot reported a bad page state problem caused by a page being freed -using free_page() still having a mlocked flag at free_pages_prepare() -stage: +Commit in newer trees: - BUG: Bad page state in process syz.5.504 pfn:61f45 - page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61f45 - flags: 0xfff00000080204(referenced|workingset|mlocked|node=0|zone=1|lastcpupid=0x7ff) - raw: 00fff00000080204 0000000000000000 dead000000000122 0000000000000000 - raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 - page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set - page_owner tracks the page as allocated - page last allocated via order 0, migratetype Unmovable, gfp_mask 0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), pid 8443, tgid 8442 (syz.5.504), ts 201884660643, free_ts 201499827394 - set_page_owner include/linux/page_owner.h:32 [inline] - post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537 - prep_new_page mm/page_alloc.c:1545 [inline] - get_page_from_freelist+0x303f/0x3190 mm/page_alloc.c:3457 - __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4733 - alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 - kvm_coalesced_mmio_init+0x1f/0xf0 virt/kvm/coalesced_mmio.c:99 - kvm_create_vm virt/kvm/kvm_main.c:1235 [inline] - kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5488 [inline] - kvm_dev_ioctl+0x12dc/0x2240 virt/kvm/kvm_main.c:5530 - __do_compat_sys_ioctl fs/ioctl.c:1007 [inline] - __se_compat_sys_ioctl+0x510/0xc90 fs/ioctl.c:950 - do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] - __do_fast_syscall_32+0xb4/0x110 arch/x86/entry/common.c:386 - do_fast_syscall_32+0x34/0x80 arch/x86/entry/common.c:411 - entry_SYSENTER_compat_after_hwframe+0x84/0x8e - page last free pid 8399 tgid 8399 stack trace: - reset_page_owner include/linux/page_owner.h:25 [inline] - free_pages_prepare mm/page_alloc.c:1108 [inline] - free_unref_folios+0xf12/0x18d0 mm/page_alloc.c:2686 - folios_put_refs+0x76c/0x860 mm/swap.c:1007 - free_pages_and_swap_cache+0x5c8/0x690 mm/swap_state.c:335 - __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline] - tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] - tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] - tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373 - tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465 - exit_mmap+0x496/0xc40 mm/mmap.c:1926 - __mmput+0x115/0x390 kernel/fork.c:1348 - exit_mm+0x220/0x310 kernel/exit.c:571 - do_exit+0x9b2/0x28e0 kernel/exit.c:926 - do_group_exit+0x207/0x2c0 kernel/exit.c:1088 - __do_sys_exit_group kernel/exit.c:1099 [inline] - __se_sys_exit_group kernel/exit.c:1097 [inline] - __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097 - x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 - do_syscall_x64 arch/x86/entry/common.c:52 [inline] - do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 - entry_SYSCALL_64_after_hwframe+0x77/0x7f - Modules linked in: - CPU: 0 UID: 0 PID: 8442 Comm: syz.5.504 Not tainted 6.12.0-rc6-syzkaller #0 - Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 - Call Trace: - <TASK> - __dump_stack lib/dump_stack.c:94 [inline] - dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 - bad_page+0x176/0x1d0 mm/page_alloc.c:501 - free_page_is_bad mm/page_alloc.c:918 [inline] - free_pages_prepare mm/page_alloc.c:1100 [inline] - free_unref_page+0xed0/0xf20 mm/page_alloc.c:2638 - kvm_destroy_vm virt/kvm/kvm_main.c:1327 [inline] - kvm_put_kvm+0xc75/0x1350 virt/kvm/kvm_main.c:1386 - kvm_vcpu_release+0x54/0x60 virt/kvm/kvm_main.c:4143 - __fput+0x23f/0x880 fs/file_table.c:431 - task_work_run+0x24f/0x310 kernel/task_work.c:239 - exit_task_work include/linux/task_work.h:43 [inline] - do_exit+0xa2f/0x28e0 kernel/exit.c:939 - do_group_exit+0x207/0x2c0 kernel/exit.c:1088 - __do_sys_exit_group kernel/exit.c:1099 [inline] - __se_sys_exit_group kernel/exit.c:1097 [inline] - __ia32_sys_exit_group+0x3f/0x40 kernel/exit.c:1097 - ia32_sys_call+0x2624/0x2630 arch/x86/include/generated/asm/syscalls_32.h:253 - do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] - __do_fast_syscall_32+0xb4/0x110 arch/x86/entry/common.c:386 - do_fast_syscall_32+0x34/0x80 arch/x86/entry/common.c:411 - entry_SYSENTER_compat_after_hwframe+0x84/0x8e - RIP: 0023:0xf745d579 - Code: Unable to access opcode bytes at 0xf745d54f. - RSP: 002b:00000000f75afd6c EFLAGS: 00000206 ORIG_RAX: 00000000000000fc - RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000 - RDX: 0000000000000000 RSI: 00000000ffffff9c RDI: 00000000f744cff4 - RBP: 00000000f717ae61 R08: 0000000000000000 R09: 0000000000000000 - R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 - R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 - </TASK> +|-----------------|----------------------------------------------| +| 6.11.y | Present (different SHA1: fa484b40621a) | +| 6.6.y | Not found | +|-----------------|----------------------------------------------| -The problem was originally introduced by commit b109b87050df ("mm/munlock: -replace clear_page_mlock() by final clearance"): it was focused on -handling pagecache and anonymous memory and wasn't suitable for lower -level get_page()/free_page() API's used for example by KVM, as with this -reproducer. - -Fix it by moving the mlocked flag clearance down to free_page_prepare(). - -The bug itself if fairly old and harmless (aside from generating these -warnings), aside from a small memory leak - "bad" pages are stopped from -being allocated again. - -Link: https://lkml.kernel.org/r/20241106195354.270757-1-roman.gushchin@linux.dev -Fixes: b109b87050df ("mm/munlock: replace clear_page_mlock() by final clearance") -Signed-off-by: Roman Gushchin <roman.gushchin@linux.dev> -Reported-by: syzbot+e985d3026c4fd041578e@syzkaller.appspotmail.com -Closes: https://lore.kernel.org/all/6729f475.050a0220.701a.0019.GAE@google.com -Acked-by: Hugh Dickins <hughd@google.com> -Cc: Matthew Wilcox <willy@infradead.org> -Cc: Sean Christopherson <seanjc@google.com> -Cc: Vlastimil Babka <vbabka@suse.cz> -Cc: <stable@vger.kernel.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Hugh Dickins <hughd@google.com> +Note: The patch differs from the upstream commit: --- - mm/page_alloc.c | 15 +++++++++++++++ - mm/swap.c | 20 -------------------- - 2 files changed, 15 insertions(+), 20 deletions(-) - -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 7272a922b838..3d7e685bdd0b 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -1082,12 +1082,27 @@ static __always_inline bool free_pages_prepare(struct page *page, - int bad = 0; - bool skip_kasan_poison = should_skip_kasan_poison(page, fpi_flags); - bool init = want_init_on_free(); -+ struct folio *folio = page_folio(page); - - VM_BUG_ON_PAGE(PageTail(page), page); - - trace_mm_page_free(page, order); - kmsan_free_page(page, order); - -+ /* -+ * In rare cases, when truncation or holepunching raced with -+ * munlock after VM_LOCKED was cleared, Mlocked may still be -+ * found set here. This does not indicate a problem, unless -+ * "unevictable_pgs_cleared" appears worryingly large. -+ */ -+ if (unlikely(folio_test_mlocked(folio))) { -+ long nr_pages = folio_nr_pages(folio); +--- - 2024-11-18 16:46:31.817057604 -0500 ++++ /tmp/tmp.r9qovxR4fN 2024-11-18 16:46:31.809104506 -0500 +@@ -1,3 +1,13 @@ ++For 6.6 and 6.1 please use this replacement patch: + -+ __folio_clear_mlocked(folio); -+ zone_stat_mod_folio(folio, NR_MLOCK, -nr_pages); -+ count_vm_events(UNEVICTABLE_PGCLEARED, nr_pages); -+ } ++>From 9de12cbafdf2fae7d5bfdf14f4684ce3244469df Mon Sep 17 00:00:00 2001 ++From: Roman Gushchin <roman.gushchin@linux.dev> ++Date: Wed, 6 Nov 2024 19:53:54 +0000 ++Subject: [PATCH] mm: page_alloc: move mlocked flag clearance into ++ free_pages_prepare() + - if (unlikely(PageHWPoison(page)) && !order) { - /* - * Do not let hwpoison pages hit pcplists/buddy -diff --git a/mm/swap.c b/mm/swap.c -index cd8f0150ba3a..42082eba42de 100644 ---- a/mm/swap.c -+++ b/mm/swap.c -@@ -89,14 +89,6 @@ static void __page_cache_release(struct folio *folio) - __folio_clear_lru_flags(folio); - unlock_page_lruvec_irqrestore(lruvec, flags); - } -- /* See comment on folio_test_mlocked in release_pages() */ -- if (unlikely(folio_test_mlocked(folio))) { -- long nr_pages = folio_nr_pages(folio); -- -- __folio_clear_mlocked(folio); -- zone_stat_mod_folio(folio, NR_MLOCK, -nr_pages); -- count_vm_events(UNEVICTABLE_PGCLEARED, nr_pages); -- } - } - - static void __folio_put_small(struct folio *folio) -@@ -1021,18 +1013,6 @@ void release_pages(release_pages_arg arg, int nr) - __folio_clear_lru_flags(folio); - } ++commit 66edc3a5894c74f8887c8af23b97593a0dd0df4d upstream. ++ + Syzbot reported a bad page state problem caused by a page being freed + using free_page() still having a mlocked flag at free_pages_prepare() + stage: +@@ -109,26 +119,26 @@ + Cc: Vlastimil Babka <vbabka@suse.cz> + Cc: <stable@vger.kernel.org> + Signed-off-by: Andrew Morton <akpm@linux-foundation.org> ++Signed-off-by: Hugh Dickins <hughd@google.com> + --- + mm/page_alloc.c | 15 +++++++++++++++ +- mm/swap.c | 14 -------------- +- 2 files changed, 15 insertions(+), 14 deletions(-) ++ mm/swap.c | 20 -------------------- ++ 2 files changed, 15 insertions(+), 20 deletions(-) -- /* -- * In rare cases, when truncation or holepunching raced with -- * munlock after VM_LOCKED was cleared, Mlocked may still be -- * found set here. This does not indicate a problem, unless -- * "unevictable_pgs_cleared" appears worryingly large. -- */ -- if (unlikely(folio_test_mlocked(folio))) { -- __folio_clear_mlocked(folio); -- zone_stat_sub_folio(folio, NR_MLOCK); -- count_vm_event(UNEVICTABLE_PGCLEARED); -- } -- - list_add(&folio->lru, &pages_to_free); - } - if (lruvec) --- -2.47.0.338.g60cca15819-goog + diff --git a/mm/page_alloc.c b/mm/page_alloc.c +-index c6c7bb3ea71bc..216fbbfbedcf9 100644 ++index 7272a922b838..3d7e685bdd0b 100644 + --- a/mm/page_alloc.c + +++ b/mm/page_alloc.c +-@@ -1048,6 +1048,7 @@ __always_inline bool free_pages_prepare(struct page *page, +- bool skip_kasan_poison = should_skip_kasan_poison(page); ++@@ -1082,12 +1082,27 @@ static __always_inline bool free_pages_prepare(struct page *page, ++ int bad = 0; ++ bool skip_kasan_poison = should_skip_kasan_poison(page, fpi_flags); + bool init = want_init_on_free(); +- bool compound = PageCompound(page); + + struct folio *folio = page_folio(page); + + VM_BUG_ON_PAGE(PageTail(page), page); + +-@@ -1057,6 +1058,20 @@ __always_inline bool free_pages_prepare(struct page *page, +- if (memcg_kmem_online() && PageMemcgKmem(page)) +- __memcg_kmem_uncharge_page(page, order); ++ trace_mm_page_free(page, order); ++ kmsan_free_page(page, order); + + + /* + + * In rare cases, when truncation or holepunching raced with +@@ -145,23 +155,17 @@ + + } + + + if (unlikely(PageHWPoison(page)) && !order) { +- /* Do not let hwpoison pages hit pcplists/buddy */ +- reset_page_owner(page, order); ++ /* ++ * Do not let hwpoison pages hit pcplists/buddy + diff --git a/mm/swap.c b/mm/swap.c +-index b8e3259ea2c47..59f30a981c6f9 100644 ++index cd8f0150ba3a..42082eba42de 100644 + --- a/mm/swap.c + +++ b/mm/swap.c +-@@ -78,20 +78,6 @@ static void __page_cache_release(struct folio *folio, struct lruvec **lruvecp, +- lruvec_del_folio(*lruvecp, folio); ++@@ -89,14 +89,6 @@ static void __page_cache_release(struct folio *folio) + __folio_clear_lru_flags(folio); ++ unlock_page_lruvec_irqrestore(lruvec, flags); + } +-- +-- /* +-- * In rare cases, when truncation or holepunching raced with +-- * munlock after VM_LOCKED was cleared, Mlocked may still be +-- * found set here. This does not indicate a problem, unless +-- * "unevictable_pgs_cleared" appears worryingly large. +-- */ ++- /* See comment on folio_test_mlocked in release_pages() */ + - if (unlikely(folio_test_mlocked(folio))) { + - long nr_pages = folio_nr_pages(folio); + - +@@ -171,4 +175,26 @@ + - } + } + +- /* ++ static void __folio_put_small(struct folio *folio) ++@@ -1021,18 +1013,6 @@ void release_pages(release_pages_arg arg, int nr) ++ __folio_clear_lru_flags(folio); ++ } ++ ++- /* ++- * In rare cases, when truncation or holepunching raced with ++- * munlock after VM_LOCKED was cleared, Mlocked may still be ++- * found set here. This does not indicate a problem, unless ++- * "unevictable_pgs_cleared" appears worryingly large. ++- */ ++- if (unlikely(folio_test_mlocked(folio))) { ++- __folio_clear_mlocked(folio); ++- zone_stat_sub_folio(folio, NR_MLOCK); ++- count_vm_event(UNEVICTABLE_PGCLEARED); ++- } ++- ++ list_add(&folio->lru, &pages_to_free); ++ } ++ if (lruvec) ++-- ++2.47.0.338.g60cca15819-goog ++ +--- + +Results of testing on various branches: + +| Branch | Patch Apply | Build Test | +|---------------------------|-------------|------------| +| stable/linux-6.6.y | Success | Success | diff --git a/a/content_digest b/N1/content_digest index ec6492f..a598559 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -1,231 +1,146 @@ - "ref\02024111714-varsity-grub-d888@gregkh\0" - "From\0Hugh Dickins <hughd@google.com>\0" + "From\0Sasha Levin <sashal@kernel.org>\0" "Subject\0Re: FAILED: patch \"[PATCH] mm: page_alloc: move mlocked flag clearance into\" failed to apply to 6.6-stable tree\0" - "Date\0Mon, 18 Nov 2024 11:28:42 -0800 (PST)\0" - "To\0gregkh@linuxfoundation.org\0" - "Cc\0roman.gushchin@linux.dev" - akpm@linux-foundation.org - hughd@google.com - seanjc@google.com - stable@vger.kernel.org - vbabka@suse.cz - " willy@infradead.org\0" + "Date\0Mon, 18 Nov 2024 23:36:29 -0500\0" + "To\0stable@vger.kernel.org\0" + "Cc\0Hugh Dickins <hughd@google.com>" + " Sasha Levin <sashal@kernel.org>\0" "\00:1\0" "b\0" - "On Sun, 17 Nov 2024, gregkh@linuxfoundation.org wrote:\n" - "> \n" - "> The patch below does not apply to the 6.6-stable tree.\n" - "> If someone wants it applied there, or to any other stable or longterm\n" - "> tree, then please email the backport, including the original git commit\n" - "> id to <stable@vger.kernel.org>.\n" - "> \n" - "> To reproduce the conflict and resubmit, you may use the following commands:\n" - "> \n" - "> git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y\n" - "> git checkout FETCH_HEAD\n" - "> git cherry-pick -x 66edc3a5894c74f8887c8af23b97593a0dd0df4d\n" - "> # <resolve conflicts, build, test, etc.>\n" - "> git commit -s\n" - "> git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2024111714-varsity-grub-d888@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^..\n" + "[ Sasha's backport helper bot ]\n" "\n" - "For 6.6 and 6.1 please use this replacement patch:\n" + "Hi,\n" "\n" - "From 9de12cbafdf2fae7d5bfdf14f4684ce3244469df Mon Sep 17 00:00:00 2001\n" - "From: Roman Gushchin <roman.gushchin@linux.dev>\n" - "Date: Wed, 6 Nov 2024 19:53:54 +0000\n" - "Subject: [PATCH] mm: page_alloc: move mlocked flag clearance into\n" - " free_pages_prepare()\n" + "The upstream commit SHA1 provided is correct: 66edc3a5894c74f8887c8af23b97593a0dd0df4d\n" "\n" - "commit 66edc3a5894c74f8887c8af23b97593a0dd0df4d upstream.\n" + "WARNING: Author mismatch between patch and upstream commit:\n" + "Backport author: Hugh Dickins <hughd@google.com>\n" + "Commit author: Roman Gushchin <roman.gushchin@linux.dev>\n" "\n" - "Syzbot reported a bad page state problem caused by a page being freed\n" - "using free_page() still having a mlocked flag at free_pages_prepare()\n" - "stage:\n" + "Commit in newer trees:\n" "\n" - " BUG: Bad page state in process syz.5.504 pfn:61f45\n" - " page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61f45\n" - " flags: 0xfff00000080204(referenced|workingset|mlocked|node=0|zone=1|lastcpupid=0x7ff)\n" - " raw: 00fff00000080204 0000000000000000 dead000000000122 0000000000000000\n" - " raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n" - " page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set\n" - " page_owner tracks the page as allocated\n" - " page last allocated via order 0, migratetype Unmovable, gfp_mask 0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), pid 8443, tgid 8442 (syz.5.504), ts 201884660643, free_ts 201499827394\n" - " set_page_owner include/linux/page_owner.h:32 [inline]\n" - " post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537\n" - " prep_new_page mm/page_alloc.c:1545 [inline]\n" - " get_page_from_freelist+0x303f/0x3190 mm/page_alloc.c:3457\n" - " __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4733\n" - " alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265\n" - " kvm_coalesced_mmio_init+0x1f/0xf0 virt/kvm/coalesced_mmio.c:99\n" - " kvm_create_vm virt/kvm/kvm_main.c:1235 [inline]\n" - " kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5488 [inline]\n" - " kvm_dev_ioctl+0x12dc/0x2240 virt/kvm/kvm_main.c:5530\n" - " __do_compat_sys_ioctl fs/ioctl.c:1007 [inline]\n" - " __se_compat_sys_ioctl+0x510/0xc90 fs/ioctl.c:950\n" - " do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]\n" - " __do_fast_syscall_32+0xb4/0x110 arch/x86/entry/common.c:386\n" - " do_fast_syscall_32+0x34/0x80 arch/x86/entry/common.c:411\n" - " entry_SYSENTER_compat_after_hwframe+0x84/0x8e\n" - " page last free pid 8399 tgid 8399 stack trace:\n" - " reset_page_owner include/linux/page_owner.h:25 [inline]\n" - " free_pages_prepare mm/page_alloc.c:1108 [inline]\n" - " free_unref_folios+0xf12/0x18d0 mm/page_alloc.c:2686\n" - " folios_put_refs+0x76c/0x860 mm/swap.c:1007\n" - " free_pages_and_swap_cache+0x5c8/0x690 mm/swap_state.c:335\n" - " __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]\n" - " tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]\n" - " tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]\n" - " tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373\n" - " tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465\n" - " exit_mmap+0x496/0xc40 mm/mmap.c:1926\n" - " __mmput+0x115/0x390 kernel/fork.c:1348\n" - " exit_mm+0x220/0x310 kernel/exit.c:571\n" - " do_exit+0x9b2/0x28e0 kernel/exit.c:926\n" - " do_group_exit+0x207/0x2c0 kernel/exit.c:1088\n" - " __do_sys_exit_group kernel/exit.c:1099 [inline]\n" - " __se_sys_exit_group kernel/exit.c:1097 [inline]\n" - " __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097\n" - " x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232\n" - " do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n" - " do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n" - " entry_SYSCALL_64_after_hwframe+0x77/0x7f\n" - " Modules linked in:\n" - " CPU: 0 UID: 0 PID: 8442 Comm: syz.5.504 Not tainted 6.12.0-rc6-syzkaller #0\n" - " Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n" - " Call Trace:\n" - " <TASK>\n" - " __dump_stack lib/dump_stack.c:94 [inline]\n" - " dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n" - " bad_page+0x176/0x1d0 mm/page_alloc.c:501\n" - " free_page_is_bad mm/page_alloc.c:918 [inline]\n" - " free_pages_prepare mm/page_alloc.c:1100 [inline]\n" - " free_unref_page+0xed0/0xf20 mm/page_alloc.c:2638\n" - " kvm_destroy_vm virt/kvm/kvm_main.c:1327 [inline]\n" - " kvm_put_kvm+0xc75/0x1350 virt/kvm/kvm_main.c:1386\n" - " kvm_vcpu_release+0x54/0x60 virt/kvm/kvm_main.c:4143\n" - " __fput+0x23f/0x880 fs/file_table.c:431\n" - " task_work_run+0x24f/0x310 kernel/task_work.c:239\n" - " exit_task_work include/linux/task_work.h:43 [inline]\n" - " do_exit+0xa2f/0x28e0 kernel/exit.c:939\n" - " do_group_exit+0x207/0x2c0 kernel/exit.c:1088\n" - " __do_sys_exit_group kernel/exit.c:1099 [inline]\n" - " __se_sys_exit_group kernel/exit.c:1097 [inline]\n" - " __ia32_sys_exit_group+0x3f/0x40 kernel/exit.c:1097\n" - " ia32_sys_call+0x2624/0x2630 arch/x86/include/generated/asm/syscalls_32.h:253\n" - " do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]\n" - " __do_fast_syscall_32+0xb4/0x110 arch/x86/entry/common.c:386\n" - " do_fast_syscall_32+0x34/0x80 arch/x86/entry/common.c:411\n" - " entry_SYSENTER_compat_after_hwframe+0x84/0x8e\n" - " RIP: 0023:0xf745d579\n" - " Code: Unable to access opcode bytes at 0xf745d54f.\n" - " RSP: 002b:00000000f75afd6c EFLAGS: 00000206 ORIG_RAX: 00000000000000fc\n" - " RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000000000\n" - " RDX: 0000000000000000 RSI: 00000000ffffff9c RDI: 00000000f744cff4\n" - " RBP: 00000000f717ae61 R08: 0000000000000000 R09: 0000000000000000\n" - " R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000\n" - " R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n" - " </TASK>\n" + "|-----------------|----------------------------------------------|\n" + "| 6.11.y | Present (different SHA1: fa484b40621a) |\n" + "| 6.6.y | Not found |\n" + "|-----------------|----------------------------------------------|\n" "\n" - "The problem was originally introduced by commit b109b87050df (\"mm/munlock:\n" - "replace clear_page_mlock() by final clearance\"): it was focused on\n" - "handling pagecache and anonymous memory and wasn't suitable for lower\n" - "level get_page()/free_page() API's used for example by KVM, as with this\n" - "reproducer.\n" - "\n" - "Fix it by moving the mlocked flag clearance down to free_page_prepare().\n" - "\n" - "The bug itself if fairly old and harmless (aside from generating these\n" - "warnings), aside from a small memory leak - \"bad\" pages are stopped from\n" - "being allocated again.\n" - "\n" - "Link: https://lkml.kernel.org/r/20241106195354.270757-1-roman.gushchin@linux.dev\n" - "Fixes: b109b87050df (\"mm/munlock: replace clear_page_mlock() by final clearance\")\n" - "Signed-off-by: Roman Gushchin <roman.gushchin@linux.dev>\n" - "Reported-by: syzbot+e985d3026c4fd041578e@syzkaller.appspotmail.com\n" - "Closes: https://lore.kernel.org/all/6729f475.050a0220.701a.0019.GAE@google.com\n" - "Acked-by: Hugh Dickins <hughd@google.com>\n" - "Cc: Matthew Wilcox <willy@infradead.org>\n" - "Cc: Sean Christopherson <seanjc@google.com>\n" - "Cc: Vlastimil Babka <vbabka@suse.cz>\n" - "Cc: <stable@vger.kernel.org>\n" - "Signed-off-by: Andrew Morton <akpm@linux-foundation.org>\n" - "Signed-off-by: Hugh Dickins <hughd@google.com>\n" + "Note: The patch differs from the upstream commit:\n" "---\n" - " mm/page_alloc.c | 15 +++++++++++++++\n" - " mm/swap.c | 20 --------------------\n" - " 2 files changed, 15 insertions(+), 20 deletions(-)\n" - "\n" - "diff --git a/mm/page_alloc.c b/mm/page_alloc.c\n" - "index 7272a922b838..3d7e685bdd0b 100644\n" - "--- a/mm/page_alloc.c\n" - "+++ b/mm/page_alloc.c\n" - "@@ -1082,12 +1082,27 @@ static __always_inline bool free_pages_prepare(struct page *page,\n" - " \tint bad = 0;\n" - " \tbool skip_kasan_poison = should_skip_kasan_poison(page, fpi_flags);\n" - " \tbool init = want_init_on_free();\n" - "+\tstruct folio *folio = page_folio(page);\n" - " \n" - " \tVM_BUG_ON_PAGE(PageTail(page), page);\n" - " \n" - " \ttrace_mm_page_free(page, order);\n" - " \tkmsan_free_page(page, order);\n" - " \n" - "+\t/*\n" - "+\t * In rare cases, when truncation or holepunching raced with\n" - "+\t * munlock after VM_LOCKED was cleared, Mlocked may still be\n" - "+\t * found set here. This does not indicate a problem, unless\n" - "+\t * \"unevictable_pgs_cleared\" appears worryingly large.\n" - "+\t */\n" - "+\tif (unlikely(folio_test_mlocked(folio))) {\n" - "+\t\tlong nr_pages = folio_nr_pages(folio);\n" + "--- -\t2024-11-18 16:46:31.817057604 -0500\n" + "+++ /tmp/tmp.r9qovxR4fN\t2024-11-18 16:46:31.809104506 -0500\n" + "@@ -1,3 +1,13 @@\n" + "+For 6.6 and 6.1 please use this replacement patch:\n" "+\n" - "+\t\t__folio_clear_mlocked(folio);\n" - "+\t\tzone_stat_mod_folio(folio, NR_MLOCK, -nr_pages);\n" - "+\t\tcount_vm_events(UNEVICTABLE_PGCLEARED, nr_pages);\n" - "+\t}\n" + "+>From 9de12cbafdf2fae7d5bfdf14f4684ce3244469df Mon Sep 17 00:00:00 2001\n" + "+From: Roman Gushchin <roman.gushchin@linux.dev>\n" + "+Date: Wed, 6 Nov 2024 19:53:54 +0000\n" + "+Subject: [PATCH] mm: page_alloc: move mlocked flag clearance into\n" + "+ free_pages_prepare()\n" "+\n" - " \tif (unlikely(PageHWPoison(page)) && !order) {\n" - " \t\t/*\n" - " \t\t * Do not let hwpoison pages hit pcplists/buddy\n" - "diff --git a/mm/swap.c b/mm/swap.c\n" - "index cd8f0150ba3a..42082eba42de 100644\n" - "--- a/mm/swap.c\n" - "+++ b/mm/swap.c\n" - "@@ -89,14 +89,6 @@ static void __page_cache_release(struct folio *folio)\n" - " \t\t__folio_clear_lru_flags(folio);\n" - " \t\tunlock_page_lruvec_irqrestore(lruvec, flags);\n" - " \t}\n" - "-\t/* See comment on folio_test_mlocked in release_pages() */\n" - "-\tif (unlikely(folio_test_mlocked(folio))) {\n" - "-\t\tlong nr_pages = folio_nr_pages(folio);\n" - "-\n" - "-\t\t__folio_clear_mlocked(folio);\n" - "-\t\tzone_stat_mod_folio(folio, NR_MLOCK, -nr_pages);\n" - "-\t\tcount_vm_events(UNEVICTABLE_PGCLEARED, nr_pages);\n" - "-\t}\n" - " }\n" - " \n" - " static void __folio_put_small(struct folio *folio)\n" - "@@ -1021,18 +1013,6 @@ void release_pages(release_pages_arg arg, int nr)\n" - " \t\t\t__folio_clear_lru_flags(folio);\n" - " \t\t}\n" + "+commit 66edc3a5894c74f8887c8af23b97593a0dd0df4d upstream.\n" + "+\n" + " Syzbot reported a bad page state problem caused by a page being freed\n" + " using free_page() still having a mlocked flag at free_pages_prepare()\n" + " stage:\n" + "@@ -109,26 +119,26 @@\n" + " Cc: Vlastimil Babka <vbabka@suse.cz>\n" + " Cc: <stable@vger.kernel.org>\n" + " Signed-off-by: Andrew Morton <akpm@linux-foundation.org>\n" + "+Signed-off-by: Hugh Dickins <hughd@google.com>\n" + " ---\n" + " mm/page_alloc.c | 15 +++++++++++++++\n" + "- mm/swap.c | 14 --------------\n" + "- 2 files changed, 15 insertions(+), 14 deletions(-)\n" + "+ mm/swap.c | 20 --------------------\n" + "+ 2 files changed, 15 insertions(+), 20 deletions(-)\n" " \n" - "-\t\t/*\n" - "-\t\t * In rare cases, when truncation or holepunching raced with\n" - "-\t\t * munlock after VM_LOCKED was cleared, Mlocked may still be\n" - "-\t\t * found set here. This does not indicate a problem, unless\n" - "-\t\t * \"unevictable_pgs_cleared\" appears worryingly large.\n" - "-\t\t */\n" - "-\t\tif (unlikely(folio_test_mlocked(folio))) {\n" - "-\t\t\t__folio_clear_mlocked(folio);\n" - "-\t\t\tzone_stat_sub_folio(folio, NR_MLOCK);\n" - "-\t\t\tcount_vm_event(UNEVICTABLE_PGCLEARED);\n" - "-\t\t}\n" - "-\n" - " \t\tlist_add(&folio->lru, &pages_to_free);\n" - " \t}\n" - " \tif (lruvec)\n" - "-- \n" - 2.47.0.338.g60cca15819-goog + " diff --git a/mm/page_alloc.c b/mm/page_alloc.c\n" + "-index c6c7bb3ea71bc..216fbbfbedcf9 100644\n" + "+index 7272a922b838..3d7e685bdd0b 100644\n" + " --- a/mm/page_alloc.c\n" + " +++ b/mm/page_alloc.c\n" + "-@@ -1048,6 +1048,7 @@ __always_inline bool free_pages_prepare(struct page *page,\n" + "- \tbool skip_kasan_poison = should_skip_kasan_poison(page);\n" + "+@@ -1082,12 +1082,27 @@ static __always_inline bool free_pages_prepare(struct page *page,\n" + "+ \tint bad = 0;\n" + "+ \tbool skip_kasan_poison = should_skip_kasan_poison(page, fpi_flags);\n" + " \tbool init = want_init_on_free();\n" + "- \tbool compound = PageCompound(page);\n" + " +\tstruct folio *folio = page_folio(page);\n" + " \n" + " \tVM_BUG_ON_PAGE(PageTail(page), page);\n" + " \n" + "-@@ -1057,6 +1058,20 @@ __always_inline bool free_pages_prepare(struct page *page,\n" + "- \tif (memcg_kmem_online() && PageMemcgKmem(page))\n" + "- \t\t__memcg_kmem_uncharge_page(page, order);\n" + "+ \ttrace_mm_page_free(page, order);\n" + "+ \tkmsan_free_page(page, order);\n" + " \n" + " +\t/*\n" + " +\t * In rare cases, when truncation or holepunching raced with\n" + "@@ -145,23 +155,17 @@\n" + " +\t}\n" + " +\n" + " \tif (unlikely(PageHWPoison(page)) && !order) {\n" + "- \t\t/* Do not let hwpoison pages hit pcplists/buddy */\n" + "- \t\treset_page_owner(page, order);\n" + "+ \t\t/*\n" + "+ \t\t * Do not let hwpoison pages hit pcplists/buddy\n" + " diff --git a/mm/swap.c b/mm/swap.c\n" + "-index b8e3259ea2c47..59f30a981c6f9 100644\n" + "+index cd8f0150ba3a..42082eba42de 100644\n" + " --- a/mm/swap.c\n" + " +++ b/mm/swap.c\n" + "-@@ -78,20 +78,6 @@ static void __page_cache_release(struct folio *folio, struct lruvec **lruvecp,\n" + "- \t\tlruvec_del_folio(*lruvecp, folio);\n" + "+@@ -89,14 +89,6 @@ static void __page_cache_release(struct folio *folio)\n" + " \t\t__folio_clear_lru_flags(folio);\n" + "+ \t\tunlock_page_lruvec_irqrestore(lruvec, flags);\n" + " \t}\n" + "--\n" + "--\t/*\n" + "--\t * In rare cases, when truncation or holepunching raced with\n" + "--\t * munlock after VM_LOCKED was cleared, Mlocked may still be\n" + "--\t * found set here. This does not indicate a problem, unless\n" + "--\t * \"unevictable_pgs_cleared\" appears worryingly large.\n" + "--\t */\n" + "+-\t/* See comment on folio_test_mlocked in release_pages() */\n" + " -\tif (unlikely(folio_test_mlocked(folio))) {\n" + " -\t\tlong nr_pages = folio_nr_pages(folio);\n" + " -\n" + "@@ -171,4 +175,26 @@\n" + " -\t}\n" + " }\n" + " \n" + "- /*\n" + "+ static void __folio_put_small(struct folio *folio)\n" + "+@@ -1021,18 +1013,6 @@ void release_pages(release_pages_arg arg, int nr)\n" + "+ \t\t\t__folio_clear_lru_flags(folio);\n" + "+ \t\t}\n" + "+ \n" + "+-\t\t/*\n" + "+-\t\t * In rare cases, when truncation or holepunching raced with\n" + "+-\t\t * munlock after VM_LOCKED was cleared, Mlocked may still be\n" + "+-\t\t * found set here. This does not indicate a problem, unless\n" + "+-\t\t * \"unevictable_pgs_cleared\" appears worryingly large.\n" + "+-\t\t */\n" + "+-\t\tif (unlikely(folio_test_mlocked(folio))) {\n" + "+-\t\t\t__folio_clear_mlocked(folio);\n" + "+-\t\t\tzone_stat_sub_folio(folio, NR_MLOCK);\n" + "+-\t\t\tcount_vm_event(UNEVICTABLE_PGCLEARED);\n" + "+-\t\t}\n" + "+-\n" + "+ \t\tlist_add(&folio->lru, &pages_to_free);\n" + "+ \t}\n" + "+ \tif (lruvec)\n" + "+-- \n" + "+2.47.0.338.g60cca15819-goog\n" + "+\n" + "---\n" + "\n" + "Results of testing on various branches:\n" + "\n" + "| Branch | Patch Apply | Build Test |\n" + "|---------------------------|-------------|------------|\n" + | stable/linux-6.6.y | Success | Success | -7eacbb11338d1864ec73fd4bd49ae734398539bb4ac53cce02935117eb65545c +74bf0f2beaff3da1ab05ff2f6203ec8247e0d2ea3d063da807994f3dc4abba3e
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.