From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=95.215.58.19 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793615955; b=rM4S7nGwitNlT7WKKHAB05WtonlG4clfpH8iM1murMlWh3jw810jY0mAZ6t+ntae9bt5 pTNXVyMbCkYI+VJ/rf0Qg3ZnHtfh0DkOufpkUpArnJ979l7Zfdm5bIiuVkrbvTxh/rdnu ZYDchtmAUTwtOQf0xuwvcvvr0eTQRNpZSVbJdl7Bbx3XFbZn+nNxjUsWIVMYlcdJkBWb0 AOD4IMrV0exDUoNKxSNjMbVtDAOdF0GjbwSWc5Y42Oz2IP7X+b3nieKBEdUpHqdA40sjj 2VxbuKEzeaxvoWNQGkdoj2tnlxsCi6EXRhEmLpQt46z9T4lwgl6gpTvzPX34xfqBdTQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793615955; h=DMARC-Filter:X-Envelope-To:DKIM-Signature:X-Envelope-To:Received: X-Mizu-Trace-ID:X-Migadu-Flow:From:To:Cc:Subject:Date:Message-Id: X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=SXPkduc5HmvcD4JbyCflilxUkIbcOVZyKgcYfnLDPdM=; b=AvDngN0HdL0eLjHLaL2DxhhP0TnN0e1c5Wv/pT7acIEB7JSicIqodHzV5rBLsHTV0Nad PrdSqBYByiNk6kOhQ2MsS/gSQcPtbVPjHxZ7NFTbxnQIJmMunvNw/oLTTPwPNdeGGGG8A xtIpi4LxKfqcJkFmdiHaBVz7TxBcPD80zpkweIYDqIhI8FYYwJNZtf5ZfAjaFgwbcEZq6 ze+y5xBf2ObFnu0K1RNQike3jBM18gizN8lPk6XL3RQxwMAPQxaS4TC+f8FWKQhexLmf5 cVZ4mGaEr2QXDS3xEobcU26myOA165XDYVSaLUx+pjkbZibrbd1Tw0RgNNLvfdGYAbQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=FGZfE5gA; arc=none smtp.remote-ip=95.215.58.19 Received: from mta1.migadu.com (out-19.mta1.migadu.com [95.215.58.19]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3DDF0606A324 for ; Mon, 2 Nov 2026 10:39:10 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 3DDF0606A324 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=FGZfE5gA X-Envelope-To: linux-fsdevel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=g/mOLxr73xiPzfSEauykXJcCVgHJm2aXb9jWqKek3jg=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1793615949; v=1; x=1794220749; b=FGZfE5gA8VQ7g0VPOa1555KztU9pXPoVqISm2zO/1Un7sNA9Xg8LXABcmO9akC2pKhNvb03u OMhftDY9uI3j6PJkrZ0A56Fdq6iSFCiG0sIeHgYo/vSTyrZBiJQMOUYn719ZAIgr64WcoOMM5tx U0sUKS5ZEyZxxKsOJRnLmU3I= X-Envelope-To: linux-fsdevel@vger.kernel.org Received: by mta10.migadu.com with ESMTPS id 8bbf69835e69a785; Mon, 02 Nov 2026 10:39:08 +0000 X-Mizu-Trace-ID: 8bbf69835e69a785 X-Migadu-Flow: FLOW_OUT From: xu.xin@linux.dev To: david@kernel.org Cc: akpm@linux-foundation.org, aneesh.kumar@kernel.org, apopple@nvidia.com, axelrasmussen@google.com, baohua@kernel.org, baolin.wang@linux.alibaba.com, baoquan.he@linux.dev, chengming.zhou@linux.dev, chrisl@kernel.org, dev.jain@arm.com, gourry@gourry.net, hannes@cmpxchg.org, harry@kernel.org, hughd@google.com, jack@suse.cz, jannh@google.com, jgg@ziepe.ca, jhubbard@nvidia.com, josef@toxicpanda.com, joshua.hahnjy@gmail.com, kas@kernel.org, kasong@tencent.com, kees@kernel.org, kexec@lists.infradead.org, lance.yang@linux.dev, liam@infradead.org, linux-arch@vger.kernel.org, linux-cxl@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, ljs@kernel.org, matthew.brost@intel.com, mhocko@kernel.org, mhocko@suse.com, minchan@kernel.org, muchun.song@linux.dev, nico.pache@linux.dev, nphamcs@gmail.com, npiggin@gmail.com, osalvador@suse.de, pasha.tatashin@soleen.com, peterx@redhat.com, peterz@infradead.org, pfalcato@suse.de, pratyush@kernel.org, qi.zheng@linux.dev, rakie.kim@sk.com, riel@surriel.com, rppt@kernel.org, ryan.roberts@arm.com, shakeel.butt@linux.dev, shikemeng@huaweicloud.com, stable@vger.kernel.org, surenb@google.com, usama.anjum@arm.com, usama.arif@linux.dev, vbabka@kernel.org, weixugc@google.com, will@kernel.org, willy@infradead.org, xu.xin@linux.dev, ying.huang@linux.alibaba.com, youngjun.park@lge.com, yuanchu@google.com, ziy@nvidia.com Subject: Re: [PATCH v3 39/47] mm/ksm: reset the unstable trees of all nodes Date: Mon, 2 Nov 2026 18:38:39 +0800 Message-Id: <20261102103839.225014-1-xu.xin@linux.dev> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20261031-fixes_core-v3-39-d6437171ecc3@kernel.org> References: <20261031-fixes_core-v3-39-d6437171ecc3@kernel.org> X-Mailing-List: linux-fsdevel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit > Each full scan resets ksm_nr_node_ids unstable tree roots. Enabling > merge_across_nodes resets this count to 1, even if per-node roots were > previously allocated. > > So when toggling "merge_across_nodes" 0 -> 1 -> 0, a scan that starts > while the setting is 1 and continues after switching back to 0 can > encounter stale unstable tree roots, resulting in UAF. > > Only root is allowed to change "merge_across_nodes", and the documented > sequence is: "merge_across_nodes setting can be changed only when there > are no ksm shared pages in the system: set run 2 to unmerge pages first, > then to 1 after changing merge_across_nodes, to remerge according to the > new setting." > > Let's fix it by tracking in ksm_nr_node_ids the actual number of > allocated tree roots. > > remove_all_stable_nodes() and ksm_check_stable_tree() will now scan > more tree roots (skipping the empty ones), which is harmless. > > Fixes: ef53d16cded7 ("ksm: allocate roots when needed") > Cc: stable@vger.kernel.org > Reported-by: Josef Bacik > Acked-by: Lorenzo Stoakes (ARM) > Reviewed-by: Pasha Tatashin > Tested-by: Muhammad Usama Anjum > Signed-off-by: David Hildenbrand (Arm) > --- > mm/ksm.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/mm/ksm.c b/mm/ksm.c > index dbfb8f98b1892..9c51925825cbf 100644 > --- a/mm/ksm.c > +++ b/mm/ksm.c > @@ -475,6 +475,7 @@ static void advisor_stop_scan(void) > #ifdef CONFIG_NUMA > /* Zeroed when merging across nodes is not allowed */ > static unsigned int ksm_merge_across_nodes = 1; > +/* Number of allocated stable and unstable tree roots. */ > static int ksm_nr_node_ids = 1; > #else > #define ksm_merge_across_nodes 1U > @@ -3636,14 +3637,13 @@ static ssize_t merge_across_nodes_store(struct kobject *kobj, > else { > root_stable_tree = buf; > root_unstable_tree = buf + nr_node_ids; > + ksm_nr_node_ids = nr_node_ids; > /* Stable tree is empty but not the unstable */ > root_unstable_tree[0] = one_unstable_tree[0]; > } > } > - if (!err) { > + if (!err) > ksm_merge_across_nodes = knob; > - ksm_nr_node_ids = knob ? 1 : nr_node_ids; > - } > } > mutex_unlock(&ksm_thread_mutex); Reviewed-by: Xu Xin