Re: [PATCH v2 06/10] memory-failure: Prevent UAF in raw_hwp_page list

[Matthew Wilcox <willy@infradead.org>]

On Fri, Jul 10, 2026 at 08:02:03AM -0700, Usama Arif wrote:
> > +void folio_clear_hugetlb_hwpoison(struct folio *folio)
> > +{
> > +	mutex_lock(&mf_mutex);
> 
> This wrapper can now sleep, but its external caller is the hugetlb free
> path.  __update_and_free_hugetlb_folio() is reached from
> update_and_free_hugetlb_folio(), which has a comment saying
> "Defer freeing to avoid using GFP_ATOMIC"

Yeah, Sashiko also pointed this out.

I think I'm going to have to change how we track hwpoison in hugetlb
in order to make this work.  Let me think out loud here:

is_page_hwpoison() can be called without a reference on the folio
containing the page.  The answer can be wrong in this case, but any
UAF must be benign.

Grabbing the mf_mutex inside hugetlb_page_hwpoison() is insufficient
because we can't protect against folio_clear_hugetlb_hwpoison() (the
approach attempted in this patch).

We could add a spinlock for protecting freeing & checking of the list.
That's probably simplest.

It'd be better to protect the list with RCU.  But then we'd need to
put an RCU head inside raw_hwp_page, doubling its size from 2 pointers
to 4.

We could completely change how we do this; instead of having an llist,
we could have an array of 32-bit page indices.  Reallocate it when we
run out, doubling its size each time, and put an rcu head in that.
That'd give us 32-bytes the first time, space for 4 indices, then double
to 64 (space for 12 indices), double again to 128 (28 indices), etc.

We could also RCU-free the folio if it's hwpoisoned.  We'd need to
clear the hugetlb flag before asking RCU to cover up this problem
to ensure that any reader that saw the hugetlb flag set started its
grace period before.

Probably all too much trouble.  I think I'll add a global spinlock.

> > +	__folio_clear_hugetlb_hwpoison(folio);
> > +	mutex_unlock(&mf_mutex);
> > +}
> > +
> >  static int get_huge_page_for_hwpoison(unsigned long pfn, int flags,
> >  				 bool *migratable_cleared)
> >  {
> > @@ -2051,7 +2058,7 @@ static int try_memory_failure_hugetlb(unsigned long pfn, int flags)
> >  	folio_lock(folio);
> >  
> >  	if (hwpoison_filter(p)) {
> > -		folio_clear_hugetlb_hwpoison(folio);
> > +		__folio_clear_hugetlb_hwpoison(folio);
> >  		if (migratable_cleared)
> >  			folio_set_hugetlb_migratable(folio);
> >  		folio_unlock(folio);
> > -- 
> > 2.47.3
> > 
> >