From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by smtp.subspace.kernel.org (Postfix) with ESMTP id ECC00279DB1; Mon, 23 Mar 2026 16:09:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=13.77.154.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774282191; cv=none; b=K3p3UCs2ptkLf3w+q8/mvAyz3QkTNtLvKkBQWXK/3Ilpl9j6lWEvNn7UWx4i/2jqDBRl5bE9tSA4OV61egUWmcHY1D1Gp33njgc1KQLB1482pZkJ0ACN8N5R5Yc9s7tn+d3o86ZO3XhDhkokAfMHzQMEyHrQG+NpEsMfDWNa55Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774282191; c=relaxed/simple; bh=FUVt5UvnJbOL9tTuKZDHMYTuOxOjCPlH58Q13F3yVWs=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=R0c8mLc/GZ2p0caXFFkk0D2BxLN1SJIsbBVmxeCBLrfWzw7FGFovjfkbt2+3PbprawDGDT+KU03VUqed1mWilqiZ/rRUGYSSAwh8d7Dxod7NwKync6pOPyQo0XgZI24FF4cyhB43S8QOFyi5snndKodUHtjisuCPW1w4WX+rnyY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com; spf=pass smtp.mailfrom=linux.microsoft.com; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b=gmLkvnkz; arc=none smtp.client-ip=13.77.154.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.microsoft.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="gmLkvnkz" Received: from skinsburskii.localdomain (c-98-225-44-182.hsd1.wa.comcast.net [98.225.44.182]) by linux.microsoft.com (Postfix) with ESMTPSA id 5573D20B7128; Mon, 23 Mar 2026 09:09:49 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 5573D20B7128 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1774282189; bh=L9o56crdaqIOhEkyoETyoQuCWYloRd/PEXLIpGyEqUE=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=gmLkvnkzfnfsC5deNnW1FVWef5HXQMrn+thX5NklANZ2qdCc0bGaQufNWEVU4m7FQ uh4zmXk+PFQgdiKHlQS+w8fKlV0IYcQKQs6P+8+ClxkcexzSWYxb3aPfOWKYIHhjlB 6XZ+455MVbkLdVXfGHD6jcTRLzvL0kakFSuhZcTc= Date: Mon, 23 Mar 2026 09:09:46 -0700 From: Stanislav Kinsburskii To: Wei Liu Cc: Michael Kelley , "kys@microsoft.com" , "haiyangz@microsoft.com" , "decui@microsoft.com" , "longli@microsoft.com" , "linux-hyperv@vger.kernel.org" , "linux-kernel@vger.kernel.org" Subject: Re: [PATCH] mshv: Fix error handling in mshv_region_populate_pages Message-ID: References: <177375989324.25621.6532741522672582851.stgit@skinsburskii-cloud-desktop.internal.cloudapp.net> <20260318062001.GA262287@liuwe-devbox-debian-v2.local> <20260318162003.GB262287@liuwe-devbox-debian-v2.local> Precedence: bulk X-Mailing-List: linux-hyperv@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260318162003.GB262287@liuwe-devbox-debian-v2.local> On Wed, Mar 18, 2026 at 04:20:03PM +0000, Wei Liu wrote: > On Wed, Mar 18, 2026 at 02:38:49PM +0000, Michael Kelley wrote: > > From: Wei Liu Sent: Tuesday, March 17, 2026 11:20 PM > > > > > > On Tue, Mar 17, 2026 at 09:56:07PM +0000, Michael Kelley wrote: > > > > From: Stanislav Kinsburskii Sent: Tuesday, March 17, 2026 8:05 AM > > > > > > > > > > The current error handling has two issues: > > > > > > > > > > First, pin_user_pages_fast() can return a short pin count (less than > > > > > requested but greater than zero) when it cannot pin all requested pages. > > > > > This is treated as success, leading to partially pinned regions being > > > > > used, which causes memory corruption. > > > > > > > > > > Second, when an error occurs mid-loop, already pinned pages from the > > > > > current batch are not released before calling mshv_region_evict_pages(), > > > > > causing a page reference leak. > > > > > > > > There's now an online LLM-based tool that is automatically reviewing > > > > kernel patches. For this patch, the results are here: > > > > > > > > > > > https://sashiko.dev/#/patchset/177375989324.25621.6532741522672582851.stgit > > > %40skinsburskii-cloud-desktop.internal.cloudapp.net > > > > > > > > It has flagged the commit message as incorrectly referencing the > > > > function mshv_region_evict_pages(), which doesn't exist. > > > > > > > > FWIW, the announcement about sashiko.dev is here: > > > > > > > > https://lore.kernel.org/lkml/7ia4o6kmpj5s.fsf@castle.c.googlers.com/ > > > > > > > > Other than the commit message reference, this looks good to me. > > > > > > > > Reviewed-by: Michael Kelley > > > > > > The second point is written as if the code here should release the > > > already pinned pages before calling mshv_region_invalidate_pages(), but > > > the code actually relies on mshv_mem_region_invalidate_pages() to > > > release the pages. The change here fixes the accounting. > > > > > > Second, when an error occurs mid-loop, already pinned pages from the > > > current batch are not accounted for before calling > > > mshv_region_invalidate_pages(), causing a page reference leak. > > > > > > And queued up the patch to hyperv-fixes. > > > > One other thing I noticed: The "Subject" of the patch is wrong. It > > mentions mshv_region_populate_pages(), but the function being > > modified is actually mshv_region_pin(). > > Good catch. I have updated the subject line and pushed to hyperv-fixes. > Thank you Michael and Wei. Thanks, Stanislav > Wei > > > > > Michael > > > > > > > > Wei > > > > > > > > > > > > > > > > > Fix by treating short pins as errors and explicitly unpinning the > > > > > partial batch before cleanup. > > > > > > > > > > Signed-off-by: Stanislav Kinsburskii > > > > > --- > > > > > drivers/hv/mshv_regions.c | 6 ++++-- > > > > > 1 file changed, 4 insertions(+), 2 deletions(-) > > > > > > > > > > diff --git a/drivers/hv/mshv_regions.c b/drivers/hv/mshv_regions.c > > > > > index c28aac0726de..fdffd4f002f6 100644 > > > > > --- a/drivers/hv/mshv_regions.c > > > > > +++ b/drivers/hv/mshv_regions.c > > > > > @@ -314,15 +314,17 @@ int mshv_region_pin(struct mshv_mem_region *region) > > > > > ret = pin_user_pages_fast(userspace_addr, nr_pages, > > > > > FOLL_WRITE | FOLL_LONGTERM, > > > > > pages); > > > > > - if (ret < 0) > > > > > + if (ret != nr_pages) > > > > > goto release_pages; > > > > > } > > > > > > > > > > return 0; > > > > > > > > > > release_pages: > > > > > + if (ret > 0) > > > > > + done_count += ret; > > > > > mshv_region_invalidate_pages(region, 0, done_count); > > > > > - return ret; > > > > > + return ret < 0 ? ret : -ENOMEM; > > > > > } > > > > > > > > > > static int mshv_region_chunk_unmap(struct mshv_mem_region *region, > > > > > > > > > > > > > > > >