[PATCH v2 06/10] memory-failure: Prevent UAF in raw_hwp_page list

["Matthew Wilcox (Oracle)" <willy@infradead.org>]

Most accesses to the raw_hwp_page list are protected by mf_mutex.
However, the call to folio_clear_hugetlb_hwpoison() in mm/hugetlb.c
does not.  This is probably OK today as this is in the freeing path and
I think all current calls to is_raw_hwpoison_page_in_hugepage() hold a
reference to the folio.  However, the next patch will call this function
without holding a reference on the folio, which will expose this race.

Rename the current folio_clear_hugetlb_hwpoison() to
__folio_clear_hugetlb_hwpoison() and wrap it with a new
folio_clear_hugetlb_hwpoison() for the benefit of external callers.

Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
---
 mm/memory-failure.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 53063e2a1f97..353288cce1b2 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1935,7 +1935,7 @@ static unsigned long folio_free_raw_hwp(struct folio *folio, bool move_flag)
 	return __folio_free_raw_hwp(folio, move_flag);
 }
 
-void folio_clear_hugetlb_hwpoison(struct folio *folio)
+static void __folio_clear_hugetlb_hwpoison(struct folio *folio)
 {
 	if (folio_test_hugetlb_raw_hwp_unreliable(folio))
 		return;
@@ -1945,6 +1945,13 @@ void folio_clear_hugetlb_hwpoison(struct folio *folio)
 	folio_free_raw_hwp(folio, true);
 }
 
+void folio_clear_hugetlb_hwpoison(struct folio *folio)
+{
+	mutex_lock(&mf_mutex);
+	__folio_clear_hugetlb_hwpoison(folio);
+	mutex_unlock(&mf_mutex);
+}
+
 static int get_huge_page_for_hwpoison(unsigned long pfn, int flags,
 				 bool *migratable_cleared)
 {
@@ -2051,7 +2058,7 @@ static int try_memory_failure_hugetlb(unsigned long pfn, int flags)
 	folio_lock(folio);
 
 	if (hwpoison_filter(p)) {
-		folio_clear_hugetlb_hwpoison(folio);
+		__folio_clear_hugetlb_hwpoison(folio);
 		if (migratable_cleared)
 			folio_set_hugetlb_migratable(folio);
 		folio_unlock(folio);
-- 
2.47.3