Re: [PATCH v2 06/10] memory-failure: Prevent UAF in raw_hwp_page list

[Usama Arif <usama.arif@linux.dev>]

On Thu,  9 Jul 2026 19:47:34 +0100 "Matthew Wilcox (Oracle)" <willy@infradead.org> wrote:

> Most accesses to the raw_hwp_page list are protected by mf_mutex.
> However, the call to folio_clear_hugetlb_hwpoison() in mm/hugetlb.c
> does not.  This is probably OK today as this is in the freeing path and
> I think all current calls to is_raw_hwpoison_page_in_hugepage() hold a
> reference to the folio.  However, the next patch will call this function
> without holding a reference on the folio, which will expose this race.
> 
> Rename the current folio_clear_hugetlb_hwpoison() to
> __folio_clear_hugetlb_hwpoison() and wrap it with a new
> folio_clear_hugetlb_hwpoison() for the benefit of external callers.
> 
> Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
> ---
>  mm/memory-failure.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/memory-failure.c b/mm/memory-failure.c
> index 53063e2a1f97..353288cce1b2 100644
> --- a/mm/memory-failure.c
> +++ b/mm/memory-failure.c
> @@ -1935,7 +1935,7 @@ static unsigned long folio_free_raw_hwp(struct folio *folio, bool move_flag)
>  	return __folio_free_raw_hwp(folio, move_flag);
>  }
>  
> -void folio_clear_hugetlb_hwpoison(struct folio *folio)
> +static void __folio_clear_hugetlb_hwpoison(struct folio *folio)
>  {

Good to add lockdep_assert_held(&mf_mutex) here, but there is a issue below.

>  	if (folio_test_hugetlb_raw_hwp_unreliable(folio))
>  		return;
> @@ -1945,6 +1945,13 @@ void folio_clear_hugetlb_hwpoison(struct folio *folio)
>  	folio_free_raw_hwp(folio, true);
>  }
>  
> +void folio_clear_hugetlb_hwpoison(struct folio *folio)
> +{
> +	mutex_lock(&mf_mutex);

This wrapper can now sleep, but its external caller is the hugetlb free
path.  __update_and_free_hugetlb_folio() is reached from
update_and_free_hugetlb_folio(), which has a comment saying
"Defer freeing to avoid using GFP_ATOMIC"

> +	__folio_clear_hugetlb_hwpoison(folio);
> +	mutex_unlock(&mf_mutex);
> +}
> +
>  static int get_huge_page_for_hwpoison(unsigned long pfn, int flags,
>  				 bool *migratable_cleared)
>  {
> @@ -2051,7 +2058,7 @@ static int try_memory_failure_hugetlb(unsigned long pfn, int flags)
>  	folio_lock(folio);
>  
>  	if (hwpoison_filter(p)) {
> -		folio_clear_hugetlb_hwpoison(folio);
> +		__folio_clear_hugetlb_hwpoison(folio);
>  		if (migratable_cleared)
>  			folio_set_hugetlb_migratable(folio);
>  		folio_unlock(folio);
> -- 
> 2.47.3
> 
>