From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-177.mta1.migadu.com (out-177.mta1.migadu.com [95.215.58.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 93EDA1427A for ; Sun, 5 Apr 2026 04:36:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775363774; cv=none; b=ULubCjudb76YgIVqWIHZ023zwevUCtEq4OucOQWrZ4x2Mvmv/E9r0NTkhfnQ6mtzV93co/zyBZrfYMcSk+2/3uEewLVCyjw4qzInL/0ZIWpFpf+OGegNZdxioZAp2MfLtNmp7Qi2k2dxm6S3LARQjiQGe/7h6HgTeJgn6GH8LXQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775363774; c=relaxed/simple; bh=uHgrvDhQZclR+F3VVZ6QqESyw+1UXJMKFuy8pxj/qx0=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=R4zmA9kCypPtpb9Y+ns0rSiq8YCq9VIVcNW3sibLlY8bIu/YIsC/x+IxtgnlZ59wr5ikWAOdsO5R8bklbkeihC3EJP/EQJVa+VrJGLOXzY6VyxK8tlz858yFV90sRSan8qozySdmVeEHJ0YNS8opIQbT2nCH7Ur2Cy7//bA0MVA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=gBvIaipp; arc=none smtp.client-ip=95.215.58.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="gBvIaipp" Message-ID: <01664abc-05c2-403d-a9eb-b2b780a1aaae@linux.dev> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1775363769; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jRO9W2hfI/BSBDTftXJZfBbu3HFf6wv71UgZO5Fk6uM=; b=gBvIaippW/ikq/XAxO9ld/dCCdw7GzFQT/8DvVcl1evTSUIJ07lZZFA2EpThgi/Vp9Heu4 Vr3rnx/f9Gjt7jiw+zteNdICTHZyueUTlV/9Cth/pcd+a6Kou/uwT+/F2srQODw0rmoQK5 jtmnXRcQ/wAA3R+5vUb7c/OboxfKNIw= Date: Sun, 5 Apr 2026 12:35:57 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Subject: Re: [PATCH 1/3] lib: test_hmm: evict device pages on file close to avoid use-after-free To: Alistair Popple Cc: linux-mm@kvack.org, Liam.Howlett@oracle.com, akpm@linux-foundation.org, david@kernel.org, jgg@ziepe.ca, leon@kernel.org, linux-kernel@vger.kernel.org, ljs@kernel.org, mhocko@suse.com, rppt@kernel.org, surenb@google.com, vbabka@kernel.org, dri-devel@lists.freedesktop.org, balbirs@nvidia.com References: <20260331063445.3551404-1-apopple@nvidia.com> <20260331063445.3551404-2-apopple@nvidia.com> Content-Language: en-US X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Zenghui Yu In-Reply-To: <20260331063445.3551404-2-apopple@nvidia.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Migadu-Flow: FLOW_OUT On 3/31/26 2:34 PM, Alistair Popple wrote: > When dmirror_fops_release() is called it frees the dmirror struct but > doesn't migrate device private pages back to system memory first. This > leaves those pages with a dangling zone_device_data pointer to the freed > dmirror. > > If a subsequent fault occurs on those pages (eg. during coredump) the > dmirror_devmem_fault() callback dereferences the stale pointer causing a > kernel panic. This was reported [1] when running mm/ksft_hmm.sh on > arm64, where a test failure triggered SIGABRT and the resulting coredump > walked the VMAs faulting in the stale device private pages. > > Fix this by calling dmirror_device_evict_chunk() for each devmem chunk > in dmirror_fops_release() to migrate all device private pages back to > system memory before freeing the dmirror struct. The function is moved > earlier in the file to avoid a forward declaration. > > Fixes: b2ef9f5a5cb3 ("mm/hmm/test: add selftest driver for HMM") > Reported-by: Zenghui Yu > Closes: https://lore.kernel.org/linux-mm/8bd0396a-8997-4d2e-a13f-5aac033083d7@linux.dev/ > Signed-off-by: Alistair Popple > > --- > > Note that I wasn't able to replicate the exact crash in [1] although I > replicated something similar. So I haven't been able to verify this > fixes the crash conclusively, but it should. Yup! I've verified that it indeed fixed the crash. Thanks for the fix! Zenghui