The Linux Kernel Mailing List
 help / color / mirror / Atom feed
From: "David Hildenbrand (Arm)" <david@kernel.org>
To: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Cc: Vernon Yang <vernon2gm@gmail.com>,
	akpm@linux-foundation.org, nico.pache@linux.dev,
	ryan.roberts@arm.com, dev.jain@arm.com, baohua@kernel.org,
	lance.yang@linux.dev, usama.arif@linux.dev, zokeefe@google.com,
	linux-kernel@vger.kernel.org, linux-mm@kvack.org,
	stable@vger.kernel.org, Vernon Yang <yanglincheng@kylinos.cn>
Subject: Re: [PATCH v3 1/3] mm: khugepaged: fix swap entry value to folio_pfn()
Date: Wed, 26 Aug 2026 11:10:37 +0200	[thread overview]
Message-ID: <b76e616c-304a-4ccf-9459-ef5d92bc505f@kernel.org> (raw)
In-Reply-To: <ao6jVbVHLUmuY2UA@gremlin>

On 8/26/26 10:35, Lorenzo Stoakes (ARM) wrote:
> On Wed, Aug 26, 2026 at 10:24:56AM +0200, David Hildenbrand (Arm) wrote:
>> On 8/26/26 10:16, David Hildenbrand (Arm) wrote:
>>>
>>> Excuse me, what? Are you now just making up arguments?
>> To clarify, we have various users of "xxx_pfn" in the tree and I fail to see how
>> "this is a problematic pfn" -> "problematic_pfn" is odd and why
>> "pfn_problematic" would be any clearer.
>>
>> I do agree with the "problematic" aspect. "failed" might indeed be nicer.
> 
> Right yeah. Mostly the push back is on the word being a bit confusing. Fair
> enough on the pfn thing, failed_pfn is actually the nicest name suggested so far
> :)
> 
> I still think:
> 
>        	if (result == SCAN_SUCCEED) {
>                	...
>                	trace_mm_khugepaged_scan_file(mm, -1, file, present, swap, result);
>        	} else {
>                	trace_mm_khugepaged_scan_file(mm, failed_pfn, file, present,
> 					      swap, result);
>        	}
> 
> Is a little neater as then it's only on the failure path that we trace the
> failed pfn, and otherwise we explicitly -1.
> 
> But it's not exactly a show stopper this :)
> 
> Very rough edit of your patch - if you're happy then let's go with this, if not
> then edit it + post so Vernon has a clear direction. I'm not feeling super
> strongly on this so don't want to block anything:
> 
> ----8<----
> diff --git a/mm/khugepaged.c b/mm/khugepaged.c
> index 75639298efc27..371ee0b16d10c 100644
> --- a/mm/khugepaged.c
> +++ b/mm/khugepaged.c
> @@ -2683,6 +2683,7 @@ static enum scan_result collapse_scan_file(struct
> mm_struct *mm,
>        	int present, swap;
>        	int node = NUMA_NO_NODE;
>        	enum scan_result result = SCAN_SUCCEED;
> +       unsigned long failed_pfn = -1;
> 
>        	present = 0;
>        	swap = 0;
> @@ -2714,6 +2715,7 @@ static enum scan_result collapse_scan_file(struct
> mm_struct *mm,
>                	}
> 
>                	if (is_pmd_order(folio_order(folio))) {
> +                       failed_pfn = folio_pfn(folio);
>                        	result = SCAN_PTE_MAPPED_HUGEPAGE;
>                        	/*
>                          * PMD-sized THP implies that we can only try
> @@ -2725,6 +2727,7 @@ static enum scan_result collapse_scan_file(struct
> mm_struct *mm,
> 
>                	node = folio_nid(folio);
>                	if (collapse_scan_abort(node, cc)) {
> +                       failed_pfn = folio_pfn(folio);
>                        	result = SCAN_SCAN_ABORT;
>                        	folio_put(folio);
>                        	break;
> @@ -2732,12 +2735,14 @@ static enum scan_result collapse_scan_file(struct
> mm_struct *mm,
>                	cc->node_load[node]++;
> 
>                	if (!folio_test_lru(folio)) {
> +                       failed_pfn = folio_pfn(folio);
>                        	result = SCAN_PAGE_LRU;
>                        	folio_put(folio);
>                        	break;
>                	}
> 
>                 if (folio_expected_ref_count(folio) + 1 != folio_ref_count(folio)) {
> +                       failed_pfn = folio_pfn(folio);
>                         result = SCAN_PAGE_COUNT;
>                         folio_put(folio);
>                         break;
> @@ -2773,7 +2778,7 @@ static enum scan_result collapse_scan_file(struct
> mm_struct *mm,
>                	}
> -      	}
> -       trace_mm_khugepaged_scan_file(mm, folio, file, present, swap, result);
> +       	trace_mm_khugepaged_scan_file(mm, -1, file, present, swap,
> +				SCAN_SUCCEED);
> +	} else {
> +	       trace_mm_khugepaged_scan_file(mm, failed_pfn, file, present,
> +				swap, result);
> +	}
> +
>         return result;
>  }

That looks good to me, thanks.

My memory is bad this week, so I have to ask with the fear of having asked
before: is tracing the PFN of any value?

What can someone tracing this on userspace reasonably do with the PFN? Inspect
kpageflags? I'd assume someone actually doing that is quite ... rare.

-- 
Cheers,

David

  reply	other threads:[~2026-08-26  9:10 UTC|newest]

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-24  9:29 [PATCH v3 0/3] mm: khugepaged: fix tracepoint UAF Vernon Yang
2026-08-24  9:29 ` [PATCH v3 1/3] mm: khugepaged: fix swap entry value to folio_pfn() Vernon Yang
2026-08-24 11:54   ` David Hildenbrand (Arm)
2026-08-26  2:44     ` Vernon Yang
2026-08-26  7:57       ` David Hildenbrand (Arm)
2026-08-26  8:07         ` Lorenzo Stoakes (ARM)
2026-08-26  8:08           ` David Hildenbrand (Arm)
2026-08-26  8:11             ` Lorenzo Stoakes (ARM)
2026-08-26  8:16               ` David Hildenbrand (Arm)
2026-08-26  8:24                 ` David Hildenbrand (Arm)
2026-08-26  8:35                   ` Lorenzo Stoakes (ARM)
2026-08-26  9:10                     ` David Hildenbrand (Arm) [this message]
2026-08-26  9:21                     ` Vernon Yang
2026-08-26 11:04                       ` Lorenzo Stoakes (ARM)
2026-08-26  9:08         ` Vernon Yang
2026-08-24  9:29 ` [PATCH v3 2/3] mm: khugepaged: fix folio is used after pte_unmap_unlock() Vernon Yang
2026-08-24 11:57   ` David Hildenbrand (Arm)
2026-08-26  2:46     ` Vernon Yang
2026-08-26  7:58       ` David Hildenbrand (Arm)
2026-08-26  8:12   ` Lorenzo Stoakes (ARM)
2026-08-26  8:42     ` Lorenzo Stoakes (ARM)
2026-08-24  9:29 ` [PATCH v3 3/3] mm: khugepaged: fix folio is used after folio_put/unlock() Vernon Yang
2026-08-24 11:59   ` David Hildenbrand (Arm)
2026-08-26  2:47     ` Vernon Yang
2026-08-26  8:09   ` Lorenzo Stoakes (ARM)
2026-08-26  8:14     ` David Hildenbrand (Arm)
2026-08-26  8:23       ` Lorenzo Stoakes (ARM)
2026-08-26  8:41     ` Lorenzo Stoakes (ARM)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=b76e616c-304a-4ccf-9459-ef5d92bc505f@kernel.org \
    --to=david@kernel.org \
    --cc=akpm@linux-foundation.org \
    --cc=baohua@kernel.org \
    --cc=dev.jain@arm.com \
    --cc=lance.yang@linux.dev \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=ljs@kernel.org \
    --cc=nico.pache@linux.dev \
    --cc=ryan.roberts@arm.com \
    --cc=stable@vger.kernel.org \
    --cc=usama.arif@linux.dev \
    --cc=vernon2gm@gmail.com \
    --cc=yanglincheng@kylinos.cn \
    --cc=zokeefe@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox