| Message ID | 1725373521-451395-6-git-send-email-steven.sistare@oracle.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | memfd-pin huge page fixes | expand |
> Subject: [PATCH V1 5/5] mm/gup: fix memfd_pin_folios alloc race panic > > If memfd_pin_folios tries to create a hugetlb page, but someone else > already did, then folio gets the value -EEXIST here: > > folio = memfd_alloc_folio(memfd, start_idx); > if (IS_ERR(folio)) { > ret = PTR_ERR(folio); > if (ret != -EEXIST) > goto err; > > then on the next trip through the "while start_idx" loop we panic here: > > if (folio) { > folio_put(folio); > > To fix, set the folio to NULL on error. > > Fixes: 89c1905d9c14 ("mm/gup: introduce memfd_pin_folios() for pinning > memfd folios") > > Signed-off-by: Steve Sistare <steven.sistare@oracle.com> > --- > mm/gup.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/mm/gup.c b/mm/gup.c > index 5b92f1d..bccabaa 100644 > --- a/mm/gup.c > +++ b/mm/gup.c > @@ -3705,6 +3705,7 @@ long memfd_pin_folios(struct file *memfd, loff_t > start, loff_t end, > ret = PTR_ERR(folio); > if (ret != -EEXIST) > goto err; > + folio = NULL; Acked-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Thanks, Vivek > } > } > } > -- > 1.8.3.1
diff --git a/mm/gup.c b/mm/gup.c index 5b92f1d..bccabaa 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -3705,6 +3705,7 @@ long memfd_pin_folios(struct file *memfd, loff_t start, loff_t end, ret = PTR_ERR(folio); if (ret != -EEXIST) goto err; + folio = NULL; } } }
If memfd_pin_folios tries to create a hugetlb page, but someone else already did, then folio gets the value -EEXIST here: folio = memfd_alloc_folio(memfd, start_idx); if (IS_ERR(folio)) { ret = PTR_ERR(folio); if (ret != -EEXIST) goto err; then on the next trip through the "while start_idx" loop we panic here: if (folio) { folio_put(folio); To fix, set the folio to NULL on error. Fixes: 89c1905d9c14 ("mm/gup: introduce memfd_pin_folios() for pinning memfd folios") Signed-off-by: Steve Sistare <steven.sistare@oracle.com> --- mm/gup.c | 1 + 1 file changed, 1 insertion(+)