Peter Xu 4c806333ef mm/hugetlb: fix missing hugetlb_lock for resv uncharge ... [ Upstream commit b76b46902c2d0395488c8412e1116c2486cdfcb2 ] There is a recent report on UFFDIO_COPY over hugetlb: https://lore.kernel.org/all/000000000000ee06de0616177560@google.com/ 350: lockdep_assert_held(&hugetlb_lock); Should be an issue in hugetlb but triggered in an userfault context, where it goes into the unlikely path where two threads modifying the resv map together. Mike has a fix in that path for resv uncharge but it looks like the locking criteria was overlooked: hugetlb_cgroup_uncharge_folio_rsvd() will update the cgroup pointer, so it requires to be called with the lock held. Link: https://lkml.kernel.org/r/20240417211836.2742593-3-peterx@redhat.com Fixes: 79aa925bf2 ("hugetlb_cgroup: fix reservation accounting") Signed-off-by: Peter Xu <peterx@redhat.com> Reported-by: syzbot+4b8077a5fccc61c385a1@syzkaller.appspotmail.com Reviewed-by: Mina Almasry <almasrymina@google.com> Cc: David Hildenbrand <david@redhat.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-05-17 11:55:52 +02:00
..
damon	mm/damon/reclaim: fix quota stauts loss due to online tunings	2024-03-01 13:26:39 +01:00
kasan	kasan/test: avoid gcc warning for intentional overflow	2024-04-03 15:19:27 +02:00
kfence	mm,kfence: decouple kfence from page granularity mapping judgement	2023-12-03 07:32:08 +01:00
kmsan
backing-dev.c
balloon_compaction.c
bootmem_info.c
cma_debug.c
cma_sysfs.c
cma.c	mm/cma: use nth_page() in place of direct struct page manipulation	2023-11-28 17:07:14 +00:00
cma.h
compaction.c	mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations	2024-04-03 15:19:42 +02:00
debug_page_ref.c
debug_vm_pgtable.c
debug.c
dmapool.c
early_ioremap.c
fadvise.c
failslab.c
filemap.c	mm: merge folio_has_private()/filemap_release_folio() call pairs	2024-01-10 17:10:31 +01:00
folio-compat.c
frontswap.c
gup_test.c
gup_test.h
gup.c
highmem.c
hmm.c
huge_memory.c	mm: huge_memory: don't force huge page alignment on 32 bit	2024-03-06 14:45:06 +00:00
hugetlb_cgroup.c	mm/hugetlb_cgroup: convert hugetlb_cgroup_uncharge_page() to folios	2024-05-17 11:55:52 +02:00
hugetlb_vmemmap.c	mm: hugetlb_vmemmap: fix a race between vmemmap pmd split	2023-09-19 12:27:56 +02:00
hugetlb_vmemmap.h
hugetlb.c	mm/hugetlb: fix missing hugetlb_lock for resv uncharge	2024-05-17 11:55:52 +02:00
hwpoison-inject.c
init-mm.c
internal.h	mm, netfs, fscache: stop read optimisation when folio removed from pagecache	2024-01-10 17:10:31 +01:00
interval_tree.c
io-mapping.c
ioremap.c
Kconfig
Kconfig.debug
khugepaged.c	mm: merge folio_has_private()/filemap_release_folio() call pairs	2024-01-10 17:10:31 +01:00
kmemleak.c
ksm.c
list_lru.c
maccess.c
madvise.c
Makefile
mapping_dirty_helpers.c
memblock.c	x86/numa: Fix the address overlap check in numa_fill_memblks()	2024-03-01 13:26:36 +01:00
memcontrol.c	mm: memcontrol: clarify swapaccount=0 deprecation warning	2024-03-01 13:26:32 +01:00
memfd.c
memory_hotplug.c	mm/memory_hotplug: fix error handling in add_memory_resource()	2024-01-10 17:10:33 +01:00
memory-failure.c	mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled	2024-04-27 17:07:16 +02:00
memory-tiers.c
memory.c	x86/mm/pat: fix VM_PAT handling in COW mappings	2024-04-10 16:28:33 +02:00
mempolicy.c	mm/mempolicy: fix set_mempolicy_home_node() previous VMA pointer	2023-11-08 14:11:02 +01:00
mempool.c
memremap.c
memtest.c	memtest: use {READ,WRITE}_ONCE in memory scanning	2024-04-03 15:19:36 +02:00
migrate_device.c
migrate.c	mm/hugetlb: add folio_hstate()	2024-05-17 11:55:52 +02:00
mincore.c
mlock.c
mm_init.c
mm_slot.h
mmap_lock.c
mmap.c	mmap: fix error paths with dup_anon_vma()	2023-11-08 14:11:03 +01:00
mmu_gather.c
mmu_notifier.c
mmzone.c
mprotect.c
mremap.c
msync.c
nommu.c
oom_kill.c
page_alloc.c	mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations	2024-04-03 15:19:42 +02:00
page_counter.c
page_ext.c
page_idle.c
page_io.c
page_isolation.c
page_owner.c
page_poison.c
page_reporting.c
page_reporting.h
page_table_check.c
page_vma_mapped.c
page-writeback.c	mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again	2024-02-23 09:12:32 +01:00
pagewalk.c
percpu-internal.h
percpu-km.c
percpu-stats.c
percpu-vm.c
percpu.c
pgalloc-track.h
pgtable-generic.c
process_vm_access.c
ptdump.c
readahead.c	readahead: avoid multiple marked readahead pages	2024-03-15 10:48:19 -04:00
rmap.c
rodata_test.c
secretmem.c
shmem.c	mm/shmem: fix race in shmem_undo_range w/THP	2023-12-20 17:00:26 +01:00
shrinker_debug.c
shuffle.c
shuffle.h
slab_common.c	mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy()	2023-10-06 14:57:03 +02:00
slab.c
slab.h
slob.c
slub.c
sparse-vmemmap.c
sparse.c	mm/sparsemem: fix race in accessing memory_section->usage	2024-01-31 16:17:02 -08:00
swap_cgroup.c
swap_slots.c
swap_state.c
swap.c
swap.h	mm/swap: fix race when skipping swapcache	2024-03-01 13:26:32 +01:00
swapfile.c	mm: swap: fix race between free_swap_and_cache() and swapoff()	2024-04-03 15:19:32 +02:00
truncate.c	mm: merge folio_has_private()/filemap_release_folio() call pairs	2024-01-10 17:10:31 +01:00
usercopy.c
userfaultfd.c	userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb	2024-02-23 09:12:51 +01:00
util.c
vmalloc.c
vmpressure.c
vmscan.c	mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations	2024-04-03 15:19:42 +02:00
vmstat.c
workingset.c	mm/mglru: fix underprotected page cache	2023-12-20 17:00:26 +01:00
z3fold.c
zbud.c
zpool.c
zsmalloc.c
zswap.c	mm: zswap: fix missing folio cleanup in writeback race path	2024-03-01 13:26:39 +01:00