Commit 2e6053fe authored by Jinjiang Tu's avatar Jinjiang Tu Committed by Andrew Morton
Browse files

mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn 

When memory_failure() is called for a already hwpoisoned pfn,
kill_accessing_process() will be called to kill current task.  However, if
the vma of the accessing vaddr is VM_PFNMAP, walk_page_range() will skip
the vma in walk_page_test() and return 0.

Before commit aaf99ac2 ("mm/hwpoison: do not send SIGBUS to processes
with recovered clean pages"), kill_accessing_process() will return EFAULT.
For x86, the current task will be killed in kill_me_maybe().

However, after this commit, kill_accessing_process() simplies return 0,
that means UCE is handled properly, but it doesn't actually.  In such
case, the user task will trigger UCE infinitely.

To fix it, add .test_walk callback for hwpoison_walk_ops to scan all vmas.

Link: https://lkml.kernel.org/r/20250815073209.1984582-1-tujinjiang@huawei.com


Fixes: aaf99ac2 ("mm/hwpoison: do not send SIGBUS to processes with recovered clean pages")
Signed-off-by: default avatarJinjiang Tu <tujinjiang@huawei.com>
Acked-by: default avatarDavid Hildenbrand <david@redhat.com>
Acked-by: default avatarMiaohe Lin <linmiaohe@huawei.com>
Reviewed-by: default avatarJane Chu <jane.chu@oracle.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Shuai Xue <xueshuai@linux.alibaba.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 44958000

mm/memory-failure.c

+8 −0
Original line number Diff line number Diff line
@@ -853,9 +853,17 @@ static int hwpoison_hugetlb_range(pte_t *ptep, unsigned long hmask, 
#define hwpoison_hugetlb_range	NULL

#endif



static int hwpoison_test_walk(unsigned long start, unsigned long end,

			     struct mm_walk *walk)

{

	/* We also want to consider pages mapped into VM_PFNMAP. */

	return 0;

}



static const struct mm_walk_ops hwpoison_walk_ops = {

	.pmd_entry = hwpoison_pte_range,

	.hugetlb_entry = hwpoison_hugetlb_range,

	.test_walk = hwpoison_test_walk,

	.walk_lock = PGWALK_RDLOCK,

};