From patchwork Sat Dec 25 05:12:35 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Morton X-Patchwork-Id: 528272 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 72F00C433EF for ; Sat, 25 Dec 2021 05:12:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229773AbhLYFMj (ORCPT ); Sat, 25 Dec 2021 00:12:39 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:49778 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229463AbhLYFMj (ORCPT ); Sat, 25 Dec 2021 00:12:39 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 00743B80AEA; Sat, 25 Dec 2021 05:12:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 627B7C36AE5; Sat, 25 Dec 2021 05:12:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1640409156; bh=uNyKebTzcIdoglhu867uyKUwwjmt/U1M4h+OErPnlAs=; h=Date:From:To:Subject:In-Reply-To:From; b=z4spDwkGBXW72yMFNbBX5Rad5oFe+mgXRuhMnaY/X3gioxuD37YNttVgc6opgB/yf m4tgra8mjYTWXbFBJ1lwhDO+Bo5dlzIIyXDYUp6tYLcGeIxoG9jmyttquldDkBy2KB 82L/avVMYi4MQMmfBI0h+qslNE2i/JvCQZiVlq88= Date: Fri, 24 Dec 2021 21:12:35 -0800 From: Andrew Morton To: aarcange@redhat.com, akpm@linux-foundation.org, arbn@yandex-team.com, linux-mm@kvack.org, mgorman@techsingularity.net, mhocko@suse.com, mm-commits@vger.kernel.org, rientjes@google.com, stable@vger.kernel.org, torvalds@linux-foundation.org Subject: [patch 2/9] mm: mempolicy: fix THP allocations escaping mempolicy restrictions Message-ID: <20211225051235.JoA_I5IqL%akpm@linux-foundation.org> In-Reply-To: <20211224211127.30b60764d059ff3b0afea38a@linux-foundation.org> User-Agent: s-nail v14.8.16 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Andrey Ryabinin Subject: mm: mempolicy: fix THP allocations escaping mempolicy restrictions alloc_pages_vma() may try to allocate THP page on the local NUMA node first: page = __alloc_pages_node(hpage_node, gfp | __GFP_THISNODE | __GFP_NORETRY, order); And if the allocation fails it retries allowing remote memory: if (!page && (gfp & __GFP_DIRECT_RECLAIM)) page = __alloc_pages_node(hpage_node, gfp, order); However, this retry allocation completely ignores memory policy nodemask allowing allocation to escape restrictions. The first appearance of this bug seems to be the commit ac5b2c18911f ("mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings") The bug disappeared later in the commit 89c83fb539f9 ("mm, thp: consolidate THP gfp handling into alloc_hugepage_direct_gfpmask") and reappeared again in slightly different form in the commit 76e654cc91bb ("mm, page_alloc: allow hugepage fallback to remote nodes when madvised") Fix this by passing correct nodemask to the __alloc_pages() call. The demonstration/reproducer of the problem: $ mount -oremount,size=4G,huge=always /dev/shm/ $ echo always > /sys/kernel/mm/transparent_hugepage/defrag $ cat mbind_thp.c #include #include #include #include #include #include #include #include #define SIZE 2ULL << 30 int main(int argc, char **argv) { int fd; unsigned long long i; char *addr; pid_t pid; char buf[100]; unsigned long nodemask = 1; fd = open("/dev/shm/test", O_RDWR|O_CREAT); assert(fd > 0); assert(ftruncate(fd, SIZE) == 0); addr = mmap(NULL, SIZE, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0); assert(mbind(addr, SIZE, MPOL_BIND, &nodemask, 2, MPOL_MF_STRICT|MPOL_MF_MOVE)==0); for (i = 0; i < SIZE; i+=4096) { addr[i] = 1; } pid = getpid(); snprintf(buf, sizeof(buf), "grep shm /proc/%d/numa_maps", pid); system(buf); sleep(10000); return 0; } $ gcc mbind_thp.c -o mbind_thp -lnuma $ numactl -H available: 2 nodes (0-1) node 0 cpus: 0 2 node 0 size: 1918 MB node 0 free: 1595 MB node 1 cpus: 1 3 node 1 size: 2014 MB node 1 free: 1731 MB node distances: node 0 1 0: 10 20 1: 20 10 $ rm -f /dev/shm/test; taskset -c 0 ./mbind_thp 7fd970a00000 bind:0 file=/dev/shm/test dirty=524288 active=0 N0=396800 N1=127488 kernelpagesize_kB=4 Link: https://lkml.kernel.org/r/20211208165343.22349-1-arbn@yandex-team.com Fixes: ac5b2c18911f ("mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings") Signed-off-by: Andrey Ryabinin Acked-by: Michal Hocko Acked-by: Mel Gorman Acked-by: David Rientjes Cc: Andrea Arcangeli Cc: Signed-off-by: Andrew Morton --- mm/mempolicy.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/mm/mempolicy.c~mm-mempolicy-fix-thp-allocations-escaping-mempolicy-restrictions +++ a/mm/mempolicy.c @@ -2140,8 +2140,7 @@ struct page *alloc_pages_vma(gfp_t gfp, * memory with both reclaim and compact as well. */ if (!page && (gfp & __GFP_DIRECT_RECLAIM)) - page = __alloc_pages_node(hpage_node, - gfp, order); + page = __alloc_pages(gfp, order, hpage_node, nmask); goto out; } From patchwork Sat Dec 25 05:12:45 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Morton X-Patchwork-Id: 528139 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AECE8C433EF for ; Sat, 25 Dec 2021 05:12:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229806AbhLYFMt (ORCPT ); Sat, 25 Dec 2021 00:12:49 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43960 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229463AbhLYFMs (ORCPT ); Sat, 25 Dec 2021 00:12:48 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A3814C061401; Fri, 24 Dec 2021 21:12:48 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 606E4B80939; Sat, 25 Dec 2021 05:12:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D675CC36AE5; Sat, 25 Dec 2021 05:12:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1640409166; bh=t1cKdzqXaN9juD51UD8CmyrMzm8EciQHDZMKnzSa3xk=; h=Date:From:To:Subject:In-Reply-To:From; b=oCc7X0JSK/XViToPutcUMR93WkiTlosKmOMselPvWweQ2xfsRlGV4fhngKzO5/Dq4 MD6PoyAvEnmImr1kTzCKxK7ekbdOKYmcNbOizFOTsEUSWcbBnhoSUnQsux2tJ/RDOA 0gXNN6ZQ3NTBafwGxAHzE6sgdfO2CqiKSsatZU58= Date: Fri, 24 Dec 2021 21:12:45 -0800 From: Andrew Morton To: akpm@linux-foundation.org, linux-mm@kvack.org, luofei@unicloud.com, mike.kravetz@oracle.com, mm-commits@vger.kernel.org, naoya.horiguchi@nec.com, stable@vger.kernel.org, torvalds@linux-foundation.org Subject: [patch 5/9] mm, hwpoison: fix condition in free hugetlb page path Message-ID: <20211225051245.qaFlHGVIZ%akpm@linux-foundation.org> In-Reply-To: <20211224211127.30b60764d059ff3b0afea38a@linux-foundation.org> User-Agent: s-nail v14.8.16 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Naoya Horiguchi Subject: mm, hwpoison: fix condition in free hugetlb page path When a memory error hits a tail page of a free hugepage, __page_handle_poison() is expected to be called to isolate the error in 4kB unit, but it's not called due to the outdated if-condition in memory_failure_hugetlb(). This loses the chance to isolate the error in the finer unit, so it's not optimal. Drop the condition. This "(p != head && TestSetPageHWPoison(head)" condition is based on the old semantics of PageHWPoison on hugepage (where PG_hwpoison flag was set on the subpage), so it's not necessray any more. By getting to set PG_hwpoison on head page for hugepages, concurrent error events on different subpages in a single hugepage can be prevented by TestSetPageHWPoison(head) at the beginning of memory_failure_hugetlb(). So dropping the condition should not reopen the race window originally mentioned in commit b985194c8c0a ("hwpoison, hugetlb: lock_page/unlock_page does not match for handling a free hugepage") [naoya.horiguchi@linux.dev: fix "HardwareCorrupted" counter] Link: https://lkml.kernel.org/r/20211220084851.GA1460264@u2004 Link: https://lkml.kernel.org/r/20211210110208.879740-1-naoya.horiguchi@linux.dev Signed-off-by: Naoya Horiguchi Reported-by: Fei Luo Reviewed-by: Mike Kravetz Cc: [5.14+] Signed-off-by: Andrew Morton --- mm/memory-failure.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) --- a/mm/memory-failure.c~mm-hwpoison-fix-condition-in-free-hugetlb-page-path +++ a/mm/memory-failure.c @@ -1470,17 +1470,12 @@ static int memory_failure_hugetlb(unsign if (!(flags & MF_COUNT_INCREASED)) { res = get_hwpoison_page(p, flags); if (!res) { - /* - * Check "filter hit" and "race with other subpage." - */ lock_page(head); - if (PageHWPoison(head)) { - if ((hwpoison_filter(p) && TestClearPageHWPoison(p)) - || (p != head && TestSetPageHWPoison(head))) { + if (hwpoison_filter(p)) { + if (TestClearPageHWPoison(head)) num_poisoned_pages_dec(); - unlock_page(head); - return 0; - } + unlock_page(head); + return 0; } unlock_page(head); res = MF_FAILED; From patchwork Sat Dec 25 05:12:54 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Morton X-Patchwork-Id: 528271 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D4918C433FE for ; Sat, 25 Dec 2021 05:12:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229831AbhLYFM6 (ORCPT ); Sat, 25 Dec 2021 00:12:58 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:49984 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229822AbhLYFM6 (ORCPT ); Sat, 25 Dec 2021 00:12:58 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D937EB80B33; Sat, 25 Dec 2021 05:12:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5C01DC36AE5; Sat, 25 Dec 2021 05:12:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1640409175; bh=jwq1C0xCNOQZ4o6aepOLSPYYPk9cTF/tgIqKQoBxg34=; h=Date:From:To:Subject:In-Reply-To:From; b=xSA61ujtNjDkZtLPmLHfBT1+LxS6pJlEx5z4/wPNIzkseeNcv+WVWAq69gOWuqFFq akp2WTErizuLoHhgy46S4r8v952WtBksPb84YUcN4PY6xYWwQwiHup1HTEGgynsRVI FUCeyObq9KTOROLgioU7WDKAzKZVQ5NuuOYRKw4M= Date: Fri, 24 Dec 2021 21:12:54 -0800 From: Andrew Morton To: akpm@linux-foundation.org, linux-mm@kvack.org, mm-commits@vger.kernel.org, sangwoob@amazon.com, sj@kernel.org, stable@vger.kernel.org, torvalds@linux-foundation.org Subject: [patch 8/9] mm/damon/dbgfs: protect targets destructions with kdamond_lock Message-ID: <20211225051254.qnNQD42Wg%akpm@linux-foundation.org> In-Reply-To: <20211224211127.30b60764d059ff3b0afea38a@linux-foundation.org> User-Agent: s-nail v14.8.16 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: SeongJae Park Subject: mm/damon/dbgfs: protect targets destructions with kdamond_lock DAMON debugfs interface iterates current monitoring targets in 'dbgfs_target_ids_read()' while holding the corresponding 'kdamond_lock'. However, it also destructs the monitoring targets in 'dbgfs_before_terminate()' without holding the lock. This can result in a use_after_free bug. This commit avoids the race by protecting the destruction with the corresponding 'kdamond_lock'. Link: https://lkml.kernel.org/r/20211221094447.2241-1-sj@kernel.org Reported-by: Sangwoo Bae Fixes: 4bc05954d007 ("mm/damon: implement a debugfs-based user space interface") Signed-off-by: SeongJae Park Cc: [5.15.x] Signed-off-by: Andrew Morton --- mm/damon/dbgfs.c | 2 ++ 1 file changed, 2 insertions(+) --- a/mm/damon/dbgfs.c~mm-damon-dbgfs-protect-targets-destructions-with-kdamond_lock +++ a/mm/damon/dbgfs.c @@ -650,10 +650,12 @@ static void dbgfs_before_terminate(struc if (!targetid_is_pid(ctx)) return; + mutex_lock(&ctx->kdamond_lock); damon_for_each_target_safe(t, next, ctx) { put_pid((struct pid *)t->id); damon_destroy_target(t); } + mutex_unlock(&ctx->kdamond_lock); } static struct damon_ctx *dbgfs_new_ctx(void) From patchwork Sat Dec 25 05:12:58 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Morton X-Patchwork-Id: 528138 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 28F6BC4332F for ; Sat, 25 Dec 2021 05:13:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229833AbhLYFNA (ORCPT ); Sat, 25 Dec 2021 00:13:00 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:37824 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229822AbhLYFNA (ORCPT ); Sat, 25 Dec 2021 00:13:00 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1970360C75; Sat, 25 Dec 2021 05:13:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 33DB7C36AE5; Sat, 25 Dec 2021 05:12:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1640409179; bh=SgMRfPzvQcmhc31+bo+uLtucdaBKnrw6ZzF0pf5qZt4=; h=Date:From:To:Subject:In-Reply-To:From; b=Gkvv/aTqATuvvWbQCzXzcTzace/fG1B35jGOgjcbY1HXPqfk0JwI0+woUrcRJMBta qxK2Nw2LwDXjifZSmY8ABpLTol9F+3oOFSZe8BknsTD/GhMISU2CofNPNPligo3Bc0 bIMLOagQlvFZwFKlJosxI1vDKGowBTRUQF/r9vq0= Date: Fri, 24 Dec 2021 21:12:58 -0800 From: Andrew Morton To: akpm@linux-foundation.org, hulkci@huawei.com, linux-mm@kvack.org, liushixin2@huawei.com, mm-commits@vger.kernel.org, naoya.horiguchi@nec.com, osalvador@suse.de, stable@vger.kernel.org, torvalds@linux-foundation.org Subject: [patch 9/9] mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page() Message-ID: <20211225051258.AXb30IPQI%akpm@linux-foundation.org> In-Reply-To: <20211224211127.30b60764d059ff3b0afea38a@linux-foundation.org> User-Agent: s-nail v14.8.16 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Liu Shixin Subject: mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page() Hulk Robot reported a panic in put_page_testzero() when testing madvise() with MADV_SOFT_OFFLINE. The BUG() is triggered when retrying get_any_page(). This is because we keep MF_COUNT_INCREASED flag in second try but the refcnt is not increased. page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) ------------[ cut here ]------------ kernel BUG at include/linux/mm.h:737! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 5 PID: 2135 Comm: sshd Tainted: G B 5.16.0-rc6-dirty #373 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:release_pages+0x53f/0x840 Code: 0c 01 4c 8d 60 ff e9 5b fb ff ff 48 c7 c6 d8 97 0c b3 4c 89 e7 48 83 05 0e 7b 3c 0c 01 e8 89 3d 04 00 48 83 05 11 7b 3c 0c 01 <0f> 0b 48 83 05 0f 7b 3c 0c 01 48 83 05 0f 7b 3c 0c 01 48 83 05f RSP: 0018:ffffc900015a7bc0 EFLAGS: 00010002 RAX: 000000000000003e RBX: ffffffffbace04c8 RCX: 0000000000000002 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000000ffffffff RBP: ffff88817b9acd50 R08: 0000000000000000 R09: c0000000ffefffff R10: 0000000000000001 R11: ffffc900015a79b0 R12: ffffea0005e1c900 R13: ffffea0005e1de88 R14: 000000000000001f R15: ffff888100071000 FS: 0000000000000000(0000) GS:ffff88842fb40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f305e8de3d4 CR3: 000000017bb6f000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: free_pages_and_swap_cache+0x64/0x80 tlb_flush_mmu+0x6f/0x220 unmap_page_range+0xe6c/0x12c0 unmap_single_vma+0x90/0x170 unmap_vmas+0xc4/0x180 exit_mmap+0xde/0x3a0 mmput+0xa3/0x250 do_exit+0x564/0x1470 do_group_exit+0x3b/0x100 __do_sys_exit_group+0x13/0x20 __x64_sys_exit_group+0x16/0x20 do_syscall_64+0x34/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f30625401d9 Code: Unable to access opcode bytes at RIP 0x7f30625401af. RSP: 002b:00007ffe391b0c88 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f30625401d9 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000001 RBP: 00007f306283d838 R08: 000000000000003c R09: 00000000000000e7 R10: fffffffffffffe30 R11: 0000000000000246 R12: 00007f306283d838 R13: 00007f3062842e80 R14: 0000000000000000 R15: ffffaa4fb7932430 Modules linked in: ---[ end trace e99579b570fe0649 ]--- RIP: 0010:release_pages+0x53f/0x840 Code: 0c 01 4c 8d 60 ff e9 5b fb ff ff 48 c7 c6 d8 97 0c b3 4c 89 e7 48 83 05 0e 7b 3c 0c 01 e8 89 3d 04 00 48 83 05 11 7b 3c 0c 01 <0f> 0b 48 83 05 0f 7b 3c 0c 01 48 83 05 0f 7b 3c 0c 01 48 83 05f RSP: 0018:ffffc900015a7bc0 EFLAGS: 00010002 RAX: 000000000000003e RBX: ffffffffbace04c8 RCX: 0000000000000002 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000000ffffffff RBP: ffff88817b9acd50 R08: 0000000000000000 R09: c0000000ffefffff R10: 0000000000000001 R11: ffffc900015a79b0 R12: ffffea0005e1c900 R13: ffffea0005e1de88 R14: 000000000000001f R15: ffff888100071000 FS: 0000000000000000(0000) GS:ffff88842fb40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f305e8de3d4 CR3: 000000017bb6f000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Link: https://lkml.kernel.org/r/20211221074908.3910286-1-liushixin2@huawei.com Fixes: b94e02822deb ("mm,hwpoison: try to narrow window race for free pages") Signed-off-by: Liu Shixin Reported-by: Hulk Robot Reviewed-by: Oscar Salvador Acked-by: Naoya Horiguchi Cc: Signed-off-by: Andrew Morton --- mm/memory-failure.c | 1 + 1 file changed, 1 insertion(+) --- a/mm/memory-failure.c~mm-hwpoison-clear-mf_count_increased-before-retrying-get_any_page +++ a/mm/memory-failure.c @@ -2234,6 +2234,7 @@ retry: } else if (ret == 0) { if (soft_offline_free_page(page) && try_again) { try_again = false; + flags &= ~MF_COUNT_INCREASED; goto retry; } }