Commit dad4e5b3 authored by Dan Williams's avatar Dan Williams Committed by Linus Torvalds
Browse files

mm: fix page reference leak in soft_offline_page() 

The conversion to move pfn_to_online_page() internal to
soft_offline_page() missed that the get_user_pages() reference taken by
the madvise() path needs to be dropped when pfn_to_online_page() fails.

Note the direct sysfs-path to soft_offline_page() does not perform a
get_user_pages() lookup.

When soft_offline_page() is handed a pfn_valid() && !pfn_to_online_page()
pfn the kernel hangs at dax-device shutdown due to a leaked reference.

Link: https://lkml.kernel.org/r/161058501210.1840162.8108917599181157327.stgit@dwillia2-desk3.amr.corp.intel.com


Fixes: feec24a6 ("mm, soft-offline: convert parameter to pfn")
Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
Reviewed-by: default avatarOscar Salvador <osalvador@suse.de>
Reviewed-by: default avatarNaoya Horiguchi <naoya.horiguchi@nec.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Qian Cai <cai@lca.pw>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 251b5497

mm/memory-failure.c

+16 −4
Original line number Diff line number Diff line
@@ -1885,6 +1885,12 @@ static int soft_offline_free_page(struct page *page) 
	return rc;

}



static void put_ref_page(struct page *page)

{

	if (page)

		put_page(page);

}



/**

 * soft_offline_page - Soft offline a page.

 * @pfn: pfn to soft-offline
@@ -1910,20 +1916,26 @@ static int soft_offline_free_page(struct page *page) 
int soft_offline_page(unsigned long pfn, int flags)

{

	int ret;

	struct page *page;

	bool try_again = true;

	struct page *page, *ref_page = NULL;



	WARN_ON_ONCE(!pfn_valid(pfn) && (flags & MF_COUNT_INCREASED));



	if (!pfn_valid(pfn))

		return -ENXIO;

	if (flags & MF_COUNT_INCREASED)

		ref_page = pfn_to_page(pfn);



	/* Only online pages can be soft-offlined (esp., not ZONE_DEVICE). */

	page = pfn_to_online_page(pfn);

	if (!page)

	if (!page) {

		put_ref_page(ref_page);

		return -EIO;

	}



	if (PageHWPoison(page)) {

		pr_info("%s: %#lx page already poisoned\n", __func__, pfn);

		if (flags & MF_COUNT_INCREASED)

			put_page(page);

		put_ref_page(ref_page);

		return 0;

	}