• Mike Kravetz's avatar
    hugetlb: fix memory leak associated with vma_lock structure · 612b8a31
    Mike Kravetz authored
    The hugetlb vma_lock structure hangs off the vm_private_data pointer of
    sharable hugetlb vmas.  The structure is vma specific and can not be
    shared between vmas.  At fork and various other times, vmas are duplicated
    via vm_area_dup().  When this happens, the pointer in the newly created
    vma must be cleared and the structure reallocated.  Two hugetlb specific
    routines deal with this hugetlb_dup_vma_private and hugetlb_vm_op_open. 
    Both routines are called for newly created vmas.  hugetlb_dup_vma_private
    would always clear the pointer and hugetlb_vm_op_open would allocate the
    new vms_lock structure.  This did not work in the case of this calling
    sequence pointed out in [1].
    
      move_vma
        copy_vma
          new_vma = vm_area_dup(vma);
          new_vma->vm_ops->open(new_vma); --> new_vma has its own vma lock.
        is_vm_hugetlb_page(vma)
          clear_vma_resv_huge_pages
            hugetlb_dup_vma_private --> vma->vm_private_data is set to NULL
    
    When clearing hugetlb_dup_vma_private we actually leak the associated
    vma_lock structure.
    
    The vma_lock structure contains a pointer to the associated vma.  This
    information can be used in hugetlb_dup_vma_private and hugetlb_vm_op_open
    to ensure we only clear the vm_private_data of newly created (copied)
    vmas.  In such cases, the vma->vma_lock->vma field will not point to the
    vma.
    
    Update hugetlb_dup_vma_private and hugetlb_vm_op_open to not clear
    vm_private_data if vma->vma_lock->vma == vma.  Also, log a warning if
    hugetlb_vm_op_open ever encounters the case where vma_lock has already
    been correctly allocated for the vma.
    
    [1] https://lore.kernel.org/linux-mm/5154292a-4c55-28cd-0935-82441e512fc3@huawei.com/
    
    Link: https://lkml.kernel.org/r/20221019201957.34607-1-mike.kravetz@oracle.com
    Fixes: 131a79b4 ("hugetlb: fix vma lock handling during split vma and range unmapping")
    Signed-off-by: default avatarMike Kravetz <mike.kravetz@oracle.com>
    Reviewed-by: default avatarMiaohe Lin <linmiaohe@huawei.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
    Cc: Axel Rasmussen <axelrasmussen@google.com>
    Cc: David Hildenbrand <david@redhat.com>
    Cc: Davidlohr Bueso <dave@stgolabs.net>
    Cc: James Houghton <jthoughton@google.com>
    Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
    Cc: Michal Hocko <mhocko@suse.com>
    Cc: Mina Almasry <almasrymina@google.com>
    Cc: Muchun Song <songmuchun@bytedance.com>
    Cc: Naoya Horiguchi <naoya.horiguchi@linux.dev>
    Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
    Cc: Peter Xu <peterx@redhat.com>
    Cc: Prakash Sangappa <prakash.sangappa@oracle.com>
    Cc: Sven Schnelle <svens@linux.ibm.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    612b8a31
hugetlb.c 207 KB