kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
No description
1,080,455 commits 116 branches 5,798 tags 5.6 GiB
  • C 96.9%
  • Assembly 0.9%
  • Rust 0.6%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Xiangfeng Cai 9c5fdffc5e mm/hugetlb: fix list corruption in allocate_file_region_entries() 
commit dd9623f58e upstream.

allocate_file_region_entries() tops up resv->region_cache with freshly
allocated file_region descriptors.  The allocation uses GFP_KERNEL, so
resv->lock is dropped around it: the new entries are gathered on a
stack-local list head, allocated_regions, and spliced into
resv->region_cache once the lock is re-acquired.

The splice used list_splice(), which moves the entries but does not
re-initialize the source head, so allocated_regions is left pointing at an
entry that now lives on resv->region_cache.  The top-up runs in a while
loop that re-checks the cache deficit after re-acquiring the lock.  For a
shared mapping the resv_map is shared by every mapper of the hugetlbfs
inode, so a concurrent region_chg()/region_add()/region_del() on the same
resv_map can consume cache entries during the unlocked window and force a
second iteration.  That iteration calls list_add() on the stale head and
corrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check
trips:

  list_add corruption. next->prev should be prev (ffffc900011ff7f8),
  but was ffff88814c281460. (next=ffff88814c545640).
  kernel BUG at lib/list_debug.c:31!
   allocate_file_region_entries+0x191/0x420
   region_chg+0x267/0x300
   hugetlb_reserve_pages+0x387/0xc80
   hugetlbfs_file_mmap+0x2ce/0x3f0
   mmap_region+0x1348/0x1a80
   do_mmap+0x85e/0xb90
   vm_mmap_pgoff+0x18c/0x330
   ksys_mmap_pgoff+0x2a1/0x3e0
   do_syscall_64+0xd7/0x420

Without CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack
address into resv->region_cache, leading to later use-after-free.

This was observed as a real host panic on a dense KVM host where a QEMU
guest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate
SPDK/DPDK vhost-user target, generating concurrent region_* traffic on one
shared resv_map.

Use list_splice_init() so the source head is re-initialized empty after
each splice, making the retry loop safe.

Link: https://lore.kernel.org/20260713171456.300518-2-caixiangfeng@bytedance.com
Fixes: d3ec7b6e09 ("mm/hugetlb: use list_splice to merge two list at once")
Signed-off-by: Xiangfeng Cai <caixiangfeng@bytedance.com>
Reviewed-by: Muchun Song <muchun.song@linux.dev>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Wei Yang <richard.weiyang@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-08-19 17:14:08 +02:00
arch powerpc/boot: Fix treeboot-akebono CPU node lookup check 2026-08-19 17:14:07 +02:00
block partitions: aix: bound the pp_count scan to the ppe array 2026-07-24 15:51:24 +02:00
certs X.509: Fix validation of ASN.1 certificate header 2026-07-24 15:51:59 +02:00
crypto crypto: rsa-pkcs1pad: Don't WARN on an empty digest 2026-08-19 17:13:55 +02:00
Documentation PCI: Move Resizable BAR code to rebar.c 2026-07-24 15:51:58 +02:00
drivers pinctrl: bm1880: add missing select GENERIC_PINCONF 2026-08-19 17:14:08 +02:00
fs smb: client: fix buffer leaks in SMB1 read and write 2026-08-19 17:14:07 +02:00
include netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() 2026-08-19 17:14:06 +02:00
init randomize_kstack: Maintain kstack_offset per task 2026-06-19 13:33:41 +02:00
io_uring io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item 2026-07-24 15:51:21 +02:00
ipc ipc/shm: serialize orphan cleanup with shm_nattch updates 2026-06-19 13:33:38 +02:00
kernel tracing/mmiotrace: Reset dropped_count in mmio_reset_data() 2026-08-19 17:14:08 +02:00
lib rhashtable: clear stale iter->p on table restart 2026-08-19 17:14:08 +02:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
mm mm/hugetlb: fix list corruption in allocate_file_region_entries() 2026-08-19 17:14:08 +02:00
net can: isotp: check register_netdevice_notifier() error in module init 2026-08-19 17:14:08 +02:00
samples tracing/events: Fix to check the simple_tsk_fn creation 2026-07-24 15:51:42 +02:00
scripts kconfig: fix potential NULL pointer dereference in conf_askvalue 2026-07-24 15:51:28 +02:00
security keys: make keyring key-chunk byte order agree with keyring_diff_objects() 2026-08-19 17:14:06 +02:00
sound ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup 2026-08-19 17:14:06 +02:00
tools bitops: make BYTES_TO_BITS() treewide-available 2026-07-24 15:51:56 +02:00
usr kbuild: hdrcheck: fix cross build with clang 2025-06-27 11:05:22 +01:00
virt KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers 2026-07-24 15:52:02 +02:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore Remove *.orig pattern from .gitignore 2024-10-17 15:11:10 +02:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS staging: rtl8712: Remove driver using deprecated API wext 2025-12-07 06:09:36 +09:00
Makefile Linux 5.15.215 2026-08-07 08:07:31 +02:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.