mm/hugetlb: fix kernel NULL pointer dereference when migrating hugetlb folio

JIRA: https://issues.redhat.com/browse/RHEL-84184
NOTE: this patch can also be found (by kerneloscope) on a dead parent branch
      in upstream mainline tree as:
      commit 1390a33
Conflicts:
  * include/linux/page-flags.h: RHEL-only hunk is required here to avoid breaking
    the build for kernel variants that disable CONFIG_TRANSPARENT_HUGEPAGE but
    keep CONFIG_HUGETLBFS enabled (-rt). This is because RHEL-9 misses upstream
    v6.10 commit 85edc15 ("mm: remove folio_prep_large_rmappable()") along
    with its accompanying series which are irrelevant for this backport work;

This patch is a backport of the following upstream commit:
commit f708f69
Author: Miaohe Lin <[email protected]>
Date:   Tue Jul 9 20:04:33 2024 +0800

    mm/hugetlb: fix kernel NULL pointer dereference when migrating hugetlb folio

    A kernel crash was observed when migrating hugetlb folio:

    BUG: kernel NULL pointer dereference, address: 0000000000000008
    PGD 0 P4D 0
    Oops: Oops: 0002 [#1] PREEMPT SMP NOPTI
    CPU: 0 PID: 3435 Comm: bash Not tainted 6.10.0-rc6-00450-g8578ca01f21f #66
    RIP: 0010:__folio_undo_large_rmappable+0x70/0xb0
    RSP: 0018:ffffb165c98a7b38 EFLAGS: 00000097
    RAX: fffffbbc44528090 RBX: 0000000000000000 RCX: 0000000000000000
    RDX: ffffa30e000a2800 RSI: 0000000000000246 RDI: ffffa3153ffffcc0
    RBP: fffffbbc44528000 R08: 0000000000002371 R09: ffffffffbe4e5868
    R10: 0000000000000001 R11: 0000000000000001 R12: ffffa3153ffffcc0
    R13: fffffbbc44468000 R14: 0000000000000001 R15: 0000000000000001
    FS:  00007f5b3a716740(0000) GS:ffffa3151fc00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000008 CR3: 000000010959a000 CR4: 00000000000006f0
    Call Trace:
     <TASK>
     __folio_migrate_mapping+0x59e/0x950
     __migrate_folio.constprop.0+0x5f/0x120
     move_to_new_folio+0xfd/0x250
     migrate_pages+0x383/0xd70
     soft_offline_page+0x2ab/0x7f0
     soft_offline_page_store+0x52/0x90
     kernfs_fop_write_iter+0x12c/0x1d0
     vfs_write+0x380/0x540
     ksys_write+0x64/0xe0
     do_syscall_64+0xb9/0x1d0
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    RIP: 0033:0x7f5b3a514887
    RSP: 002b:00007ffe138fce68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
    RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007f5b3a514887
    RDX: 000000000000000c RSI: 0000556ab809ee10 RDI: 0000000000000001
    RBP: 0000556ab809ee10 R08: 00007f5b3a5d1460 R09: 000000007fffffff
    R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000c
    R13: 00007f5b3a61b780 R14: 00007f5b3a617600 R15: 00007f5b3a616a00

    It's because hugetlb folio is passed to __folio_undo_large_rmappable()
    unexpectedly.  large_rmappable flag is imperceptibly set to hugetlb folio
    since commit f6a8dd9 ("hugetlb: convert alloc_buddy_hugetlb_folio to
    use a folio").  Then commit be9581e ("mm: fix crashes from deferred
    split racing folio migration") makes folio_migrate_mapping() call
    folio_undo_large_rmappable() triggering the bug.  Fix this issue by
    clearing large_rmappable flag for hugetlb folios.  They don't need that
    flag set anyway.

    Link: https://lkml.kernel.org/r/[email protected]
    Fixes: f6a8dd9 ("hugetlb: convert alloc_buddy_hugetlb_folio to use a folio")
    Fixes: be9581e ("mm: fix crashes from deferred split racing folio migration")
    Signed-off-by: Miaohe Lin <[email protected]>
    Cc: Hugh Dickins <[email protected]>
    Cc: Matthew Wilcox (Oracle) <[email protected]>
    Cc: Muchun Song <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>

Signed-off-by: Rafael Aquini <[email protected]>

Author: Rafael Aquini

include/linux/page-flags.h

@@ -861,7 +861,7 @@ static inline void ClearPageCompound(struct page *page)
 }
 PAGEFLAG(LargeRmappable, large_rmappable, PF_SECOND)
 #else
-TESTPAGEFLAG_FALSE(LargeRmappable, large_rmappable)
+PAGEFLAG_FALSE(LargeRmappable, large_rmappable)
 #endif
 
 #define PG_head_mask ((1UL << PG_head))

mm/hugetlb.c

@@ -2118,6 +2118,9 @@ static struct folio *alloc_buddy_hugetlb_folio(struct hstate *h,
 		nid = numa_mem_id();
 retry:
 	folio = __folio_alloc(gfp_mask, order, nid, nmask);
+	/* Ensure hugetlb folio won't have large_rmappable flag set. */
+	if (folio)
+		folio_clear_large_rmappable(folio);
 
 	if (folio && !folio_ref_freeze(folio, 1)) {
 		folio_put(folio);