mm/hwpoison: do not send SIGBUS to processes with recovered clean pages

JIRA: https://issues.redhat.com/browse/RHEL-104908
Conflicts:
  Minor context conflict as there is an upstream patch adding documentation
  to the proceeding function.

This patch is a backport of the following upstream commit:
commit aaf99ac
Author: Shuai Xue <[email protected]>
Date:   Wed Mar 12 19:28:51 2025 +0800

    mm/hwpoison: do not send SIGBUS to processes with recovered clean pages

    When an uncorrected memory error is consumed there is a race between the
    CMCI from the memory controller reporting an uncorrected error with a UCNA
    signature, and the core reporting and SRAR signature machine check when
    the data is about to be consumed.

    - Background: why *UN*corrected errors tied to *C*MCI in Intel platform [1]

    Prior to Icelake memory controllers reported patrol scrub events that
    detected a previously unseen uncorrected error in memory by signaling a
    broadcast machine check with an SRAO (Software Recoverable Action
    Optional) signature in the machine check bank.  This was overkill because
    it's not an urgent problem that no core is on the verge of consuming that
    bad data.  It's also found that multi SRAO UCE may cause nested MCE
    interrupts and finally become an IERR.

    Hence, Intel downgrades the machine check bank signature of patrol scrub
    from SRAO to UCNA (Uncorrected, No Action required), and signal changed to
    #CMCI.  Just to add to the confusion, Linux does take an action (in
    uc_decode_notifier()) to try to offline the page despite the UC*NA*
    signature name.

    - Background: why #CMCI and #MCE race when poison is consuming in Intel platform [1]

    Having decided that CMCI/UCNA is the best action for patrol scrub errors,
    the memory controller uses it for reads too.  But the memory controller is
    executing asynchronously from the core, and can't tell the difference
    between a "real" read and a speculative read.  So it will do CMCI/UCNA if
    an error is found in any read.

    Thus:

    1) Core is clever and thinks address A is needed soon, issues a speculative read.
    2) Core finds it is going to use address A soon after sending the read request
    3) The CMCI from the memory controller is in a race with MCE from the core
       that will soon try to retire the load from address A.

    Quite often (because speculation has got better) the CMCI from the memory
    controller is delivered before the core is committed to the instruction
    reading address A, so the interrupt is taken, and Linux offlines the page
    (marking it as poison).

    - Why user process is killed for instr case

    Commit 046545a ("mm/hwpoison: fix error page recovered but reported
    "not recovered"") tries to fix noise message "Memory error not recovered"
    and skips duplicate SIGBUSs due to the race.  But it also introduced a bug
    that kill_accessing_process() return -EHWPOISON for instr case, as result,
    kill_me_maybe() send a SIGBUS to user process.

    If the CMCI wins that race, the page is marked poisoned when
    uc_decode_notifier() calls memory_failure().  For dirty pages,
    memory_failure() invokes try_to_unmap() with the TTU_HWPOISON flag,
    converting the PTE to a hwpoison entry.  As a result,
    kill_accessing_process():

    - call walk_page_range() and return 1 regardless of whether
      try_to_unmap() succeeds or fails,
    - call kill_proc() to make sure a SIGBUS is sent
    - return -EHWPOISON to indicate that SIGBUS is already sent to the
      process and kill_me_maybe() doesn't have to send it again.

    However, for clean pages, the TTU_HWPOISON flag is cleared, leaving the
    PTE unchanged and not converted to a hwpoison entry.  Conversely, for
    clean pages where PTE entries are not marked as hwpoison,
    kill_accessing_process() returns -EFAULT, causing kill_me_maybe() to send
    a SIGBUS.

    Console log looks like this:

        Memory failure: 0x827ca68: corrupted page was clean: dropped without side effects
        Memory failure: 0x827ca68: recovery action for clean LRU page: Recovered
        Memory failure: 0x827ca68: already hardware poisoned
        mce: Memory error not recovered

    To fix it, return 0 for "corrupted page was clean", preventing an
    unnecessary SIGBUS to user process.

    [1] https://lore.kernel.org/lkml/[email protected]/T/#mba94f1305b3009dd340ce4114d3221fe810d1871
    Link: https://lkml.kernel.org/r/[email protected]
    Fixes: 046545a ("mm/hwpoison: fix error page recovered but reported "not recovered"")
    Signed-off-by: Shuai Xue <[email protected]>
    Tested-by: Tony Luck <[email protected]>
    Acked-by: Miaohe Lin <[email protected]>
    Cc: Baolin Wang <[email protected]>
    Cc: Borislav Betkov <[email protected]>
    Cc: Catalin Marinas <[email protected]>
    Cc: Dave Hansen <[email protected]>
    Cc: "H. Peter Anvin" <[email protected]>
    Cc: Ingo Molnar <[email protected]>
    Cc: Jane Chu <[email protected]>
    Cc: Jarkko Sakkinen <[email protected]>
    Cc: Jonathan Cameron <[email protected]>
    Cc: Josh Poimboeuf <[email protected]>
    Cc: Naoya Horiguchi <[email protected]>
    Cc: Peter Zijlstra <[email protected]>
    Cc: Ruidong Tian <[email protected]>
    Cc: Thomas Gleinxer <[email protected]>
    Cc: Yazen Ghannam <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>

Signed-off-by: Audra Mitchell <[email protected]>

Author: Audra Mitchell

mm/memory-failure.c

@@ -879,12 +879,17 @@ static int kill_accessing_process(struct task_struct *p, unsigned long pfn,
 	mmap_read_lock(p->mm);
 	ret = walk_page_range(p->mm, 0, TASK_SIZE, &hwpoison_walk_ops,
 			      (void *)&priv);
+	/*
+	 * ret = 1 when CMCI wins, regardless of whether try_to_unmap()
+	 * succeeds or fails, then kill the process with SIGBUS.
+	 * ret = 0 when poison page is a clean page and it's dropped, no
+	 * SIGBUS is needed.
+	 */
 	if (ret == 1 && priv.tk.addr)
 		kill_proc(&priv.tk, pfn, flags);
-	else
-		ret = 0;
 	mmap_read_unlock(p->mm);
-	return ret > 0 ? -EHWPOISON : -EFAULT;
+
+	return ret > 0 ? -EHWPOISON : 0;
 }
 
 static const char *action_name[] = {