From patchwork Tue Mar 10 12:38:42 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 229495 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8B19C10F27 for ; Tue, 10 Mar 2020 13:30:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A0ADC24649 for ; Tue, 10 Mar 2020 13:30:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1583847003; bh=uUmpij+9W1OTILI+xOFyBliAfKE59rmj0bsOZV9Bvy8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=TssrC+stJ7xbYUYOQCFJMdsI1CpFK9bz9yvAad2gL8R8ArzPcJQZ5wuA/n24DFZGJ EPsLy99q3SNm35MkFNn4Wacv/agpjg2GwO3mQY1e7Olc5vRpK4PEKv4lsh59S1OP18 jyhyLLlRZFWzDMyyuFsTMLqeOCd6XH1xjgIzQWQI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728843AbgCJMvK (ORCPT ); Tue, 10 Mar 2020 08:51:10 -0400 Received: from mail.kernel.org ([198.145.29.99]:56174 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728754AbgCJMvJ (ORCPT ); Tue, 10 Mar 2020 08:51:09 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8797B24699; Tue, 10 Mar 2020 12:51:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1583844669; bh=uUmpij+9W1OTILI+xOFyBliAfKE59rmj0bsOZV9Bvy8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1VjkGNPALm1MqB+98YF0Ij00B05GzU8bNZIU9f8mQUyDLXnqGJJ2Z4lpgcWTtTbbF 9JRVOFUi1RGYq0EBL271kJhYtvQKdKtoRleLmtRsb9oHtdYWj9X3CRPMP6QVDKVusZ qpzQKnCn/0GC51bUt5THBp1vMEzDEpNAnJYOf54M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrew Morton , "Huang, Ying" , Zi Yan , William Kucharski , "Kirill A. Shutemov" , Vlastimil Babka , Michal Hocko , Andrea Arcangeli , Linus Torvalds Subject: [PATCH 5.4 076/168] mm: fix possible PMD dirty bit lost in set_pmd_migration_entry() Date: Tue, 10 Mar 2020 13:38:42 +0100 Message-Id: <20200310123642.991670395@linuxfoundation.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200310123635.322799692@linuxfoundation.org> References: <20200310123635.322799692@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Huang Ying commit 8a8683ad9ba48b4b52a57f013513d1635c1ca5c4 upstream. In set_pmd_migration_entry(), pmdp_invalidate() is used to change PMD atomically. But the PMD is read before that with an ordinary memory reading. If the THP (transparent huge page) is written between the PMD reading and pmdp_invalidate(), the PMD dirty bit may be lost, and cause data corruption. The race window is quite small, but still possible in theory, so need to be fixed. The race is fixed via using the return value of pmdp_invalidate() to get the original content of PMD, which is a read/modify/write atomic operation. So no THP writing can occur in between. The race has been introduced when the THP migration support is added in the commit 616b8371539a ("mm: thp: enable thp migration in generic path"). But this fix depends on the commit d52605d7cb30 ("mm: do not lose dirty and accessed bits in pmdp_invalidate()"). So it's easy to be backported after v4.16. But the race window is really small, so it may be fine not to backport the fix at all. Signed-off-by: Andrew Morton Signed-off-by: "Huang, Ying" Reviewed-by: Zi Yan Reviewed-by: William Kucharski Acked-by: Kirill A. Shutemov Cc: Cc: Vlastimil Babka Cc: Michal Hocko Cc: Andrea Arcangeli Link: http://lkml.kernel.org/r/20200220075220.2327056-1-ying.huang@intel.com Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/huge_memory.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -3032,8 +3032,7 @@ void set_pmd_migration_entry(struct page return; flush_cache_range(vma, address, address + HPAGE_PMD_SIZE); - pmdval = *pvmw->pmd; - pmdp_invalidate(vma, address, pvmw->pmd); + pmdval = pmdp_invalidate(vma, address, pvmw->pmd); if (pmd_dirty(pmdval)) set_page_dirty(page); entry = make_migration_entry(page, pmd_write(pmdval));