aab4f9828f
JIRA: https://issues.redhat.com/browse/RHEL-27745
This patch is a backport of the following upstream commit:
commit 3a5a8d343e1cf96eb9971b17cbd4b832ab19b8e7
Author: Ryan Roberts <ryan.roberts@arm.com>
Date: Wed May 1 15:33:10 2024 +0100
mm: fix race between __split_huge_pmd_locked() and GUP-fast
__split_huge_pmd_locked() can be called for a present THP, devmap or
(non-present) migration entry. It calls pmdp_invalidate() unconditionally
on the pmdp and only determines if it is present or not based on the
returned old pmd. This is a problem for the migration entry case because
pmd_mkinvalid(), called by pmdp_invalidate() must only be called for a
present pmd.
On arm64 at least, pmd_mkinvalid() will mark the pmd such that any future
call to pmd_present() will return true. And therefore any lockless
pgtable walker could see the migration entry pmd in this state and start
interpretting the fields as if it were present, leading to BadThings (TM).
GUP-fast appears to be one such lockless pgtable walker.
x86 does not suffer the above problem, but instead pmd_mkinvalid() will
corrupt the offset field of the swap entry within the swap pte. See link
below for discussion of that problem.
Fix all of this by only calling pmdp_invalidate() for a present pmd. And
for good measure let's add a warning to all implementations of
pmdp_invalidate[_ad](). I've manually reviewed all other
pmdp_invalidate[_ad]() call sites and believe all others to be conformant.
This is a theoretical bug found during code review. I don't have any test
case to trigger it in practice.
Link: https://lkml.kernel.org/r/20240501143310.1381675-1-ryan.roberts@arm.com
Link: https://lore.kernel.org/all/0dd7827a-6334-439a-8fd0-43c98e6af22b@arm.com/
Fixes:
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| fault_32.c | ||
| fault_64.c | ||
| hugetlbpage.c | ||
| hypersparc.S | ||
| init_32.c | ||
| init_64.c | ||
| init_64.h | ||
| io-unit.c | ||
| iommu.c | ||
| leon_mm.c | ||
| mm_32.h | ||
| srmmu.c | ||
| srmmu_access.S | ||
| swift.S | ||
| tlb.c | ||
| tsb.c | ||
| tsunami.S | ||
| ultra.S | ||
| viking.S | ||