From patchwork Wed Jul 17 00:14:45 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Ralph Campbell X-Patchwork-Id: 11046843 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 049231395 for ; Wed, 17 Jul 2019 00:15:46 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E9E6F285CC for ; Wed, 17 Jul 2019 00:15:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DD4C4285FB; Wed, 17 Jul 2019 00:15:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 46DE1285CC for ; Wed, 17 Jul 2019 00:15:45 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id DDA876B0008; Tue, 16 Jul 2019 20:15:43 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id D8DBD6B000A; Tue, 16 Jul 2019 20:15:43 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B42758E0001; Tue, 16 Jul 2019 20:15:43 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-yw1-f69.google.com (mail-yw1-f69.google.com [209.85.161.69]) by kanga.kvack.org (Postfix) with ESMTP id 916BD6B0008 for ; Tue, 16 Jul 2019 20:15:43 -0400 (EDT) Received: by mail-yw1-f69.google.com with SMTP id x20so17483220ywg.23 for ; Tue, 16 Jul 2019 17:15:43 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding:dkim-signature; bh=xvR8iX2outgELqejVmTcMhX9RlYLy+wU1js0WKyDum8=; b=dofLExKzZ1YAp2mnGWnp2qwKnBBe0Jir1AZR9Szj17VLZc8ErE9PWGypGFL9GJv/NO eexpiL/kf6mtUocUHhqt3QxNdmrxdZnJcDSt9sbKxd66Ma2GkE7wXoZ2mPiFdCb1NZgz 7i9hwHg63aVgu4qkb5Xxedk07v67WA8CUX8nAVsUanig6V4jvdJEgkAbC8CmJA0tIw6R GrFBVpjfsPaYc59aPACxEHPMYMhYkWkKMwmdeFb5rRqruqMTi5LuK6CGibxUPJkHBhjn Z6/3+LId7tMA2S6kqalQYHX00c43bXHMRPIsY1TtrESvpYW8eGWEAR9KgiaAPpgspSN7 UfHg== X-Gm-Message-State: APjAAAUdizFyBy3ivHF4tOz72Wa1TZM97w6YiMi6dV28ybvV1U+PLoth bskGbyqaE5PCba7yR8TaJSJM5QTmQ3pZYKGKMqvU9rzESSV8kbaac3JBNR9jkeob+dc1oiU49UF B+TpL+6tBPkNXvXNsl1bkLEHxoNREAqg36bW+XvSztunx4gvWz3fsYfUDUAaIgk7Kqw== X-Received: by 2002:a0d:ce84:: with SMTP id q126mr20340882ywd.88.1563322543324; Tue, 16 Jul 2019 17:15:43 -0700 (PDT) X-Google-Smtp-Source: APXvYqz1mDRcYQ0ruS4uNLFPXD6LCpIAZoJfNOJbUbQOiDACqtlzYV0KDQEphA1w7uUGzWxlo3Q9 X-Received: by 2002:a0d:ce84:: with SMTP id q126mr20340855ywd.88.1563322542739; Tue, 16 Jul 2019 17:15:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1563322542; cv=none; d=google.com; s=arc-20160816; b=WK4yVF7jnO6PQc0k7okvpH7G9NqGJzfeI06hZ4cvmUXJrws84e+X1iH+Hjfvg0FwLJ lz6m/e+E07bKkU2ZgAo7ZqZxAHbI+iNYsetShDES2mIhufiwlvfK5Z5wS3SOQqpcWL2r +He+MHj1IiT+fqTVJdd5vZwc3esHjvnprl2wofTJr8++COMmxy5gpEC46KmfaBBL+X4d YaTYK3YcaJY7qlDQtvFSytpPojYxIQ6bopvMhLwN8kE9xx5/ZrcpKGgZMpD9QyC/rC6/ USBSEztUzlPdiWU68nkqZzykVgdmLRaeWVqUQfxskZZLkiP9Tb+N10T5CWHiRF2kHycI IXGg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=dkim-signature:content-transfer-encoding:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from; bh=xvR8iX2outgELqejVmTcMhX9RlYLy+wU1js0WKyDum8=; b=nACFUUKR2Z+wZQ86soOtQ/gEpXyCOZS9LimKnpk9P/9XCmkFkUdrUO+5yqOZkNuBqY +hQr1liBlhXeNajhW8nJJ0cIDFuJyQnGWfAXQQRERPksFrYMmu3o++2GIUzftT8p58Xa mZ68j8/PvrTm2W13XKogbW7pIFHOszX98ows/QsdpfVRl23UVALgJ7RwEpSTpuym1CS0 VhxvSymT734SNGVYANfM1/G8Jzk4pxhp0gfLlBHKikWYmbt7y7j7SaUa2V83XE/Nkisb CEML9SFa6H6+TTPS1+LaSZGD3Ntct9S3GzjndXYlDh1SeA2W/LduvHGpXfILrX4ZoaoY 7ZCw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@nvidia.com header.s=n1 header.b=TRCk27Tt; spf=pass (google.com: domain of rcampbell@nvidia.com designates 216.228.121.64 as permitted sender) smtp.mailfrom=rcampbell@nvidia.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=nvidia.com Received: from hqemgate15.nvidia.com (hqemgate15.nvidia.com. [216.228.121.64]) by mx.google.com with ESMTPS id d14si8691441ybr.421.2019.07.16.17.15.42 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 16 Jul 2019 17:15:42 -0700 (PDT) Received-SPF: pass (google.com: domain of rcampbell@nvidia.com designates 216.228.121.64 as permitted sender) client-ip=216.228.121.64; Authentication-Results: mx.google.com; dkim=pass header.i=@nvidia.com header.s=n1 header.b=TRCk27Tt; spf=pass (google.com: domain of rcampbell@nvidia.com designates 216.228.121.64 as permitted sender) smtp.mailfrom=rcampbell@nvidia.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=nvidia.com Received: from hqpgpgate102.nvidia.com (Not Verified[216.228.121.13]) by hqemgate15.nvidia.com (using TLS: TLSv1.2, DES-CBC3-SHA) id ; Tue, 16 Jul 2019 17:15:48 -0700 Received: from hqmail.nvidia.com ([172.20.161.6]) by hqpgpgate102.nvidia.com (PGP Universal service); Tue, 16 Jul 2019 17:15:41 -0700 X-PGP-Universal: processed; by hqpgpgate102.nvidia.com on Tue, 16 Jul 2019 17:15:41 -0700 Received: from HQMAIL101.nvidia.com (172.20.187.10) by HQMAIL104.nvidia.com (172.18.146.11) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 17 Jul 2019 00:15:38 +0000 Received: from hqnvemgw01.nvidia.com (172.20.150.20) by HQMAIL101.nvidia.com (172.20.187.10) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Wed, 17 Jul 2019 00:15:38 +0000 Received: from rcampbell-dev.nvidia.com (Not Verified[10.110.48.66]) by hqnvemgw01.nvidia.com with Trustwave SEG (v7,5,8,10121) id ; Tue, 16 Jul 2019 17:15:38 -0700 From: Ralph Campbell To: CC: , Ralph Campbell , , Christoph Hellwig , Dan Williams , Andrew Morton , "Jason Gunthorpe" , Logan Gunthorpe , "Ira Weiny" , Matthew Wilcox , Mel Gorman , Jan Kara , "Kirill A. Shutemov" , Michal Hocko , "Andrea Arcangeli" , Mike Kravetz , =?utf-8?b?SsOpcsO0bWUgR2xpc3Nl?= Subject: [PATCH 2/3] mm/hmm: fix ZONE_DEVICE anon page mapping reuse Date: Tue, 16 Jul 2019 17:14:45 -0700 Message-ID: <20190717001446.12351-3-rcampbell@nvidia.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190717001446.12351-1-rcampbell@nvidia.com> References: <20190717001446.12351-1-rcampbell@nvidia.com> MIME-Version: 1.0 X-NVConfidentiality: public DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nvidia.com; s=n1; t=1563322548; bh=xvR8iX2outgELqejVmTcMhX9RlYLy+wU1js0WKyDum8=; h=X-PGP-Universal:From:To:CC:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:X-NVConfidentiality: Content-Type:Content-Transfer-Encoding; b=TRCk27TtRrVv4ByDmKeCrqvJNp6+08H/etGBrEm50CH2SOXfZYymRmojCkvp8tLa6 H24TZFPuMsdO5jijygFy328uG5wNmKsxJMZir8gAsUoeMTM1BKQGEV8NBWZSheafK/ 1S/5Im8uAHIvUgtRm1EwNzfrk7IV6HonA8TEYRmmBQ2vyc8BFuVHI6uvlLQaEQfw0v XMqf8AqOwJrQxQ9pw5ESS5F/4G13BCIKLFjGjLccKaQ2cKaJzvx7FfBQi37zgSgXYP Ci17HzuHtXsMwYZDJqiTmYa54GJSGJ9gco+U/XzjJcosLSDUgG8c6QBed9JHo23xEJ cUx2MNq/WejeQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP When a ZONE_DEVICE private page is freed, the page->mapping field can be set. If this page is reused as an anonymous page, the previous value can prevent the page from being inserted into the CPU's anon rmap table. For example, when migrating a pte_none() page to device memory: migrate_vma(ops, vma, start, end, src, dst, private) migrate_vma_collect() src[] = MIGRATE_PFN_MIGRATE migrate_vma_prepare() /* no page to lock or isolate so OK */ migrate_vma_unmap() /* no page to unmap so OK */ ops->alloc_and_copy() /* driver allocates ZONE_DEVICE page for dst[] */ migrate_vma_pages() migrate_vma_insert_page() page_add_new_anon_rmap() __page_set_anon_rmap() /* This check sees the page's stale mapping field */ if (PageAnon(page)) return /* page->mapping is not updated */ The result is that the migration appears to succeed but a subsequent CPU fault will be unable to migrate the page back to system memory or worse. Clear the page->mapping field when freeing the ZONE_DEVICE page so stale pointer data doesn't affect future page use. Fixes: b7a523109fb5c9d2d6dd ("mm: don't clear ->mapping in hmm_devmem_free") Cc: stable@vger.kernel.org Signed-off-by: Ralph Campbell Cc: Christoph Hellwig Cc: Dan Williams Cc: Andrew Morton Cc: Jason Gunthorpe Cc: Logan Gunthorpe Cc: Ira Weiny Cc: Matthew Wilcox Cc: Mel Gorman Cc: Jan Kara Cc: "Kirill A. Shutemov" Cc: Michal Hocko Cc: Andrea Arcangeli Cc: Mike Kravetz Cc: "Jérôme Glisse" --- kernel/memremap.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/memremap.c b/kernel/memremap.c index bea6f887adad..238ae5d0ae8a 100644 --- a/kernel/memremap.c +++ b/kernel/memremap.c @@ -408,6 +408,10 @@ void __put_devmap_managed_page(struct page *page) mem_cgroup_uncharge(page); + /* Clear anonymous page mapping to prevent stale pointers */ + if (is_device_private_page(page)) + page->mapping = NULL; + page->pgmap->ops->page_free(page); } else if (!count) __put_page(page);