From patchwork Thu Feb 20 07:52:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Huang, Ying" X-Patchwork-Id: 11393527 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 677BE14E3 for ; Thu, 20 Feb 2020 07:52:39 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 34F2424656 for ; Thu, 20 Feb 2020 07:52:39 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 34F2424656 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 770E56B0006; Thu, 20 Feb 2020 02:52:38 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 7215C6B0007; Thu, 20 Feb 2020 02:52:38 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 637326B0008; Thu, 20 Feb 2020 02:52:38 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0092.hostedemail.com [216.40.44.92]) by kanga.kvack.org (Postfix) with ESMTP id 4D7D26B0006 for ; Thu, 20 Feb 2020 02:52:38 -0500 (EST) Received: from smtpin22.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 0B8D18248047 for ; Thu, 20 Feb 2020 07:52:38 +0000 (UTC) X-FDA: 76509738396.22.net53_16f00bfac9c28 X-Spam-Summary: 1,0,0,,d41d8cd98f00b204,ying.huang@intel.com,:akpm@linux-foundation.org::linux-kernel@vger.kernel.org:ying.huang@intel.com:ziy@nvidia.com:kirill.shutemov@linux.intel.com:aarcange@redhat.com:mhocko@kernel.org:vbabka@suse.cz,RULES_HIT:30003:30054:30056:30064:30070:30090,0,RBL:134.134.136.20:@intel.com:.lbl8.mailshell.net-64.95.201.95 62.50.0.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:ft,MSBL:0,DNSBL:none,Custom_rules:0:0:0,LFtime:23,LUA_SUMMARY:none X-HE-Tag: net53_16f00bfac9c28 X-Filterd-Recvd-Size: 3215 Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by imf32.hostedemail.com (Postfix) with ESMTP for ; Thu, 20 Feb 2020 07:52:37 +0000 (UTC) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 Feb 2020 23:52:35 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,463,1574150400"; d="scan'208";a="349123453" Received: from yhuang-dev.sh.intel.com ([10.239.159.41]) by fmsmga001.fm.intel.com with ESMTP; 19 Feb 2020 23:52:33 -0800 From: "Huang, Ying" To: Andrew Morton Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Huang Ying , Zi Yan , "Kirill A . Shutemov" , Andrea Arcangeli , Michal Hocko , Vlastimil Babka Subject: [PATCH] mm: Fix possible PMD dirty bit lost in set_pmd_migration_entry() Date: Thu, 20 Feb 2020 15:52:20 +0800 Message-Id: <20200220075220.2327056-1-ying.huang@intel.com> X-Mailer: git-send-email 2.25.0 MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Huang Ying In set_pmd_migration_entry(), pmdp_invalidate() is used to change PMD atomically. But the PMD is read before that with an ordinary memory reading. If the THP (transparent huge page) is written between the PMD reading and pmdp_invalidate(), the PMD dirty bit may be lost, and cause data corruption. The race window is quite small, but still possible in theory, so need to be fixed. The race is fixed via using the return value of pmdp_invalidate() to get the original content of PMD, which is a read/modify/write atomic operation. So no THP writing can occur in between. The race has been introduced when the THP migration support is added in the commit 616b8371539a ("mm: thp: enable thp migration in generic path"). But this fix depends on the commit d52605d7cb30 ("mm: do not lose dirty and accessed bits in pmdp_invalidate()"). So it's easy to be backported after v4.16. But the race window is really small, so it may be fine not to backport the fix at all. Signed-off-by: "Huang, Ying" Cc: Zi Yan Cc: Kirill A. Shutemov Cc: Andrea Arcangeli Cc: Michal Hocko Cc: Vlastimil Babka Reviewed-by: William Kucharski Acked-by: Kirill A. Shutemov Reviewed-by: Zi Yan --- mm/huge_memory.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 580098e115bd..b1e069e68189 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -3060,8 +3060,7 @@ void set_pmd_migration_entry(struct page_vma_mapped_walk *pvmw, return; flush_cache_range(vma, address, address + HPAGE_PMD_SIZE); - pmdval = *pvmw->pmd; - pmdp_invalidate(vma, address, pvmw->pmd); + pmdval = pmdp_invalidate(vma, address, pvmw->pmd); if (pmd_dirty(pmdval)) set_page_dirty(page); entry = make_migration_entry(page, pmd_write(pmdval));