diff mbox series

[02/23] mm: Clear vmf->pte after pte_unmap_same() returns

Message ID 20210323004912.35132-3-peterx@redhat.com (mailing list archive)
State New, archived
Headers show
Series userfaultfd-wp: Support shmem and hugetlbfs | expand

Commit Message

Peter Xu March 23, 2021, 12:48 a.m. UTC
pte_unmap_same() will always unmap the pte pointer.  After the unmap, vmf->pte
will not be valid any more.  We should clear it.

It was safe only because no one is accessing vmf->pte after pte_unmap_same()
returns, since the only caller of pte_unmap_same() (so far) is do_swap_page(),
where vmf->pte will in most cases be overwritten very soon.

pte_unmap_same() will be used in other places in follow up patches, so that
vmf->pte will not always be re-written.  This patch enables us to call
functions like finish_fault() because that'll conditionally unmap the pte by
checking vmf->pte first.  Or, alloc_set_pte() will make sure to allocate a new
pte even after calling pte_unmap_same().

Since we'll need to modify vmf->pte, directly pass in vmf into pte_unmap_same()
and then we can also avoid the long parameter list.

Signed-off-by: Peter Xu <peterx@redhat.com>
---
 mm/memory.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

Comments

Miaohe Lin March 23, 2021, 2:34 a.m. UTC | #1
Hi:
On 2021/3/23 8:48, Peter Xu wrote:
> pte_unmap_same() will always unmap the pte pointer.  After the unmap, vmf->pte
> will not be valid any more.  We should clear it.
> 
> It was safe only because no one is accessing vmf->pte after pte_unmap_same()
> returns, since the only caller of pte_unmap_same() (so far) is do_swap_page(),
> where vmf->pte will in most cases be overwritten very soon.
> 
> pte_unmap_same() will be used in other places in follow up patches, so that
> vmf->pte will not always be re-written.  This patch enables us to call
> functions like finish_fault() because that'll conditionally unmap the pte by
> checking vmf->pte first.  Or, alloc_set_pte() will make sure to allocate a new
> pte even after calling pte_unmap_same().
> 
> Since we'll need to modify vmf->pte, directly pass in vmf into pte_unmap_same()
> and then we can also avoid the long parameter list.
> 
> Signed-off-by: Peter Xu <peterx@redhat.com>

Good cleanup! Thanks.
Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>

> ---
>  mm/memory.c | 13 +++++++------
>  1 file changed, 7 insertions(+), 6 deletions(-)
> 
> diff --git a/mm/memory.c b/mm/memory.c
> index a458a595331f..d534eba85756 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -2607,19 +2607,20 @@ EXPORT_SYMBOL_GPL(apply_to_existing_page_range);
>   * proceeding (but do_wp_page is only called after already making such a check;
>   * and do_anonymous_page can safely check later on).
>   */
> -static inline int pte_unmap_same(struct mm_struct *mm, pmd_t *pmd,
> -				pte_t *page_table, pte_t orig_pte)
> +static inline int pte_unmap_same(struct vm_fault *vmf)
>  {
>  	int same = 1;
>  #if defined(CONFIG_SMP) || defined(CONFIG_PREEMPTION)
>  	if (sizeof(pte_t) > sizeof(unsigned long)) {
> -		spinlock_t *ptl = pte_lockptr(mm, pmd);
> +		spinlock_t *ptl = pte_lockptr(vmf->vma->vm_mm, vmf->pmd);
>  		spin_lock(ptl);
> -		same = pte_same(*page_table, orig_pte);
> +		same = pte_same(*vmf->pte, vmf->orig_pte);
>  		spin_unlock(ptl);
>  	}
>  #endif
> -	pte_unmap(page_table);
> +	pte_unmap(vmf->pte);
> +	/* After unmap of pte, the pointer is invalid now - clear it. */
> +	vmf->pte = NULL;
>  	return same;
>  }
>  
> @@ -3308,7 +3309,7 @@ vm_fault_t do_swap_page(struct vm_fault *vmf)
>  	vm_fault_t ret = 0;
>  	void *shadow = NULL;
>  
> -	if (!pte_unmap_same(vma->vm_mm, vmf->pmd, vmf->pte, vmf->orig_pte))
> +	if (!pte_unmap_same(vmf))
>  		goto out;
>  
>  	entry = pte_to_swp_entry(vmf->orig_pte);
>
Peter Xu March 23, 2021, 3:40 p.m. UTC | #2
On Tue, Mar 23, 2021 at 10:34:45AM +0800, Miaohe Lin wrote:
> Hi:
> On 2021/3/23 8:48, Peter Xu wrote:
> > pte_unmap_same() will always unmap the pte pointer.  After the unmap, vmf->pte
> > will not be valid any more.  We should clear it.
> > 
> > It was safe only because no one is accessing vmf->pte after pte_unmap_same()
> > returns, since the only caller of pte_unmap_same() (so far) is do_swap_page(),
> > where vmf->pte will in most cases be overwritten very soon.
> > 
> > pte_unmap_same() will be used in other places in follow up patches, so that
> > vmf->pte will not always be re-written.  This patch enables us to call
> > functions like finish_fault() because that'll conditionally unmap the pte by
> > checking vmf->pte first.  Or, alloc_set_pte() will make sure to allocate a new
> > pte even after calling pte_unmap_same().
> > 
> > Since we'll need to modify vmf->pte, directly pass in vmf into pte_unmap_same()
> > and then we can also avoid the long parameter list.
> > 
> > Signed-off-by: Peter Xu <peterx@redhat.com>
> 
> Good cleanup! Thanks.
> Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>

Just a note that this is not a pure cleanup - the latter patches may start to
depend on the clearing of vmf->pte in their logic.

Thanks for the quick review!
diff mbox series

Patch

diff --git a/mm/memory.c b/mm/memory.c
index a458a595331f..d534eba85756 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2607,19 +2607,20 @@  EXPORT_SYMBOL_GPL(apply_to_existing_page_range);
  * proceeding (but do_wp_page is only called after already making such a check;
  * and do_anonymous_page can safely check later on).
  */
-static inline int pte_unmap_same(struct mm_struct *mm, pmd_t *pmd,
-				pte_t *page_table, pte_t orig_pte)
+static inline int pte_unmap_same(struct vm_fault *vmf)
 {
 	int same = 1;
 #if defined(CONFIG_SMP) || defined(CONFIG_PREEMPTION)
 	if (sizeof(pte_t) > sizeof(unsigned long)) {
-		spinlock_t *ptl = pte_lockptr(mm, pmd);
+		spinlock_t *ptl = pte_lockptr(vmf->vma->vm_mm, vmf->pmd);
 		spin_lock(ptl);
-		same = pte_same(*page_table, orig_pte);
+		same = pte_same(*vmf->pte, vmf->orig_pte);
 		spin_unlock(ptl);
 	}
 #endif
-	pte_unmap(page_table);
+	pte_unmap(vmf->pte);
+	/* After unmap of pte, the pointer is invalid now - clear it. */
+	vmf->pte = NULL;
 	return same;
 }
 
@@ -3308,7 +3309,7 @@  vm_fault_t do_swap_page(struct vm_fault *vmf)
 	vm_fault_t ret = 0;
 	void *shadow = NULL;
 
-	if (!pte_unmap_same(vma->vm_mm, vmf->pmd, vmf->pte, vmf->orig_pte))
+	if (!pte_unmap_same(vmf))
 		goto out;
 
 	entry = pte_to_swp_entry(vmf->orig_pte);