Commit ad1ac596 authored by Miaohe Lin's avatar Miaohe Lin Committed by Andrew Morton
Browse files

mm/migration: fix potential pte_unmap on an not mapped pte 

__migration_entry_wait and migration_entry_wait_on_locked assume pte is
always mapped from caller.  But this is not the case when it's called from
migration_entry_wait_huge and follow_huge_pmd.  Add a hugetlbfs variant
that calls hugetlb_migration_entry_wait(ptep == NULL) to fix this issue.

Link: https://lkml.kernel.org/r/20220530113016.16663-5-linmiaohe@huawei.com


Fixes: 30dad309 ("mm: migration: add migrate_entry_wait_huge()")
Signed-off-by: default avatarMiaohe Lin <linmiaohe@huawei.com>
Suggested-by: default avatarDavid Hildenbrand <david@redhat.com>
Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Christoph Lameter <cl@linux.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Huang Ying <ying.huang@intel.com>
Cc: kernel test robot <lkp@intel.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Muchun Song <songmuchun@bytedance.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Peter Xu <peterx@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 7ce82f4c

include/linux/swapops.h

+8 −4
Original line number Diff line number Diff line
@@ -244,8 +244,10 @@ extern void __migration_entry_wait(struct mm_struct *mm, pte_t *ptep, 
					spinlock_t *ptl);

extern void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,

					unsigned long address);

extern void migration_entry_wait_huge(struct vm_area_struct *vma,

		struct mm_struct *mm, pte_t *pte);

#ifdef CONFIG_HUGETLB_PAGE

extern void __migration_entry_wait_huge(pte_t *ptep, spinlock_t *ptl);

extern void migration_entry_wait_huge(struct vm_area_struct *vma, pte_t *pte);

#endif

#else

static inline swp_entry_t make_readable_migration_entry(pgoff_t offset)

{
@@ -271,8 +273,10 @@ static inline void __migration_entry_wait(struct mm_struct *mm, pte_t *ptep, 
					spinlock_t *ptl) { }

static inline void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,

					 unsigned long address) { }

static inline void migration_entry_wait_huge(struct vm_area_struct *vma,

		struct mm_struct *mm, pte_t *pte) { }

#ifdef CONFIG_HUGETLB_PAGE

static inline void __migration_entry_wait_huge(pte_t *ptep, spinlock_t *ptl) { }

static inline void migration_entry_wait_huge(struct vm_area_struct *vma, pte_t *pte) { }

#endif

static inline int is_writable_migration_entry(swp_entry_t entry)

{

	return 0;

mm/hugetlb.c

+2 −2
Original line number Diff line number Diff line
@@ -5702,7 +5702,7 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, 
		 */

		entry = huge_ptep_get(ptep);

		if (unlikely(is_hugetlb_entry_migration(entry))) {

			migration_entry_wait_huge(vma, mm, ptep);

			migration_entry_wait_huge(vma, ptep);

			return 0;

		} else if (unlikely(is_hugetlb_entry_hwpoisoned(entry)))

			return VM_FAULT_HWPOISON_LARGE |
@@ -6927,7 +6927,7 @@ follow_huge_pmd(struct mm_struct *mm, unsigned long address, 
	} else {

		if (is_hugetlb_entry_migration(pte)) {

			spin_unlock(ptl);

			__migration_entry_wait(mm, (pte_t *)pmd, ptl);

			__migration_entry_wait_huge((pte_t *)pmd, ptl);

			goto retry;

		}

		/*

mm/migrate.c

+19 −4
Original line number Diff line number Diff line
@@ -315,12 +315,27 @@ void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd, 
	__migration_entry_wait(mm, ptep, ptl);

}



void migration_entry_wait_huge(struct vm_area_struct *vma,

		struct mm_struct *mm, pte_t *pte)

#ifdef CONFIG_HUGETLB_PAGE

void __migration_entry_wait_huge(pte_t *ptep, spinlock_t *ptl)

{

	pte_t pte;



	spin_lock(ptl);

	pte = huge_ptep_get(ptep);



	if (unlikely(!is_hugetlb_entry_migration(pte)))

		spin_unlock(ptl);

	else

		migration_entry_wait_on_locked(pte_to_swp_entry(pte), NULL, ptl);

}



void migration_entry_wait_huge(struct vm_area_struct *vma, pte_t *pte)

{

	spinlock_t *ptl = huge_pte_lockptr(hstate_vma(vma), mm, pte);

	__migration_entry_wait(mm, pte, ptl);

	spinlock_t *ptl = huge_pte_lockptr(hstate_vma(vma), vma->vm_mm, pte);



	__migration_entry_wait_huge(pte, ptl);

}

#endif



#ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION

void pmd_migration_entry_wait(struct mm_struct *mm, pmd_t *pmd)