From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 43633C433F5 for ; Thu, 10 Feb 2022 19:51:04 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id BEFED6B0074; Thu, 10 Feb 2022 14:51:03 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id B9F406B0075; Thu, 10 Feb 2022 14:51:03 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A66C96B0078; Thu, 10 Feb 2022 14:51:03 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0221.hostedemail.com [216.40.44.221]) by kanga.kvack.org (Postfix) with ESMTP id 957216B0074 for ; Thu, 10 Feb 2022 14:51:03 -0500 (EST) Received: from smtpin06.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 5F4B8181AC9C6 for ; Thu, 10 Feb 2022 19:51:03 +0000 (UTC) X-FDA: 79127913606.06.0D67CA4 Received: from mail-vs1-f52.google.com (mail-vs1-f52.google.com [209.85.217.52]) by imf03.hostedemail.com (Postfix) with ESMTP id 0020C20006 for ; Thu, 10 Feb 2022 19:51:02 +0000 (UTC) Received: by mail-vs1-f52.google.com with SMTP id m24so7718369vsp.7 for ; Thu, 10 Feb 2022 11:51:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=IeEOn6XSFgtVrtd3RDza6sziW2YEC3TzRY0Hs4BmRek=; b=G8oDPDd9A4jW4Q4xSKnTuWQhqYNS/SqUUMFYjq+ljM2XcLuQlqcqxFxwIOHTGIaNbI rYblpzXvqK3G71u3OIeD2jEz19TFAfMo75oif+ewV2lLS7KTzT/CltJXnQwQ2jIweR7c vwgQ8EikOHbNzD+jXgYpo5LqzdmTjHu5Gb81I9ewx79ChLtk9ZbJeMGtOWoLibVKXkdl OfpyAr8ziHbnrkb2K5ZP0HAsLQKarB2xEU32ir6HsOvo3mrkN6B1phVBXHy/pzImnpbH v2vbjgvf6u+rBUuzrWFuo39Cg2qYKmjzNElU6bDOueEVUL5Xf+lj+5nr952yBsdYJ0/v GRsQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=IeEOn6XSFgtVrtd3RDza6sziW2YEC3TzRY0Hs4BmRek=; b=HQCppp+vSV9XWFlMz90GFJlluoB8SYEoxx59kUahHtmISnrYm1lwOlmueaAAj3aOjQ Coa/JgaU0jCGJeAB7HFfnZBqQb4xsR82SPK+oe0rMQg+GyCQQ/nQRdJCgCyBUGFxn5yr T9PYgwF6p9W6w30fG4YzlbbzIebLGooZdjL5ix5BZInXOficpTW3NC6zvKldv68Vp077 p2R8N8NaKbtIAFm7FeUPWPSmHsYrp51CDbgbtYPieHWE1IbGFyoPLH8CIejt7Q9HiIZE uOeCh36xeKY74SIPXutn6oxQRu79zZSrNr7KGqSuPKakQEuB0Vz74AiROtfWr0qdx89U vNzg== X-Gm-Message-State: AOAM531W6C/HesN7pPIzArH6+ViZnVD7iZ+VnyX/x9Y5Wi1w17b08lBd 6uSAG31CGNAui5l2xMyv5CxLRu7jvo1PxYQIWjQBIQ== X-Google-Smtp-Source: ABdhPJx+IQDZQEvCNhhOaaQiKVuZiSUq4eBuQnwX8a8KZ1d9DltfIP6BlrfXPi3XlZYeUR+CDDjgh022kc5HrMsfU/g= X-Received: by 2002:a67:f890:: with SMTP id h16mr3519275vso.43.1644522662142; Thu, 10 Feb 2022 11:51:02 -0800 (PST) MIME-Version: 1.0 References: <20220210073111.61199-1-aneesh.kumar@linux.ibm.com> In-Reply-To: From: Mina Almasry Date: Thu, 10 Feb 2022 11:50:50 -0800 Message-ID: Subject: Re: [PATCH] mm/hugetlb: Fix kernel crash with hugetlb mremap To: Mike Kravetz Cc: "Aneesh Kumar K.V" , linux-mm@kvack.org, akpm@linux-foundation.org Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 0020C20006 X-Stat-Signature: oijh39hmuu9k89x67pru4rsikiq4nweu Authentication-Results: imf03.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=G8oDPDd9; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf03.hostedemail.com: domain of almasrymina@google.com designates 209.85.217.52 as permitted sender) smtp.mailfrom=almasrymina@google.com X-Rspamd-Server: rspam06 X-Rspam-User: X-HE-Tag: 1644522662-14042 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Feb 10, 2022 at 11:42 AM Mike Kravetz wrote: > > On 2/9/22 23:31, Aneesh Kumar K.V wrote: > > This fixes the below crash: > > > > kernel BUG at include/linux/mm.h:2373! > > cpu 0x5d: Vector: 700 (Program Check) at [c00000003c6e76e0] > > pc: c000000000581a54: pmd_to_page+0x54/0x80 > > lr: c00000000058d184: move_hugetlb_page_tables+0x4e4/0x5b0 > > sp: c00000003c6e7980 > > msr: 9000000000029033 > > current = 0xc00000003bd8d980 > > paca = 0xc000200fff610100 irqmask: 0x03 irq_happened: 0x01 > > pid = 9349, comm = hugepage-mremap > > kernel BUG at include/linux/mm.h:2373! > > [link register ] c00000000058d184 move_hugetlb_page_tables+0x4e4/0x5b0 > > [c00000003c6e7980] c00000000058cecc move_hugetlb_page_tables+0x22c/0x5b0 (unreliable) > > [c00000003c6e7a90] c00000000053b78c move_page_tables+0xdbc/0x1010 > > [c00000003c6e7bd0] c00000000053bc34 move_vma+0x254/0x5f0 > > [c00000003c6e7c90] c00000000053c790 sys_mremap+0x7c0/0x900 > > [c00000003c6e7db0] c00000000002c450 system_call_exception+0x160/0x2c0 > > > > the kernel can't use huge_pte_offset before it set the pte entry because a page table > > lookup check for huge PTE bit in the page table to differentiate between a > > huge pte entry and a pointer to pte page. A huge_pte_alloc won't mark the > > page table entry huge and hence kernel should not use huge_pte_offset after > > a huge_pte_alloc. > > Thanks Aneesh! > > Architectures that use the default version of huge_pte_offset (like X86) > 'got away' with this because of the default return: > > pmd = pmd_offset(pud, addr); > /* must be pmd huge, non-present or none */ > return (pte_t *)pmd; > > > > > Cc: Mina Almasry > > Cc: Mike Kravetz > > Signed-off-by: Aneesh Kumar K.V Thanks Aneesh! Reviewed-by: Mina Almasry > > Should we add a Fixes: tag and cc stable? > Yes please if possible. > > --- > > mm/hugetlb.c | 7 +++---- > > 1 file changed, 3 insertions(+), 4 deletions(-) > > Reviewed-by: Mike Kravetz > -- > Mike Kravetz > > > > > diff --git a/mm/hugetlb.c b/mm/hugetlb.c > > index 61895cc01d09..e57650a9404f 100644 > > --- a/mm/hugetlb.c > > +++ b/mm/hugetlb.c > > @@ -4851,14 +4851,13 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, > > } > > > > static void move_huge_pte(struct vm_area_struct *vma, unsigned long old_addr, > > - unsigned long new_addr, pte_t *src_pte) > > + unsigned long new_addr, pte_t *src_pte, pte_t *dst_pte) > > { > > struct hstate *h = hstate_vma(vma); > > struct mm_struct *mm = vma->vm_mm; > > - pte_t *dst_pte, pte; > > spinlock_t *src_ptl, *dst_ptl; > > + pte_t pte; > > > > - dst_pte = huge_pte_offset(mm, new_addr, huge_page_size(h)); > > dst_ptl = huge_pte_lock(h, mm, dst_pte); > > src_ptl = huge_pte_lockptr(h, mm, src_pte); > > > > @@ -4917,7 +4916,7 @@ int move_hugetlb_page_tables(struct vm_area_struct *vma, > > if (!dst_pte) > > break; > > > > - move_huge_pte(vma, old_addr, new_addr, src_pte); > > + move_huge_pte(vma, old_addr, new_addr, src_pte, dst_pte); > > } > > flush_tlb_range(vma, old_end - len, old_end); > > mmu_notifier_invalidate_range_end(&range); >