Stable Archive on
 help / color / Atom feed
* [patch 02/18] mm/hmm: fix ZONE_DEVICE anon page mapping reuse
@ 2019-08-13 22:37 akpm
  0 siblings, 0 replies; only message in thread
From: akpm @ 2019-08-13 22:37 UTC (permalink / raw)
  To: willy, vbabka, stable, schwidefsky, rdunlap, penberg,
	mike.kravetz, mhocko, mgorman, logang, kirill.shutemov,
	jiangshanlai, jhubbard, jglisse, jgg, jack, ira.weiny, hch,
	dave.hansen, dan.j.williams, cl, aryabinin, aarcange, rcampbell,
	akpm, mm-commits, torvalds

From: Ralph Campbell <>
Subject: mm/hmm: fix ZONE_DEVICE anon page mapping reuse

When a ZONE_DEVICE private page is freed, the page->mapping field can be
set.  If this page is reused as an anonymous page, the previous value can
prevent the page from being inserted into the CPU's anon rmap table.  For
example, when migrating a pte_none() page to device memory:

  migrate_vma(ops, vma, start, end, src, dst, private)
      /* no page to lock or isolate so OK */
      /* no page to unmap so OK */
      /* driver allocates ZONE_DEVICE page for dst[] */
            /* This check sees the page's stale mapping field */
            if (PageAnon(page))
            /* page->mapping is not updated */

The result is that the migration appears to succeed but a subsequent CPU
fault will be unable to migrate the page back to system memory or worse.

Clear the page->mapping field when freeing the ZONE_DEVICE page so stale
pointer data doesn't affect future page use.

Fixes: b7a523109fb5c9d2d6dd ("mm: don't clear ->mapping in hmm_devmem_free")
Signed-off-by: Ralph Campbell <>
Reviewed-by: John Hubbard <>
Reviewed-by: Christoph Hellwig <>
Cc: Dan Williams <>
Cc: Jason Gunthorpe <>
Cc: Logan Gunthorpe <>
Cc: Ira Weiny <>
Cc: Matthew Wilcox <>
Cc: Mel Gorman <>
Cc: Jan Kara <>
Cc: "Kirill A. Shutemov" <>
Cc: Michal Hocko <>
Cc: Andrea Arcangeli <>
Cc: Mike Kravetz <>
Cc: "Jérôme Glisse" <>
Cc: Andrey Ryabinin <>
Cc: Christoph Lameter <>
Cc: Dave Hansen <>
Cc: Lai Jiangshan <>
Cc: Martin Schwidefsky <>
Cc: Pekka Enberg <>
Cc: Randy Dunlap <>
Cc: Vlastimil Babka <>
Cc: <>
Signed-off-by: Andrew Morton <>

 mm/memremap.c |   24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

--- a/mm/memremap.c~mm-hmm-fix-zone_device-anon-page-mapping-reuse
+++ a/mm/memremap.c
@@ -403,6 +403,30 @@ void __put_devmap_managed_page(struct pa
+		/*
+		 * When a device_private page is freed, the page->mapping field
+		 * may still contain a (stale) mapping value. For example, the
+		 * lower bits of page->mapping may still identify the page as
+		 * an anonymous page. Ultimately, this entire field is just
+		 * stale and wrong, and it will cause errors if not cleared.
+		 * One example is:
+		 *
+		 *  migrate_vma_pages()
+		 *    migrate_vma_insert_page()
+		 *      page_add_new_anon_rmap()
+		 *        __page_set_anon_rmap()
+		 *          ...checks page->mapping, via PageAnon(page) call,
+		 *            and incorrectly concludes that the page is an
+		 *            anonymous page. Therefore, it incorrectly,
+		 *            silently fails to set up the new anon rmap.
+		 *
+		 * For other types of ZONE_DEVICE pages, migration is either
+		 * handled differently or not done at all, so there is no need
+		 * to clear page->mapping.
+		 */
+		if (is_device_private_page(page))
+			page->mapping = NULL;
 	} else if (!count)

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-13 22:37 [patch 02/18] mm/hmm: fix ZONE_DEVICE anon page mapping reuse akpm

Stable Archive on

Archives are clonable:
	git clone --mirror stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ \
	public-inbox-index stable

Newsgroup available over NNTP:

AGPL code for this site: git clone public-inbox