From patchwork Tue Oct 17 11:15:17 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Will Deacon X-Patchwork-Id: 116072 Delivered-To: patch@linaro.org Received: by 10.140.22.163 with SMTP id 32csp4755055qgn; Tue, 17 Oct 2017 04:15:15 -0700 (PDT) X-Google-Smtp-Source: AOwi7QAhvqzeBSkK1e2avSzw5O6UjExPcDCY7grkcTcysr9FS48cW/y3KspqzpPJOlDjgSJPdTTW X-Received: by 10.159.194.6 with SMTP id x6mr11854910pln.359.1508238915209; Tue, 17 Oct 2017 04:15:15 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1508238915; cv=none; d=google.com; s=arc-20160816; b=q6VtcL4YchDiUQulKHFS6YeMn8m/mzLOkB0NMIjDhY5KpC/rpqowlMmY/cYWHs4FWu i+1USADj5GQP6Nz+N4ROAIaFSXDee7EtQfhyB3CcAFiT3pubpyF6wRnGw39XPS3Ue7JS MAUABFIg0FMNfScJCHDTYouGfiltHu6uRFtS+OoTrXTL05Bdog0cI6ydwojdp0dkBw9l LDnP9QiOdeV6+prVklrI92FdnFdYkJZ3+xI/aVEfPDIhTRe+CeRzouT3zEAN3+OKrHfN 36QkM7pTLsvrAn2kUl9Vi1w+IRJDy8VO7l9A8h7m9CHyJjPDFPQHnRr6sagrnji29X2s cRNw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:subject:cc:to:from :arc-authentication-results; bh=AzHi7H93VdjjQ2202W3IGwk781EksDDGXkW/9yyqgvg=; b=oVcxKG/0Dvtp8qf9CtMTtT6Db6cZz34oVL2xIDHzsz6Kwt/FjidT7dFnxrkkob4oig mo8N+YG6santcgv17sR7b4UdBRspNr1s1i7Ka1XDhc7e4nGl7EHIUOAYDLpqVfl71m4i vgJPM756APDvwre5RW2fbn0tecTgF7USvcuYxxAIS4QjtNnSXs2/LAFynx3NmCjwtHie nXehfqKn9moRA4nnEYYkVy33clevQk3KUSZ+I0p+bQUUza+G7F14X4Z9sTqrQFv6HpBw st5QG3NMJRvahb4YzGKoBN5SYs5dm/FL85HeF8/n0GoGskT6s4a8dd9NoF9upjR4z2FS 5dfw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id k6si848013pla.710.2017.10.17.04.15.14; Tue, 17 Oct 2017 04:15:15 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755878AbdJQLPO (ORCPT + 9 others); Tue, 17 Oct 2017 07:15:14 -0400 Received: from foss.arm.com ([217.140.101.70]:43868 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755586AbdJQLPN (ORCPT ); Tue, 17 Oct 2017 07:15:13 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 49E3E1529; Tue, 17 Oct 2017 04:15:13 -0700 (PDT) Received: from edgewater-inn.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 1ADAC3F483; Tue, 17 Oct 2017 04:15:13 -0700 (PDT) Received: by edgewater-inn.cambridge.arm.com (Postfix, from userid 1000) id 642AA1AE2F39; Tue, 17 Oct 2017 12:15:18 +0100 (BST) From: Will Deacon To: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Will Deacon Subject: [PATCH] mm: page_vma_mapped: ensure pmd is loaded with READ_ONCE outside of lock Date: Tue, 17 Oct 2017 12:15:17 +0100 Message-Id: <1508238917-14553-1-git-send-email-will.deacon@arm.com> X-Mailer: git-send-email 2.1.4 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org [Commit a7b100953aa33a5bbdc3e5e7f2241b9c0704606e upstream] Loading the pmd without holding the pmd_lock exposes us to races with concurrent updaters of the page tables but, worse still, it also allows the compiler to cache the pmd value in a register and reuse it later on, even if we've performed a READ_ONCE in between and seen a more recent value. In the case of page_vma_mapped_walk, this leads to the following crash when the pmd loaded for the initial pmd_trans_huge check is all zeroes and a subsequent valid table entry is loaded by check_pmd. We then proceed into map_pte, but the compiler re-uses the zero entry inside pte_offset_map, resulting in a junk pointer being installed in pvmw->pte: PC is at check_pte+0x20/0x170 LR is at page_vma_mapped_walk+0x2e0/0x540 [...] Process doio (pid: 2463, stack limit = 0xffff00000f2e8000) Call trace: check_pte+0x20/0x170 page_vma_mapped_walk+0x2e0/0x540 page_mkclean_one+0xac/0x278 rmap_walk_file+0xf0/0x238 rmap_walk+0x64/0xa0 page_mkclean+0x90/0xa8 clear_page_dirty_for_io+0x84/0x2a8 mpage_submit_page+0x34/0x98 mpage_process_page_bufs+0x164/0x170 mpage_prepare_extent_to_map+0x134/0x2b8 ext4_writepages+0x484/0xe30 do_writepages+0x44/0xe8 __filemap_fdatawrite_range+0xbc/0x110 file_write_and_wait_range+0x48/0xd8 ext4_sync_file+0x80/0x4b8 vfs_fsync_range+0x64/0xc0 SyS_msync+0x194/0x1e8 This patch fixes the problem by ensuring that READ_ONCE is used before the initial checks on the pmd, and this value is subsequently used when checking whether or not the pmd is present. pmd_check is removed and the pmd_present check is inlined directly. Link: http://lkml.kernel.org/r/1507222630-5839-1-git-send-email-will.deacon@arm.com Fixes: f27176cfc363 ("mm: convert page_mkclean_one() to use page_vma_mapped_walk()") Cc: # 4.13 [will: backport to 4.13.y] Signed-off-by: Will Deacon --- mm/page_vma_mapped.c | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-) -- 2.1.4 diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c index 8ec6ba230bb9..6b9311631aa1 100644 --- a/mm/page_vma_mapped.c +++ b/mm/page_vma_mapped.c @@ -6,17 +6,6 @@ #include "internal.h" -static inline bool check_pmd(struct page_vma_mapped_walk *pvmw) -{ - pmd_t pmde; - /* - * Make sure we don't re-load pmd between present and !trans_huge check. - * We need a consistent view. - */ - pmde = READ_ONCE(*pvmw->pmd); - return pmd_present(pmde) && !pmd_trans_huge(pmde); -} - static inline bool not_found(struct page_vma_mapped_walk *pvmw) { page_vma_mapped_walk_done(pvmw); @@ -106,6 +95,7 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw) pgd_t *pgd; p4d_t *p4d; pud_t *pud; + pmd_t pmde; /* The only possible pmd mapping has been handled on last iteration */ if (pvmw->pmd && !pvmw->pte) @@ -138,7 +128,13 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw) if (!pud_present(*pud)) return false; pvmw->pmd = pmd_offset(pud, pvmw->address); - if (pmd_trans_huge(*pvmw->pmd)) { + /* + * Make sure the pmd value isn't cached in a register by the + * compiler and used as a stale value after we've observed a + * subsequent update. + */ + pmde = READ_ONCE(*pvmw->pmd); + if (pmd_trans_huge(pmde)) { pvmw->ptl = pmd_lock(mm, pvmw->pmd); if (!pmd_present(*pvmw->pmd)) return not_found(pvmw); @@ -153,9 +149,8 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw) spin_unlock(pvmw->ptl); pvmw->ptl = NULL; } - } else { - if (!check_pmd(pvmw)) - return false; + } else if (!pmd_present(pmde)) { + return false; } if (!map_pte(pvmw)) goto next_pte;