Ryan Roberts be0ce3f6ff mm: fix race between __split_huge_pmd_locked() and GUP-fast ... commit 3a5a8d343e upstream. __split_huge_pmd_locked() can be called for a present THP, devmap or (non-present) migration entry. It calls pmdp_invalidate() unconditionally on the pmdp and only determines if it is present or not based on the returned old pmd. This is a problem for the migration entry case because pmd_mkinvalid(), called by pmdp_invalidate() must only be called for a present pmd. On arm64 at least, pmd_mkinvalid() will mark the pmd such that any future call to pmd_present() will return true. And therefore any lockless pgtable walker could see the migration entry pmd in this state and start interpretting the fields as if it were present, leading to BadThings (TM). GUP-fast appears to be one such lockless pgtable walker. x86 does not suffer the above problem, but instead pmd_mkinvalid() will corrupt the offset field of the swap entry within the swap pte. See link below for discussion of that problem. Fix all of this by only calling pmdp_invalidate() for a present pmd. And for good measure let's add a warning to all implementations of pmdp_invalidate[_ad](). I've manually reviewed all other pmdp_invalidate[_ad]() call sites and believe all others to be conformant. This is a theoretical bug found during code review. I don't have any test case to trigger it in practice. Link: https://lkml.kernel.org/r/20240501143310.1381675-1-ryan.roberts@arm.com Link: https://lore.kernel.org/all/0dd7827a-6334-439a-8fd0-43c98e6af22b@arm.com/ Fixes: 84c3fc4e9c ("mm: thp: check pmd migration entry in common path") Signed-off-by: Ryan Roberts <ryan.roberts@arm.com> Reviewed-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Acked-by: David Hildenbrand <david@redhat.com> Cc: Andreas Larsson <andreas@gaisler.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Aneesh Kumar K.V <aneesh.kumar@kernel.org> Cc: Borislav Petkov (AMD) <bp@alien8.de> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Christian Borntraeger <borntraeger@linux.ibm.com> Cc: Christophe Leroy <christophe.leroy@csgroup.eu> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: Ingo Molnar <mingo@redhat.com> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Naveen N. Rao <naveen.n.rao@linux.ibm.com> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Sven Schnelle <svens@linux.ibm.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Will Deacon <will@kernel.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-06-16 13:47:40 +02:00
..
fault_32.c	sparc32: fix lock_mm_and_find_vma() conversion	2023-06-29 20:41:24 -07:00
fault_64.c	Merge branch 'expand-stack'	2023-06-28 20:35:21 -07:00
hugetlbpage.c	mm: hugetlb: add huge page size param to set_huge_pte_at()	2023-09-29 17:20:47 -07:00
hypersparc.S
init_32.c	sparc32: implement the new page table range API	2023-08-24 16:20:23 -07:00
init_64.c	mm/treewide: replace pud_large() with pud_leaf()	2024-04-10 16:35:46 +02:00
init_64.h
io-unit.c	sparc: Explicitly include correct DT includes	2023-08-28 13:30:57 -05:00
iommu.c	sparc: Explicitly include correct DT includes	2023-08-28 13:30:57 -05:00
leon_mm.c
Makefile	sparc32: switch to generic extables	2021-01-03 20:05:18 -05:00
mm_32.h	sparc32: kill lookup_fault()	2021-01-03 20:05:14 -05:00
srmmu.c	sparc: convert pgtable_pte_page_{ctor, dtor}() to ptdesc equivalents	2023-08-21 13:37:58 -07:00
srmmu_access.S
swift.S
tlb.c	mm: fix race between __split_huge_pmd_locked() and GUP-fast	2024-06-16 13:47:40 +02:00
tsb.c	mm, treewide: redefine MAX_ORDER sanely	2023-04-05 19:42:46 -07:00
tsunami.S
ultra.S	mm: reorder includes after introduction of linux/pgtable.h	2020-06-09 09:39:13 -07:00
viking.S