From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id B61DBC25B74 for ; Fri, 24 May 2024 03:41:03 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 4C37F6B00A3; Thu, 23 May 2024 23:41:03 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 4745A6B00A4; Thu, 23 May 2024 23:41:03 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 363676B00A5; Thu, 23 May 2024 23:41:03 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 186896B00A3 for ; Thu, 23 May 2024 23:41:03 -0400 (EDT) Received: from smtpin18.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id AB47AC07F2 for ; Fri, 24 May 2024 03:41:02 +0000 (UTC) X-FDA: 82151888364.18.A295A51 Received: from out30-130.freemail.mail.aliyun.com (out30-130.freemail.mail.aliyun.com [115.124.30.130]) by imf05.hostedemail.com (Postfix) with ESMTP id 8FAE0100006 for ; Fri, 24 May 2024 03:40:59 +0000 (UTC) Authentication-Results: imf05.hostedemail.com; dkim=pass header.d=linux.alibaba.com header.s=default header.b=RaYF9tzj; dmarc=pass (policy=none) header.from=linux.alibaba.com; spf=pass (imf05.hostedemail.com: domain of baolin.wang@linux.alibaba.com designates 115.124.30.130 as permitted sender) smtp.mailfrom=baolin.wang@linux.alibaba.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1716522061; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=6/UZ2+cAO5LwgqyUyoJz3cM9YsqKmDTGWP10HkryRFU=; b=7Da4c55TqS1O7zHpSuojvrmKKWQhPsWCb7Yvi//R3m1CsbD8GMhvtFfZe4OLwodP+LlP9m yj+64wEVh/EbdsZEeq1u0NjoZTpxHHFqwoMzO2nc8+1zLZe3pta1B5uYzQiOcp6tUEtGo/ 1AZPXbcPZiN1CUyBS5UU0sT8fsrL3ks= ARC-Authentication-Results: i=1; imf05.hostedemail.com; dkim=pass header.d=linux.alibaba.com header.s=default header.b=RaYF9tzj; dmarc=pass (policy=none) header.from=linux.alibaba.com; spf=pass (imf05.hostedemail.com: domain of baolin.wang@linux.alibaba.com designates 115.124.30.130 as permitted sender) smtp.mailfrom=baolin.wang@linux.alibaba.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1716522061; a=rsa-sha256; cv=none; b=sx1dmmLeksVawYVy/l8k8ko0T2YI3oJCYOrBbov8k6LVaMEbz8xPqYQe5IjdiIkFCsmBVw Q8ShjQ8wQa/Y4n99Mnv/YN/k1NZ5Vica+3jJJPCHaqU8hxfHLUYDeBIbVRdg0w4p9HjugK WiGDiSYnBo9fQMqxYXg2EshSoN/wMww= DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1716522056; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=6/UZ2+cAO5LwgqyUyoJz3cM9YsqKmDTGWP10HkryRFU=; b=RaYF9tzjO4JLDOkYJ4Ba2PPkv7sng9z4VIxMH0e/FjfDEJFK19/7jKLoXpTFHF13vK+5duNCsDra+odUVNo1TWvneR9GJWKXJXM9gtCXWUwrWh4faL5eD2n0mrmccPQxuE2IByV32y6IbNDJ0DadQxDtdPRLrjlKJ7u8VEm70pI= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R411e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033045075189;MF=baolin.wang@linux.alibaba.com;NM=1;PH=DS;RN=20;SR=0;TI=SMTPD_---0W74cpp8_1716522053; Received: from 30.97.56.65(mailfrom:baolin.wang@linux.alibaba.com fp:SMTPD_---0W74cpp8_1716522053) by smtp.aliyun-inc.com; Fri, 24 May 2024 11:40:55 +0800 Message-ID: <0ae77b66-c919-4dfe-9b3c-741b52643257@linux.alibaba.com> Date: Fri, 24 May 2024 11:40:53 +0800 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] mm: arm64: Fix the out-of-bounds issue in contpte_clear_young_dirty_ptes To: Barry Song <21cnbao@gmail.com>, akpm@linux-foundation.org, linux-mm@kvack.org Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Barry Song , Lance Yang , Ryan Roberts , David Hildenbrand , Jeff Xie , Kefeng Wang , Michal Hocko , Minchan Kim , Muchun Song , Peter Xu , Yang Shi , Yin Fengwei , Zach O'Keefe , Catalin Marinas , Will Deacon References: <20240524005444.135417-1-21cnbao@gmail.com> From: Baolin Wang In-Reply-To: <20240524005444.135417-1-21cnbao@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Rspam-User: X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: 8FAE0100006 X-Stat-Signature: 9h7i3a359yowd18m3dz39iqdee461mc3 X-HE-Tag: 1716522059-444771 X-HE-Meta: U2FsdGVkX1/5zUF6oajyEQhckPFwMzcn+Da5q0Gs6sWT+p2t1w4kiIo5H2ylR0zu1ol5h/hNYvd2LjFuIHeSHKRZwYOoraGZ+kkeiZ227jncLrmYo291yqM50k4XjrbwIgTxSuw9I9oUzUmEQJVFCEPJN9ooea07U533m9NHDubMEp+dL1zgIOKIf7cRAHqbF1E/W6yvpMCVQVMQkLjQIGc1niCU/VoQYvh3cXLYitOsrOyRvqAuwziUbNZd4eTaWAuWB8wbIw+aPQ0X/v/RFV4jmKF6W+vOMGo59RTWVDC9MRxEwyKEuv00t1IG0d5qxKY/sWsq+7qP6ImYcTEXMJ2lRejE+VQjQVthQ5YZOtdiQcr6cQCfJzOHtoRbS4K1bc9mRTM3f6CDAu/DJRSdDLU57ztfBKMGc4CyjBdmmC/67rsX8CXISGZuyvvOVtorBW/wg4F+EB5PAlTmWpgyuSEhQBHpNHZbbXTC0igla7B33WOqxWA2QLOxPacjPc8P3r+z78M0XZzbyP1TeOWwMVEorB7ktBO/m3tClfZ0At7uo+6HfKL5Ef1xiZbQN+mDEPp0yNeFT1O6MTKOw5eA/Pk71WNWDpITWI0ZAn2jJUwwu94KRL2+iD2i57F1gx6fIFUFd5/Zk/PR+w+oPOJfz7fSmjFTkXhs449I8g0dPpxQslKjTFymHA/OBopeAaZbgOd4Q/ExpNe7W7xp5vWAgxTiRbMxXCTa/v7HdmjVpqU7Ri4IIIwyOmApB4a4sE5qAIfaAKFhoq4XjQnqFR72WoRyUyRXB1I1KWwG+upsZpvJQE9foDur3QXh6ATOno59hGrqiM4LuKYRGt9ZJHqTaL/1j/Z3n+IEEwf3fp2GSki/65Ju0wO+xPyM1Pnpcihd/ceZOyFw2tUSZzvg8D6sJAPDWqLgx6e9fjpgMZpHDQznTE4BJpP8w5y6VP9UWda65TfSasGVO7J+vsAEBuw t77DT1z7 gtdObQ2XxO7lGnXKgHe7o3tElqmH4zvVV20YRf2psVxJb7Xx+9lQk8RPg+WQ1vS0uqLl2VzBjPztJMYSEKgCglk2AXLY6t0hzS+S3p37/DAWlc4FoLfb3tTq1isBBm4LwF+t3JBcwMFAbgpU/u4pokoXQ5euoFQGAe+OhlIauktl72p8/W9JQJsowgBLpWcGHp/Ryf9AKBwCvpBtKnm76JpPmIECt/WuZJ/A5I0nS+sm7Y8FJo3NU001BOICdIX04mYR2Zpqr3kPc64/T7Ag1/LAT4sHxatdHx8Ypz4dXa6Xt0xPrr1BldORNR0txFhRiOb9qNOyCItGYxSvgw5vcRhiKZD9eN6YJpgev/xjI2ZyR7yAwW9pHeXl4CAccaJlXYc8NvCO0OXEIxBtl/IIE4LLSSSq0Xe/Du7QmyXu3AP01BR6BsHwHD1Ggo5OpbgBtPT4QNnKJZhDkfGIgJjORpLJR4WAbR4/bdxIDcrfeuMWe4e1h1xbd7gRyGuFsEAVYyvTsmiKJTZqFIvaU5cy9nssUMsHXaqnAVdrXOhnrA3COrZeAPm6lFE/mPBln9h0V/O8n8suNpRtlq8ozZNRlReqf94gzvz31P2/RjxG4hVM9uGcXvOpbFg5icA3gBY334D8JpyaBG14khey9+u4KWlUqQLHBrC+MLv/pXpg4Urx9S0qZa0OlawcL75DhXbDHQUtIwHuCrvEBmp1mw6idxtI49yMRMuzYsQXuo6TkMfLSpl/8+rDJQBj3GKtrjkAvvtmT2gd2tQUUfmNowX7mUcXgpw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 2024/5/24 08:54, Barry Song wrote: > From: Barry Song > > We are passing a huge nr to __clear_young_dirty_ptes() right > now. While we should pass the number of pages, we are actually > passing CONT_PTE_SIZE. This is causing lots of crashes of > MADV_FREE, panic oops could vary everytime. > > Fixes: 89e86854fb0a ("mm/arm64: override clear_young_dirty_ptes() batch helper") > Cc: Lance Yang > Cc: Barry Song <21cnbao@gmail.com> > Cc: Ryan Roberts > Cc: David Hildenbrand > Cc: Jeff Xie > Cc: Kefeng Wang > Cc: Michal Hocko > Cc: Minchan Kim > Cc: Muchun Song > Cc: Peter Xu > Cc: Yang Shi > Cc: Yin Fengwei > Cc: Zach O'Keefe > Cc: Catalin Marinas > Cc: Will Deacon > Signed-off-by: Barry Song Good catch. Feel free to add: Reviewed-by: Baolin Wang > --- > arch/arm64/mm/contpte.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/arch/arm64/mm/contpte.c b/arch/arm64/mm/contpte.c > index 9f9486de0004..a3edced29ac1 100644 > --- a/arch/arm64/mm/contpte.c > +++ b/arch/arm64/mm/contpte.c > @@ -376,7 +376,7 @@ void contpte_clear_young_dirty_ptes(struct vm_area_struct *vma, > * clearing access/dirty for the whole block. > */ > unsigned long start = addr; > - unsigned long end = start + nr; > + unsigned long end = start + nr * PAGE_SIZE; > > if (pte_cont(__ptep_get(ptep + nr - 1))) > end = ALIGN(end, CONT_PTE_SIZE); > @@ -386,7 +386,7 @@ void contpte_clear_young_dirty_ptes(struct vm_area_struct *vma, > ptep = contpte_align_down(ptep); > } > > - __clear_young_dirty_ptes(vma, start, ptep, end - start, flags); > + __clear_young_dirty_ptes(vma, start, ptep, (end - start) / PAGE_SIZE, flags); > } > EXPORT_SYMBOL_GPL(contpte_clear_young_dirty_ptes); >