[PATCH] mm/madvise: fix potential pte_unmap_unlock pte error

[PATCH] mm/madvise: fix potential pte_unmap_unlock pte error

[Miaohe Lin]

We can't assume pte_offset_map_lock will return same orig_pte value. So
it's necessary to reacquire the orig_pte or pte_unmap_unlock will unmap
the stale pte.

Fixes: 9c276cc65a58 ("mm: introduce MADV_COLD")
Fixes: 854e9ed09ded ("mm: support madvise(MADV_FREE)")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
---
 mm/madvise.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/mm/madvise.c b/mm/madvise.c
index ec03a76244b7..4d6592488b51 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -437,12 +437,12 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd,
 			if (split_huge_page(page)) {
 				unlock_page(page);
 				put_page(page);
-				pte_offset_map_lock(mm, pmd, addr, &ptl);
+				orig_pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
 				break;
 			}
 			unlock_page(page);
 			put_page(page);
-			pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
+			orig_pte = pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
 			pte--;
 			addr -= PAGE_SIZE;
 			continue;
@@ -653,12 +653,12 @@ static int madvise_free_pte_range(pmd_t *pmd, unsigned long addr,
 			if (split_huge_page(page)) {
 				unlock_page(page);
 				put_page(page);
-				pte_offset_map_lock(mm, pmd, addr, &ptl);
+				orig_pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
 				goto out;
 			}
 			unlock_page(page);
 			put_page(page);
-			pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
+			orig_pte = pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
 			pte--;
 			addr -= PAGE_SIZE;
 			continue;
-- 
2.23.0

Re: [PATCH] mm/madvise: fix potential pte_unmap_unlock pte error

[Andrew Morton]

On Sat, 16 Apr 2022 16:14:16 +0800 Miaohe Lin <linmiaohe@huawei.com> wrote:

> We can't assume pte_offset_map_lock will return same orig_pte value. So
> it's necessary to reacquire the orig_pte or pte_unmap_unlock will unmap
> the stale pte.

hm, where did you learn this info about pte_offset_map_lock()?

I assume this is from code inspection only?  No observed runtime failures?

Re: [PATCH] mm/madvise: fix potential pte_unmap_unlock pte error

[Miaohe Lin]

On 2022/4/19 12:09, Andrew Morton wrote:
> On Sat, 16 Apr 2022 16:14:16 +0800 Miaohe Lin <linmiaohe@huawei.com> wrote:
> 
>> We can't assume pte_offset_map_lock will return same orig_pte value. So
>> it's necessary to reacquire the orig_pte or pte_unmap_unlock will unmap
>> the stale pte.
> 
> hm, where did you learn this info about pte_offset_map_lock()?
> 
> I assume this is from code inspection only?  No observed runtime failures?

Yes, this is from code inspection. There is no observed runtime failures now due
to the race window being really small. And this becomes noop in !CONFIG_HIGHMEM
system (CONFIG_HIGHMEM system should be rare now). But this could be triggered theoretically.

Thanks!

> .
>