From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 15DB1C433EF for ; Sat, 26 Feb 2022 03:10:59 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 7EC158D0003; Fri, 25 Feb 2022 22:10:59 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 79B188D0001; Fri, 25 Feb 2022 22:10:59 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 6B1C28D0003; Fri, 25 Feb 2022 22:10:59 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0111.hostedemail.com [216.40.44.111]) by kanga.kvack.org (Postfix) with ESMTP id 5D57F8D0001 for ; Fri, 25 Feb 2022 22:10:59 -0500 (EST) Received: from smtpin19.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 19910824C44E for ; Sat, 26 Feb 2022 03:10:59 +0000 (UTC) X-FDA: 79183454238.19.87C0CD6 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf14.hostedemail.com (Postfix) with ESMTP id 952A8100005 for ; Sat, 26 Feb 2022 03:10:58 +0000 (UTC) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EC7BF61E15; Sat, 26 Feb 2022 03:10:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 50216C340EF; Sat, 26 Feb 2022 03:10:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1645845057; bh=7LBXFx6hZpq7/9Vwph8v64Zd+qaOv7VE0EtyNFx1bNM=; h=Date:To:From:In-Reply-To:Subject:From; b=TCYtI1hsWqNWQUBifA45nFauFSM/MEuRStP9IYq9LK4iOpv84MGD3B0+3oQz86I0y XrovhGBz5PlYvmE+0mvLtZLGvf3WoSTTgUuTqZjR069u1LXLw5daabojL+feJG0qPG hZI/4JQc+RE41cSPsfoaT9KRNYUdYlrL8/48av0o= Date: Fri, 25 Feb 2022 19:10:56 -0800 To: stable@vger.kernel.org,mike.kravetz@oracle.com,almasrymina@google.com,aneesh.kumar@linux.ibm.com,akpm@linux-foundation.org,patches@lists.linux.dev,linux-mm@kvack.org,mm-commits@vger.kernel.org,torvalds@linux-foundation.org,akpm@linux-foundation.org From: Andrew Morton In-Reply-To: <20220225191021.f71538a3f43dc448110e88b6@linux-foundation.org> Subject: [patch 02/12] mm/hugetlb: fix kernel crash with hugetlb mremap Message-Id: <20220226031057.50216C340EF@smtp.kernel.org> X-Rspam-User: X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: 952A8100005 X-Stat-Signature: 38aeps8y9xi3yznkt3q67hiue5ej38re Authentication-Results: imf14.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b=TCYtI1hs; spf=pass (imf14.hostedemail.com: domain of akpm@linux-foundation.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org; dmarc=none X-HE-Tag: 1645845058-629380 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: "Aneesh Kumar K.V" Subject: mm/hugetlb: fix kernel crash with hugetlb mremap This fixes the below crash: kernel BUG at include/linux/mm.h:2373! cpu 0x5d: Vector: 700 (Program Check) at [c00000003c6e76e0] pc: c000000000581a54: pmd_to_page+0x54/0x80 lr: c00000000058d184: move_hugetlb_page_tables+0x4e4/0x5b0 sp: c00000003c6e7980 msr: 9000000000029033 current = 0xc00000003bd8d980 paca = 0xc000200fff610100 irqmask: 0x03 irq_happened: 0x01 pid = 9349, comm = hugepage-mremap kernel BUG at include/linux/mm.h:2373! [link register ] c00000000058d184 move_hugetlb_page_tables+0x4e4/0x5b0 [c00000003c6e7980] c00000000058cecc move_hugetlb_page_tables+0x22c/0x5b0 (unreliable) [c00000003c6e7a90] c00000000053b78c move_page_tables+0xdbc/0x1010 [c00000003c6e7bd0] c00000000053bc34 move_vma+0x254/0x5f0 [c00000003c6e7c90] c00000000053c790 sys_mremap+0x7c0/0x900 [c00000003c6e7db0] c00000000002c450 system_call_exception+0x160/0x2c0 the kernel can't use huge_pte_offset before it set the pte entry because a page table lookup check for huge PTE bit in the page table to differentiate between a huge pte entry and a pointer to pte page. A huge_pte_alloc won't mark the page table entry huge and hence kernel should not use huge_pte_offset after a huge_pte_alloc. Link: https://lkml.kernel.org/r/20220211063221.99293-1-aneesh.kumar@linux.ibm.com Fixes: 550a7d60bd5e ("mm, hugepages: add mremap() support for hugepage backed vma") Signed-off-by: Aneesh Kumar K.V Reviewed-by: Mike Kravetz Reviewed-by: Mina Almasry Cc: Signed-off-by: Andrew Morton --- mm/hugetlb.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) --- a/mm/hugetlb.c~mm-hugetlb-fix-kernel-crash-with-hugetlb-mremap +++ a/mm/hugetlb.c @@ -4851,14 +4851,13 @@ again: } static void move_huge_pte(struct vm_area_struct *vma, unsigned long old_addr, - unsigned long new_addr, pte_t *src_pte) + unsigned long new_addr, pte_t *src_pte, pte_t *dst_pte) { struct hstate *h = hstate_vma(vma); struct mm_struct *mm = vma->vm_mm; - pte_t *dst_pte, pte; spinlock_t *src_ptl, *dst_ptl; + pte_t pte; - dst_pte = huge_pte_offset(mm, new_addr, huge_page_size(h)); dst_ptl = huge_pte_lock(h, mm, dst_pte); src_ptl = huge_pte_lockptr(h, mm, src_pte); @@ -4917,7 +4916,7 @@ int move_hugetlb_page_tables(struct vm_a if (!dst_pte) break; - move_huge_pte(vma, old_addr, new_addr, src_pte); + move_huge_pte(vma, old_addr, new_addr, src_pte, dst_pte); } flush_tlb_range(vma, old_end - len, old_end); mmu_notifier_invalidate_range_end(&range); _