On Fri, Dec 7, 2018 at 6:34 AM Peter Xu <peterx@redhat.com> wrote:
>
> On Thu, Dec 06, 2018 at 04:46:04PM +0800, Peter Xu wrote:
> > When splitting a huge migrating PMD, we'll transfer the soft dirty bit
> > from the huge page to the small pages.  However we're possibly using a
> > wrong data since when fetching the bit we're using pmd_soft_dirty()
> > upon a migration entry.  Fix it up.
>
> Note that if my understanding is correct about the problem then if
> without the patch there is chance to lose some of the dirty bits in
> the migrating pmd pages (on x86_64 we're fetching bit 11 which is part
> of swap offset instead of bit 2) and it could potentially corrupt the
> memory of an userspace program which depends on the dirty bit.

It seems this code is broken in case of pmd_migraion:

old_pmd = pmdp_invalidate(vma, haddr, pmd);

#ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
pmd_migration = is_pmd_migration_entry(old_pmd);
if (pmd_migration) {
swp_entry_t entry;

entry = pmd_to_swp_entry(old_pmd);
page = pfn_to_page(swp_offset(entry));
} else
#endif
page = pmd_page(old_pmd);
VM_BUG_ON_PAGE(!page_count(page), page);
page_ref_add(page, HPAGE_PMD_NR - 1);
if (pmd_dirty(old_pmd))
SetPageDirty(page);
write = pmd_write(old_pmd);
young = pmd_young(old_pmd);
soft_dirty = pmd_soft_dirty(old_pmd);

Not just soft_dirt - all bits (dirty, write, young) have diffrent encoding
or not present at all for migration entry.

>
> >
> > CC: Andrea Arcangeli <aarcange@redhat.com>
> > CC: Andrew Morton <akpm@linux-foundation.org>
> > CC: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
> > CC: Matthew Wilcox <willy@infradead.org>
> > CC: Michal Hocko <mhocko@suse.com>
> > CC: Dave Jiang <dave.jiang@intel.com>
> > CC: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
> > CC: Souptick Joarder <jrdr.linux@gmail.com>
> > CC: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
> > CC: linux-mm@kvack.org
> > CC: linux-kernel@vger.kernel.org
> > Signed-off-by: Peter Xu <peterx@redhat.com>
> > ---
> >
> > I noticed this during code reading.  Only compile tested.  I'm sending
> > a patch directly for review comments since it's relatively
> > straightforward and not easy to test.  Please have a look, thanks.
> > ---
> >  mm/huge_memory.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> > index f2d19e4fe854..fb0787c3dd3b 100644
> > --- a/mm/huge_memory.c
> > +++ b/mm/huge_memory.c
> > @@ -2161,7 +2161,10 @@ static void __split_huge_pmd_locked(struct
vm_area_struct *vma, pmd_t *pmd,
> >               SetPageDirty(page);
> >       write = pmd_write(old_pmd);
> >       young = pmd_young(old_pmd);
> > -     soft_dirty = pmd_soft_dirty(old_pmd);
> > +     if (unlikely(pmd_migration))
> > +             soft_dirty = pmd_swp_soft_dirty(old_pmd);
> > +     else
> > +             soft_dirty = pmd_soft_dirty(old_pmd);
> >
> >       /*
> >        * Withdraw the table only after we mark the pmd entry invalid.
> > --
> > 2.17.1
> >
>
> Regards,
>
> --
> Peter Xu
>