Re: [PATCH v2 1/2] mm: use aligned address in clear_gigantic_page()

[Kefeng Wang <wangkefeng.wang@huawei.com>]

On 2024/10/28 15:03, Huang, Ying wrote:
> Kefeng Wang <wangkefeng.wang@huawei.com> writes:
> 
>> On 2024/10/28 14:17, Huang, Ying wrote:
>>> Kefeng Wang <wangkefeng.wang@huawei.com> writes:
>>>
>>>> When clearing gigantic page, it zeros page from the first page to the
>>>> last page, if directly passing addr_hint which maybe not the address
>>>> of the first page of folio, then some archs could flush the wrong cache
>>>> if it does use the addr_hint as a hint. For non-gigantic page, it
>>>> calculates the base address inside, even passed the wrong addr_hint, it
>>>> only has performance impact as the process_huge_page() wants to process
>>>> target page last to keep its cache lines hot), no functional impact.
>>>>
>>>> Let's pass the real accessed address to folio_zero_user() and use the
>>>> aligned address in clear_gigantic_page() to fix it.
>>>>
>>>> Fixes: 78fefd04c123 ("mm: memory: convert clear_huge_page() to folio_zero_user()")
>>>> Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
>>>> ---
>>>> v2:
>>>> - update changelog to clarify the impact, per Andrew
>>>>
>>>>    fs/hugetlbfs/inode.c | 2 +-
>>>>    mm/memory.c          | 1 +
>>>>    2 files changed, 2 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
>>>> index a4441fb77f7c..a5ea006f403e 100644
>>>> --- a/fs/hugetlbfs/inode.c
>>>> +++ b/fs/hugetlbfs/inode.c
>>>> @@ -825,7 +825,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
>>>>    			error = PTR_ERR(folio);
>>>>    			goto out;
>>>>    		}
>>>> -		folio_zero_user(folio, ALIGN_DOWN(addr, hpage_size));
>>>> +		folio_zero_user(folio, addr);
>>> 'addr' is set with the following statement above,
>>> 		/* addr is the offset within the file (zero based) */
>>> 		addr = index * hpage_size;
>>> So, we just don't need to ALIGN_DOWN() here.  Or do I miss
>>> something?
>>
>> Yes, it is already aligned,
>>>
>>>>    		__folio_mark_uptodate(folio);
>>>>    		error = hugetlb_add_to_page_cache(folio, mapping, index);
>>>>    		if (unlikely(error)) {
>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>> index 75c2dfd04f72..ef47b7ea5ddd 100644
>>>> --- a/mm/memory.c
>>>> +++ b/mm/memory.c
>>>> @@ -6821,6 +6821,7 @@ static void clear_gigantic_page(struct folio *folio, unsigned long addr,
>>>>    	int i;
>>>>      	might_sleep();
>>>> +	addr = ALIGN_DOWN(addr, folio_size(folio));
>>
>> but for hugetlb_no_page(),  we do need to align the addr as it use
>> vmf->real_address, so I move the alignment into the
>> clear_gigantic_page.
> 
> That sounds good.  You may need to revise patch description to describe
> why you make the change.  May be something like below?
> 
> In current kernel, hugetlb_no_page() calls folio_zero_user() with the
> fault address.  Where the fault address may be not aligned with the huge
> page size.  Then, folio_zero_user() may call clear_gigantic_page() with
> the address, while clear_gigantic_page() requires the address to be huge
> page size aligned.  So, this may cause memory corruption or information
> leak.

OK, will use it and update all patches, thanks.

> 
>>>>    	for (i = 0; i < nr_pages; i++) {
>>>>    		cond_resched();
>>>>    		clear_user_highpage(folio_page(folio, i), addr + i * PAGE_SIZE);
> 
> --
> Best Regards,
> Huang, Ying
>