Re: [PATCH 3/3] mm:fix gup_pud_range

[John Hubbard <jhubbard@nvidia.com>]

On 9/20/19 5:33 PM, Qiujun Huang wrote:
>> On 9/20/19 8:51 AM, Qiujun Huang wrote:
...
>> It would be nice if this spelled out a little more clearly what's
>> wrong. I think you and Aneesh are saying that the entry is really
>> a swap entry, created by the MCE response to a bad page?
> do_machine_check->
> do_memory_failure->
> memory_failure->
> hwpoison_user_mappings
> will updated PUD level PTE entry as a swap entry.
> 
> static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
> unsigned long address, void *arg)
> {
> ...
> if (PageHWPoison(page) && !(flags & TTU_IGNORE_HWPOISON)) {
> pteval = swp_entry_to_pte(make_hwpoison_entry(subpage));

OK, that helps. Let's add something approximately like this to the
commit description:

do_machine_check()
  do_memory_failure()
    memory_failure()
      hw_poison_user_mappings()
        try_to_unmap()
          pteval = swp_entry_to_pte(make_hwpoison_entry(subpage));

...and now we have a swap entry that indicates that the page entry
refers to a bad (and poisoned) page of memory, but gup_fast() at this
level of the page table was ignoring swap entries, and incorrectly 
assuming that "!pxd_none() == valid and present". 

And this was not just a poisoned page problem, but a generaly swap entry 
problem. So, any swap entry type (device memory migration, numa migration,
or just regular swapping) could lead to the same problem.

Fix this by checking for pxd_present(), instead of pxd_none().


> ...
>>
>>>
>>> Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
>>> ---
>>>  mm/gup.c | 2 ++
>>>  1 file changed, 2 insertions(+)
>>>
>>> diff --git a/mm/gup.c b/mm/gup.c
>>> index 98f13ab..6157ed9 100644
>>> --- a/mm/gup.c
>>> +++ b/mm/gup.c
>>> @@ -2230,6 +2230,8 @@ static int gup_pud_range(p4d_t p4d, unsigned long addr, unsigned long end,
>>>               next = pud_addr_end(addr, end);
>>>               if (pud_none(pud))
>>>                       return 0;
>>> +             if (unlikely(!pud_present(pud)))
>>> +                     return 0;
>>
>> If the MCE hwpoison behavior puts in swap entries, then it seems like all
>> page table walkers would need to check for p*d_present(), and maybe at all
>> levels too, right?
> I think so
>>

Should those changes be part of this fix, do you think?

thanks,
-- 
John Hubbard
NVIDIA