From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752444AbdJSJdm (ORCPT ); Thu, 19 Oct 2017 05:33:42 -0400 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:57559 "EHLO out4-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751607AbdJSJdj (ORCPT ); Thu, 19 Oct 2017 05:33:39 -0400 X-ME-Sender: Date: Thu, 19 Oct 2017 11:33:48 +0200 From: Greg KH To: Will Deacon Cc: stable@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] mm: page_vma_mapped: ensure pmd is loaded with READ_ONCE outside of lock Message-ID: <20171019093348.GB20059@kroah.com> References: <1508238917-14553-1-git-send-email-will.deacon@arm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1508238917-14553-1-git-send-email-will.deacon@arm.com> User-Agent: Mutt/1.9.1 (2017-09-22) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Oct 17, 2017 at 12:15:17PM +0100, Will Deacon wrote: > [Commit a7b100953aa33a5bbdc3e5e7f2241b9c0704606e upstream] > > Loading the pmd without holding the pmd_lock exposes us to races with > concurrent updaters of the page tables but, worse still, it also allows > the compiler to cache the pmd value in a register and reuse it later on, > even if we've performed a READ_ONCE in between and seen a more recent > value. > > In the case of page_vma_mapped_walk, this leads to the following crash > when the pmd loaded for the initial pmd_trans_huge check is all zeroes > and a subsequent valid table entry is loaded by check_pmd. We then > proceed into map_pte, but the compiler re-uses the zero entry inside > pte_offset_map, resulting in a junk pointer being installed in > pvmw->pte: > > PC is at check_pte+0x20/0x170 > LR is at page_vma_mapped_walk+0x2e0/0x540 > [...] > Process doio (pid: 2463, stack limit = 0xffff00000f2e8000) > Call trace: > check_pte+0x20/0x170 > page_vma_mapped_walk+0x2e0/0x540 > page_mkclean_one+0xac/0x278 > rmap_walk_file+0xf0/0x238 > rmap_walk+0x64/0xa0 > page_mkclean+0x90/0xa8 > clear_page_dirty_for_io+0x84/0x2a8 > mpage_submit_page+0x34/0x98 > mpage_process_page_bufs+0x164/0x170 > mpage_prepare_extent_to_map+0x134/0x2b8 > ext4_writepages+0x484/0xe30 > do_writepages+0x44/0xe8 > __filemap_fdatawrite_range+0xbc/0x110 > file_write_and_wait_range+0x48/0xd8 > ext4_sync_file+0x80/0x4b8 > vfs_fsync_range+0x64/0xc0 > SyS_msync+0x194/0x1e8 > > This patch fixes the problem by ensuring that READ_ONCE is used before > the initial checks on the pmd, and this value is subsequently used when > checking whether or not the pmd is present. pmd_check is removed and > the pmd_present check is inlined directly. > > Link: http://lkml.kernel.org/r/1507222630-5839-1-git-send-email-will.deacon@arm.com > Fixes: f27176cfc363 ("mm: convert page_mkclean_one() to use page_vma_mapped_walk()") > Cc: # 4.13 > [will: backport to 4.13.y] > Signed-off-by: Will Deacon Thanks for the backport! greg k-h