Kirill A. Shutemov 47c53ccca4 thp: fix MADV_DONTNEED vs. numa balancing race ...

commit ced108037c upstream.

In case prot_numa, we are under down_read(mmap_sem).  It's critical to
not clear pmd intermittently to avoid race with MADV_DONTNEED which is
also under down_read(mmap_sem):

	CPU0:				CPU1:
				change_huge_pmd(prot_numa=1)
				 pmdp_huge_get_and_clear_notify()
madvise_dontneed()
 zap_pmd_range()
  pmd_trans_huge(*pmd) == 0 (without ptl)
  // skip the pmd
				 set_pmd_at();
				 // pmd is re-established

The race makes MADV_DONTNEED miss the huge pmd and don't clear it
which may break userspace.

Found by code analysis, never saw triggered.

Link: http://lkml.kernel.org/r/20170302151034.27829-3-kirill.shutemov@linux.intel.com
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hillf Danton <hillf.zj@alibaba-inc.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[jwang: adjust context for 4.4]
Signed-off-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-12-16 10:33:50 +01:00

..

kasan

kasan: respect /proc/sys/kernel/traceoff_on_warning

2017-06-17 06:39:36 +02:00

backing-dev.c

block: fix double-free in the failure path of cgwb_bdi_init()

2017-02-26 11:07:51 +01:00

balloon_compaction.c

…

bootmem.c

…

cleancache.c

…

cma_debug.c

…

cma.c

mm/cma: silence warnings due to max() usage

2016-11-10 16:36:36 +01:00

cma.h

…

compaction.c

…

debug-pagealloc.c

mm, hwpoison: fixup "mm: check the return value of lookup_page_ext for all call sites"

2017-11-24 11:26:29 +01:00

debug.c

…

dmapool.c

…

early_ioremap.c

…

fadvise.c

…

failslab.c

…

filemap.c

mm: do not access page->mapping directly on page_endio

2017-03-12 06:37:25 +01:00

frame_vector.c

…

frontswap.c

…

gup.c

mm: larger stack guard gap, between vmas

2017-06-26 07:13:11 +02:00

highmem.c

…

huge_memory.c

thp: fix MADV_DONTNEED vs. numa balancing race

2017-12-16 10:33:50 +01:00

hugetlb_cgroup.c

…

hugetlb.c

mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd()

2017-04-08 09:53:32 +02:00

hwpoison-inject.c

…

init-mm.c

mm: Add a user_ns owner to mm_struct and fix ptrace permission checks

2017-01-06 11:16:11 +01:00

internal.h

mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries

2017-08-11 09:08:50 -07:00

interval_tree.c

…

Kconfig

…

Kconfig.debug

…

kmemcheck.c

…

kmemleak-test.c

…

kmemleak.c

…

ksm.c

…

list_lru.c

mm/list_lru.c: fix list_lru_count_node() to be race free

2017-07-21 07:44:56 +02:00

maccess.c

…

madvise.c

mm/madvise.c: fix madvise() infinite loop under special circumstances

2017-12-05 11:22:50 +01:00

Makefile

…

memblock.c

mm: consider memblock reservations for deferred memory initialization sizing

2017-06-14 13:16:26 +02:00

memcontrol.c

mm: memcontrol: avoid unused function warning

2017-03-18 19:09:57 +08:00

memory_hotplug.c

base/memory, hotplug: fix a kernel oops in show_valid_zones()

2017-02-09 08:02:47 +01:00

memory-failure.c

mm/memory-failure.c: use compound_head() flags for huge pages

2017-06-26 07:13:10 +02:00

memory.c

mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries

2017-08-11 09:08:50 -07:00

mempolicy.c

mm/mempolicy: fix use after free when calling get_mempolicy

2017-08-24 17:02:35 -07:00

mempool.c

mm/mempool: avoid KASAN marking mempool poison checks as use-after-free

2017-08-12 19:29:09 -07:00

memtest.c

…

migrate.c

Sanitize 'move_pages()' permission checks

2017-08-24 17:02:36 -07:00

mincore.c

…

mlock.c

mlock: fix mlock count can not decrease in race condition

2017-06-07 12:06:01 +02:00

mm_init.c

…

mmap.c

mm: fix overflow check in expand_upwards()

2017-07-21 07:44:58 +02:00

mmu_context.c

…

mmu_notifier.c

…

mmzone.c

…

mprotect.c

mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries

2017-08-11 09:08:50 -07:00

mremap.c

mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries

2017-08-11 09:08:50 -07:00

msync.c

…

nobootmem.c

…

nommu.c

…

oom_kill.c

…

page_alloc.c

mm: check the return value of lookup_page_ext for all call sites

2017-11-24 08:32:25 +01:00

page_counter.c

…

page_ext.c

mm/page_ext.c: check if page_ext is not prepared

2017-11-24 08:32:25 +01:00

page_idle.c

…

page_io.c

…

page_isolation.c

…

page_owner.c

mm: check the return value of lookup_page_ext for all call sites

2017-11-24 08:32:25 +01:00

page-writeback.c

…

pagewalk.c

mm/pagewalk.c: report holes in hugetlb ranges

2017-11-24 08:32:25 +01:00

percpu-km.c

…

percpu-vm.c

…

percpu.c

percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages

2017-03-26 12:13:20 +02:00

pgtable-generic.c

…

process_vm_access.c

…

quicklist.c

…

readahead.c

…

rmap.c

mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries

2017-08-11 09:08:50 -07:00

shmem.c

…

slab_common.c

slub: do not merge cache if slub_debug contains a never-merge flag

2017-10-21 17:09:05 +02:00

slab.c

…

slab.h

…

slob.c

…

slub.c

slub/memcg: cure the brainless abuse of sysfs attributes

2017-06-07 12:06:01 +02:00

sparse-vmemmap.c

…

sparse.c

…

swap_cgroup.c

mm, swap_cgroup: reschedule when neeed in swap_cgroup_swapoff()

2017-07-05 14:37:15 +02:00

swap_state.c

…

swap.c

…

swapfile.c

swapfile: fix memory corruption via malformed swapfile

2016-11-18 10:48:34 +01:00

truncate.c

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

userfaultfd.c

…

util.c

…

vmacache.c

…

vmalloc.c

…

vmpressure.c

mm: vmpressure: fix sending wrong events on underflow

2017-03-12 06:37:25 +01:00

vmscan.c

mm: fix classzone_idx underflow in shrink_zones()

2017-07-15 11:57:44 +02:00

vmstat.c

mm: check the return value of lookup_page_ext for all call sites

2017-11-24 08:32:25 +01:00

workingset.c

mm: workingset: fix crash in shadow node shrinker caused by replace_page_cache_page()

2016-10-28 03:01:34 -04:00

zbud.c

…

zpool.c

…

zsmalloc.c

…

zswap.c

zswap: disable changing params if init fails

2017-02-09 08:02:45 +01:00