Patch "mm: thp: refix false positive BUG in page_move_anon_rmap()" has been added to the 4.6-stable tree

PATCH [email protected] 1 participant 1 message Aug 2, 2016

Subsystems (5)

Stable branch Memory management MM core HugeTLB +1 more subsystems

lore

Share & tools

lore

[email protected]

author maintainer Applied

2016-08-02 07:07 UTC #0 lore raw

This is a note to let you know that I've just added the patch titled

mm: thp: refix false positive BUG in page_move_anon_rmap()

to the 4.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mm-thp-refix-false-positive-bug-in-page_move_anon_rmap.patch
and it can be found in the queue-4.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 5a49973d7143ebbabd76e1dcd69ee42e349bb7b9 Mon Sep 17 00:00:00 2001

From: Hugh Dickins <[email protected]>
Date: Thu, 14 Jul 2016 12:07:38 -0700
Subject: mm: thp: refix false positive BUG in page_move_anon_rmap()

From: Hugh Dickins <[email protected]>

commit 5a49973d7143ebbabd76e1dcd69ee42e349bb7b9 upstream.

The VM_BUG_ON_PAGE in page_move_anon_rmap() is more trouble than it's
worth: the syzkaller fuzzer hit it again. It's still wrong for some THP cases, because linear_page_index() was never intended to apply to addresses before the start of a vma.

That's easily fixed with a signed long cast inside linear_page_index(); and Dmitry has tested such a patch, to verify the false positive. But why extend linear_page_index() just for this case? when the avoidance in page_move_anon_rmap() has already grown ugly, and there's no reason for the check at all (nothing else there is using address or index).

Remove address arg from page_move_anon_rmap(), remove VM_BUG_ON_PAGE, remove CONFIG_DEBUG_VM PageTransHuge adjustment.

And one more thing: should the compound_head(page) be done inside or outside page_move_anon_rmap()? It's usually pushed down to the lowest level nowadays (and mm/memory.c shows no other explicit use of it), so I think it's better done in page_move_anon_rmap() than by caller.

Fixes 0798d3c022dc ("mm: thp: avoid false positive VM_BUG_ON_PAGE in page_move_anon_rmap()")

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Hugh Dickins <[email protected]>

Reported-by Dmitry Vyukov <[email protected]>

Acked-by Kirill A. Shutemov <[email protected]>

Cc Mika Westerberg <[email protected]>

Cc Andrea Arcangeli <[email protected]>

Cc Rik van Riel <[email protected]>

Signed-off-by Andrew Morton <[email protected]>

Signed-off-by Linus Torvalds <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/linux/rmap.h |    2 +-
 mm/hugetlb.c         |    2 +-
 mm/memory.c          |    3 +--
 mm/rmap.c            |    9 +++------
 4 files changed, 6 insertions(+), 10 deletions(-)

include/linux/rmap.h +1 -1

@@ -158,7 +158,7 @@ struct anon_vma *page_get_anon_vma(struc
 /*
  * rmap interfaces called when adding or removing pte of page
  */
-void page_move_anon_rmap(struct page *, struct vm_area_struct *, unsigned long);
+void page_move_anon_rmap(struct page *, struct vm_area_struct *);
 void page_add_anon_rmap(struct page *, struct vm_area_struct *,
 		unsigned long, bool);
 void do_page_add_anon_rmap(struct page *, struct vm_area_struct *,

mm/hugetlb.c +1 -1

@@ -3328,7 +3328,7 @@ retry_avoidcopy:
 	/* If no-one else is actually using this page, avoid the copy
 	 * and just make the page writable */
 	if (page_mapcount(old_page) == 1 && PageAnon(old_page)) {
-		page_move_anon_rmap(old_page, vma, address);
+		page_move_anon_rmap(old_page, vma);
 		set_huge_ptep_writable(vma, address, ptep);
 		return 0;
 	}

mm/memory.c +1 -2

@@ -2397,8 +2397,7 @@ static int do_wp_page(struct mm_struct *
 				 * Protected against the rmap code by
 				 * the page lock.
 				 */
-				page_move_anon_rmap(compound_head(old_page),
-						    vma, address);
+				page_move_anon_rmap(old_page, vma);
 			}
 			unlock_page(old_page);
 			return wp_page_reuse(mm, vma, address, page_table, ptl,

mm/rmap.c +3 -6

@@ -1084,23 +1084,20 @@ EXPORT_SYMBOL_GPL(page_mkclean);
  * page_move_anon_rmap - move a page to our anon_vma
  * @page:	the page to move to our anon_vma
  * @vma:	the vma the page belongs to
- * @address:	the user virtual address mapped
  *
  * When a page belongs exclusively to one process after a COW event,
  * that page can be moved into the anon_vma that belongs to just that
  * process, so the rmap code will not search the parent or sibling
  * processes.
  */
-void page_move_anon_rmap(struct page *page,
-	struct vm_area_struct *vma, unsigned long address)
+void page_move_anon_rmap(struct page *page, struct vm_area_struct *vma)
 {
 	struct anon_vma *anon_vma = vma->anon_vma;
 
+	page = compound_head(page);
+
 	VM_BUG_ON_PAGE(!PageLocked(page), page);
 	VM_BUG_ON_VMA(!anon_vma, vma);
-	if (IS_ENABLED(CONFIG_DEBUG_VM) && PageTransHuge(page))
-		address &= HPAGE_PMD_MASK;
-	VM_BUG_ON_PAGE(page->index != linear_page_index(vma, address), page);
 
 	anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON;
 	/*

Patches currently in stable-queue which might be from [email protected] are

queue-4.6/mm-thp-refix-false-positive-bug-in-page_move_anon_rmap.patch queue-4.6/mm-compaction-abort-free-scanner-if-split-fails.patch queue-4.6/mm-compaction-prevent-vm_bug_on-when-terminating-freeing-scanner.patch queue-4.6/radix-tree-fix-radix_tree_iter_retry-for-tagged-iterators.patch