Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a2ce2666 authored by Aaron Lu's avatar Aaron Lu Committed by Linus Torvalds
Browse files

mremap: move_ptes: check pte dirty after its removal 



Linus found there still is a race in mremap after commit 5d190420
("mremap: fix race between mremap() and page cleanning").

As described by Linus:
 "the issue is that another thread might make the pte be dirty (in the
  hardware walker, so no locking of ours will make any difference)
  *after* we checked whether it was dirty, but *before* we removed it
  from the page tables"

Fix it by moving the check after we removed it from the page table.

Suggested-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarAaron Lu <aaron.lu@intel.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 88abd824

mm/huge_memory.c

+2 −2
Original line number Diff line number Diff line
@@ -1456,9 +1456,9 @@ bool move_huge_pmd(struct vm_area_struct *vma, unsigned long old_addr, 
		new_ptl = pmd_lockptr(mm, new_pmd);

		if (new_ptl != old_ptl)

			spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);

		if (pmd_present(*old_pmd) && pmd_dirty(*old_pmd))

			force_flush = true;

		pmd = pmdp_huge_get_and_clear(mm, old_addr, old_pmd);

		if (pmd_present(pmd) && pmd_dirty(pmd))

			force_flush = true;

		VM_BUG_ON(!pmd_none(*new_pmd));



		if (pmd_move_must_withdraw(new_ptl, old_ptl) &&

mm/mremap.c

+8 −4
Original line number Diff line number Diff line
@@ -149,14 +149,18 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd, 
		if (pte_none(*old_pte))

			continue;



		pte = ptep_get_and_clear(mm, old_addr, old_pte);

		/*

		 * We are remapping a dirty PTE, make sure to

		 * flush TLB before we drop the PTL for the

		 * If we are remapping a dirty PTE, make sure

		 * to flush TLB before we drop the PTL for the

		 * old PTE or we may race with page_mkclean().

		 *

		 * This check has to be done after we removed the

		 * old PTE from page tables or another thread may

		 * dirty it after the check and before the removal.

		 */

		if (pte_present(*old_pte) && pte_dirty(*old_pte))

		if (pte_present(pte) && pte_dirty(pte))

			force_flush = true;

		pte = ptep_get_and_clear(mm, old_addr, old_pte);

		pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);

		pte = move_soft_dirty_pte(pte);

		set_pte_at(mm, new_addr, new_pte, pte);