Commit 5a49973d authored by Hugh Dickins's avatar Hugh Dickins Committed by Linus Torvalds

mm: thp: refix false positive BUG in page_move_anon_rmap()

The VM_BUG_ON_PAGE in page_move_anon_rmap() is more trouble than it's
worth: the syzkaller fuzzer hit it again.  It's still wrong for some THP
cases, because linear_page_index() was never intended to apply to
addresses before the start of a vma.

That's easily fixed with a signed long cast inside linear_page_index();
and Dmitry has tested such a patch, to verify the false positive.  But
why extend linear_page_index() just for this case? when the avoidance in
page_move_anon_rmap() has already grown ugly, and there's no reason for
the check at all (nothing else there is using address or index).

Remove address arg from page_move_anon_rmap(), remove VM_BUG_ON_PAGE,
remove CONFIG_DEBUG_VM PageTransHuge adjustment.

And one more thing: should the compound_head(page) be done inside or
outside page_move_anon_rmap()? It's usually pushed down to the lowest
level nowadays (and mm/memory.c shows no other explicit use of it), so I
think it's better done in page_move_anon_rmap() than by caller.

Fixes: 0798d3c0 ("mm: thp: avoid false positive VM_BUG_ON_PAGE in page_move_anon_rmap()")
Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1607120444540.12528@eggly.anvilsSigned-off-by: default avatarHugh Dickins <hughd@google.com>
Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Acked-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: <stable@vger.kernel.org>	[4.5+]
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 55bda43b
...@@ -158,7 +158,7 @@ struct anon_vma *page_get_anon_vma(struct page *page); ...@@ -158,7 +158,7 @@ struct anon_vma *page_get_anon_vma(struct page *page);
/* /*
* rmap interfaces called when adding or removing pte of page * rmap interfaces called when adding or removing pte of page
*/ */
void page_move_anon_rmap(struct page *, struct vm_area_struct *, unsigned long); void page_move_anon_rmap(struct page *, struct vm_area_struct *);
void page_add_anon_rmap(struct page *, struct vm_area_struct *, void page_add_anon_rmap(struct page *, struct vm_area_struct *,
unsigned long, bool); unsigned long, bool);
void do_page_add_anon_rmap(struct page *, struct vm_area_struct *, void do_page_add_anon_rmap(struct page *, struct vm_area_struct *,
......
...@@ -3383,7 +3383,7 @@ static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma, ...@@ -3383,7 +3383,7 @@ static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
/* If no-one else is actually using this page, avoid the copy /* If no-one else is actually using this page, avoid the copy
* and just make the page writable */ * and just make the page writable */
if (page_mapcount(old_page) == 1 && PageAnon(old_page)) { if (page_mapcount(old_page) == 1 && PageAnon(old_page)) {
page_move_anon_rmap(old_page, vma, address); page_move_anon_rmap(old_page, vma);
set_huge_ptep_writable(vma, address, ptep); set_huge_ptep_writable(vma, address, ptep);
return 0; return 0;
} }
......
...@@ -2399,8 +2399,7 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma, ...@@ -2399,8 +2399,7 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
* Protected against the rmap code by * Protected against the rmap code by
* the page lock. * the page lock.
*/ */
page_move_anon_rmap(compound_head(old_page), page_move_anon_rmap(old_page, vma);
vma, address);
} }
unlock_page(old_page); unlock_page(old_page);
return wp_page_reuse(mm, vma, address, page_table, ptl, return wp_page_reuse(mm, vma, address, page_table, ptl,
......
...@@ -1084,23 +1084,20 @@ EXPORT_SYMBOL_GPL(page_mkclean); ...@@ -1084,23 +1084,20 @@ EXPORT_SYMBOL_GPL(page_mkclean);
* page_move_anon_rmap - move a page to our anon_vma * page_move_anon_rmap - move a page to our anon_vma
* @page: the page to move to our anon_vma * @page: the page to move to our anon_vma
* @vma: the vma the page belongs to * @vma: the vma the page belongs to
* @address: the user virtual address mapped
* *
* When a page belongs exclusively to one process after a COW event, * When a page belongs exclusively to one process after a COW event,
* that page can be moved into the anon_vma that belongs to just that * that page can be moved into the anon_vma that belongs to just that
* process, so the rmap code will not search the parent or sibling * process, so the rmap code will not search the parent or sibling
* processes. * processes.
*/ */
void page_move_anon_rmap(struct page *page, void page_move_anon_rmap(struct page *page, struct vm_area_struct *vma)
struct vm_area_struct *vma, unsigned long address)
{ {
struct anon_vma *anon_vma = vma->anon_vma; struct anon_vma *anon_vma = vma->anon_vma;
page = compound_head(page);
VM_BUG_ON_PAGE(!PageLocked(page), page); VM_BUG_ON_PAGE(!PageLocked(page), page);
VM_BUG_ON_VMA(!anon_vma, vma); VM_BUG_ON_VMA(!anon_vma, vma);
if (IS_ENABLED(CONFIG_DEBUG_VM) && PageTransHuge(page))
address &= HPAGE_PMD_MASK;
VM_BUG_ON_PAGE(page->index != linear_page_index(vma, address), page);
anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON; anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON;
/* /*
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment