From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D4D00C25B74 for ; Fri, 24 May 2024 03:41:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Content-Type: Content-Transfer-Encoding:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:From:References:Cc:To:Subject: MIME-Version:Date:Message-ID:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=1qEk/iiO515zdmmZvXBOgVWTSrtz7QfDuN8n7QG34bE=; b=DxHgGky5vZmyXZ tMb4M1C54ECD2YRAWctS/+Oe5OTEPNEfS6gjbKkjLad9FlWPaqqsJYl/Nhosvbs0rqAv1P4p179OD IglOZuZxNL7FtmfypiW3SsYUKEGxjRdTnLK46DQYsfvD9ndSKU2CvaGZ6VtuEDpJudMnfmhegWmz9 LQIUjkQTSQR6x2Si1Z3PT7iyCI+whGl0sKocAnSkXpr+fOhM5UfFO8ZQC1wDTkWRzxwv1PT32dnd0 MfR/NMxQgBm2abKmf+Y8wln6uLLz2gVr8G36UgLmZ9NSqTYFpwYIyJ5XyNF/walReUYpSJx0aSKbA 6V4i0V2uAeCNkzzO0wmQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1sALnu-00000007xUm-2W05; Fri, 24 May 2024 03:41:14 +0000 Received: from out30-98.freemail.mail.aliyun.com ([115.124.30.98]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1sALnn-00000007xTc-1knN for linux-arm-kernel@lists.infradead.org; Fri, 24 May 2024 03:41:09 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1716522059; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=6/UZ2+cAO5LwgqyUyoJz3cM9YsqKmDTGWP10HkryRFU=; b=vKW7CBG7txF9OPWY+bKGOF9er7BYQHJ17IxRIu/txmpdlCBeeYVAGRBN4f8A8MzM7yHEiKyMfZWWeD8HzmFdpMYSLHwWGGJY9bV7zDv0rHPMls8Flw6MGS8zJZrstdsGrVkUbOVwpjGjOMiKhKrI/oT+yzAGhKEXva6sFDfh7+k= X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R411e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033045075189;MF=baolin.wang@linux.alibaba.com;NM=1;PH=DS;RN=20;SR=0;TI=SMTPD_---0W74cpp8_1716522053; Received: from 30.97.56.65(mailfrom:baolin.wang@linux.alibaba.com fp:SMTPD_---0W74cpp8_1716522053) by smtp.aliyun-inc.com; Fri, 24 May 2024 11:40:55 +0800 Message-ID: <0ae77b66-c919-4dfe-9b3c-741b52643257@linux.alibaba.com> Date: Fri, 24 May 2024 11:40:53 +0800 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] mm: arm64: Fix the out-of-bounds issue in contpte_clear_young_dirty_ptes To: Barry Song <21cnbao@gmail.com>, akpm@linux-foundation.org, linux-mm@kvack.org Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Barry Song , Lance Yang , Ryan Roberts , David Hildenbrand , Jeff Xie , Kefeng Wang , Michal Hocko , Minchan Kim , Muchun Song , Peter Xu , Yang Shi , Yin Fengwei , Zach O'Keefe , Catalin Marinas , Will Deacon References: <20240524005444.135417-1-21cnbao@gmail.com> From: Baolin Wang In-Reply-To: <20240524005444.135417-1-21cnbao@gmail.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240523_204107_688456_DA1ED688 X-CRM114-Status: GOOD ( 14.29 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On 2024/5/24 08:54, Barry Song wrote: > From: Barry Song > > We are passing a huge nr to __clear_young_dirty_ptes() right > now. While we should pass the number of pages, we are actually > passing CONT_PTE_SIZE. This is causing lots of crashes of > MADV_FREE, panic oops could vary everytime. > > Fixes: 89e86854fb0a ("mm/arm64: override clear_young_dirty_ptes() batch helper") > Cc: Lance Yang > Cc: Barry Song <21cnbao@gmail.com> > Cc: Ryan Roberts > Cc: David Hildenbrand > Cc: Jeff Xie > Cc: Kefeng Wang > Cc: Michal Hocko > Cc: Minchan Kim > Cc: Muchun Song > Cc: Peter Xu > Cc: Yang Shi > Cc: Yin Fengwei > Cc: Zach O'Keefe > Cc: Catalin Marinas > Cc: Will Deacon > Signed-off-by: Barry Song Good catch. Feel free to add: Reviewed-by: Baolin Wang > --- > arch/arm64/mm/contpte.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/arch/arm64/mm/contpte.c b/arch/arm64/mm/contpte.c > index 9f9486de0004..a3edced29ac1 100644 > --- a/arch/arm64/mm/contpte.c > +++ b/arch/arm64/mm/contpte.c > @@ -376,7 +376,7 @@ void contpte_clear_young_dirty_ptes(struct vm_area_struct *vma, > * clearing access/dirty for the whole block. > */ > unsigned long start = addr; > - unsigned long end = start + nr; > + unsigned long end = start + nr * PAGE_SIZE; > > if (pte_cont(__ptep_get(ptep + nr - 1))) > end = ALIGN(end, CONT_PTE_SIZE); > @@ -386,7 +386,7 @@ void contpte_clear_young_dirty_ptes(struct vm_area_struct *vma, > ptep = contpte_align_down(ptep); > } > > - __clear_young_dirty_ptes(vma, start, ptep, end - start, flags); > + __clear_young_dirty_ptes(vma, start, ptep, (end - start) / PAGE_SIZE, flags); > } > EXPORT_SYMBOL_GPL(contpte_clear_young_dirty_ptes); > _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel