From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C458C433FE for ; Tue, 29 Nov 2022 20:49:48 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 463856B0071; Tue, 29 Nov 2022 15:49:48 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 3EC9A6B0072; Tue, 29 Nov 2022 15:49:48 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 28D2F6B0073; Tue, 29 Nov 2022 15:49:48 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 14DF06B0071 for ; Tue, 29 Nov 2022 15:49:48 -0500 (EST) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id C699DC0157 for ; Tue, 29 Nov 2022 20:49:47 +0000 (UTC) X-FDA: 80187671214.05.708E69F Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf03.hostedemail.com (Postfix) with ESMTP id 6731C20013 for ; Tue, 29 Nov 2022 20:49:47 +0000 (UTC) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 80A5A618DE; Tue, 29 Nov 2022 20:49:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8FCD0C433D6; Tue, 29 Nov 2022 20:49:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1669754985; bh=0mzuQKQ6ZSk8geHPXv2MySKivpc1Sg+tc+ZvJOAilYA=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=N4VbFD/yPTNW+kJNXgFAk4RlYu7ZXH/Tron1X0lywmfayU8XBrdgBa9w0xSPtgiNi 0JDyr4wb/h59ZxtX7uHGtYbK9prjiQ+VpvmGgSqHpMvBHyX0CYhc7xAK01aAnfbjym 7fjJXrDA9vbbbWxcd3kuyr/vw1JW4YXDWl9P+uE8= Date: Tue, 29 Nov 2022 12:49:44 -0800 From: Andrew Morton To: Peter Xu Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, James Houghton , Jann Horn , Andrea Arcangeli , Rik van Riel , Nadav Amit , Miaohe Lin , Muchun Song , Mike Kravetz , David Hildenbrand Subject: Re: [PATCH 00/10] mm/hugetlb: Make huge_pte_offset() thread-safe for pmd unshare Message-Id: <20221129124944.8eff54cda65d0f5a8a089e22@linux-foundation.org> In-Reply-To: <20221129193526.3588187-1-peterx@redhat.com> References: <20221129193526.3588187-1-peterx@redhat.com> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1669754987; a=rsa-sha256; cv=none; b=zIYbLx3WXHG5N8S79jNbQwfDRzfwyLXSBF1EAz3SqC4GbLXN3fWgnk9I5UpKpIozB6ajSc qYHxzv4YwofV8xHSCcbm6QJ7tr0EVJhIryBDqcoTc22x6ZSoVQQvdBRG+jzWNU08Dqamm0 4snrHBYPZ6KNvnmKb1+ZoHR+NO3eqzg= ARC-Authentication-Results: i=1; imf03.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b="N4VbFD/y"; dmarc=none; spf=pass (imf03.hostedemail.com: domain of akpm@linux-foundation.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1669754987; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=uRz2oaLYbQF3IsUmh2Zma+xNPKzTo58bMCmFRGHbb6E=; b=EhPCRDk8d4WtAsdpyGI+v8OJNhDuzffzcNj1O+TOoJfP5SGmlWbGAqSPR6Vn19MM4atwxE iXVdz5+hfRW8SI06RcNnZLJyBKIKrLWntqPrLCnNyPkGevyJ85YFBLQK9RBz7n70Zb5xeU AoqhVwdTKks8ZDE5zGDfGySLihEPiZA= X-Stat-Signature: sn5bmb1u1chw5xnhpexknu3o9na4cy84 X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 6731C20013 Authentication-Results: imf03.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b="N4VbFD/y"; dmarc=none; spf=pass (imf03.hostedemail.com: domain of akpm@linux-foundation.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org X-Rspam-User: X-HE-Tag: 1669754987-384708 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, 29 Nov 2022 14:35:16 -0500 Peter Xu wrote: > Based on latest mm-unstable (9ed079378408). > > This can be seen as a follow-up series to Mike's recent hugetlb vma lock > series for pmd unsharing, but majorly covering safe use of huge_pte_offset. We're at -rc7 (a -rc8 appears probable this time) and I'm looking to settle down and stabilize things... > > ... > > huge_pte_offset() is always called with mmap lock held with either read or > write. It was assumed to be safe but it's actually not. One race > condition can easily trigger by: (1) firstly trigger pmd share on a memory > range, (2) do huge_pte_offset() on the range, then at the meantime, (3) > another thread unshare the pmd range, and the pgtable page is prone to lost > if the other shared process wants to free it completely (by either munmap > or exit mm). That sounds like a hard-to-hit memory leak, but what we have here is a user-triggerable use-after-free and an oops. Ugh. Could people please prioritize the review and testing of this patchset?