Re: [PATCH v2 1/2] mm: use aligned address in clear_gigantic_page()

Kefeng Wang
2024-10-28T08:35:38Z

On 2024/10/28 15:03, Huang, Ying wrote:
> Kefeng Wang <wangkefeng.wang@huawei.com> writes:
>
>> On 2024/10/28 14:17, Huang, Ying wrote:
>>> Kefeng Wang <wangkefeng.wang@huawei.com> writes:
>>>
>>>> When clearing gigantic page, it zeros page from the first page to the
>>>> last page, if directly passing addr_hint which maybe not the address
>>>> of the first page of folio, then some archs could flush the wrong cache
>>>> if it does use the addr_hint as a hint. For non-gigantic page, it
>>>> calculates the base address inside, even passed the wrong addr_hint, it
>>>> only has performance impact as the process_huge_page() wants to process
>>>> target page last to keep its cache lines hot), no functional impact.
>>>>
>>>> Let's pass the real accessed address to folio_zero_user() and use the
>>>> aligned address in clear_gigantic_page() to fix it.
>>>>
>>>> Fixes: 78fefd04c123 ("mm: memory: convert clear_huge_page() to folio_zero_user()")
>>>> Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
>>>> ---
>>>> v2:
>>>> - update changelog to clarify the impact, per Andrew
>>>>
>>>> fs/hugetlbfs/inode.c | 2 +-
>>>> mm/memory.c | 1 +
>>>> 2 files changed, 2 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
>>>> index a4441fb77f7c..a5ea006f403e 100644
>>>> --- a/fs/hugetlbfs/inode.c
>>>> +++ b/fs/hugetlbfs/inode.c
>>>> @@ -825,7 +825,7 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
>>>> error = PTR_ERR(folio);
>>>> goto out;
>>>> }
>>>> - folio_zero_user(folio, ALIGN_DOWN(addr, hpage_size));
>>>> + folio_zero_user(folio, addr);
>>> 'addr' is set with the following statement above,
>>> /* addr is the offset within the file (zero based) */
>>> addr = index * hpage_size;
>>> So, we just don't need to ALIGN_DOWN() here. Or do I miss
>>> something?
>>
>> Yes, it is already aligned,
>>>
>>>> __folio_mark_uptodate(folio);
>>>> error = hugetlb_add_to_page_cache(folio, mapping, index);
>>>> if (unlikely(error)) {
>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>> index 75c2dfd04f72..ef47b7ea5ddd 100644
>>>> --- a/mm/memory.c
>>>> +++ b/mm/memory.c
>>>> @@ -6821,6 +6821,7 @@ static void clear_gigantic_page(struct folio *folio, unsigned long addr,
>>>> int i;
>>>> might_sleep();
>>>> + addr = ALIGN_DOWN(addr, folio_size(folio));
>>
>> but for hugetlb_no_page(), we do need to align the addr as it use
>> vmf->real_address, so I move the alignment into the
>> clear_gigantic_page.
>
> That sounds good. You may need to revise patch description to describe
> why you make the change. May be something like below?
>
> In current kernel, hugetlb_no_page() calls folio_zero_user() with the
> fault address. Where the fault address may be not aligned with the huge
> page size. Then, folio_zero_user() may call clear_gigantic_page() with
> the address, while clear_gigantic_page() requires the address to be huge
> page size aligned. So, this may cause memory corruption or information
> leak.

OK, will use it and update all patches, thanks.

>
>>>> for (i = 0; i < nr_pages; i++) {
>>>> cond_resched();
>>>> clear_user_highpage(folio_page(folio, i), addr + i * PAGE_SIZE);
>
> --
> Best Regards,
> Huang, Ying
>