From: Peter Xu <peterx@redhat.com>
To: Yuanzheng Song <songyuanzheng@huawei.com>
Cc: akpm@linux-foundation.org, david@redhat.com, hughd@google.com,
gregkh@linuxfoundation.org, linux-mm@kvack.org,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH STABLE 5.10 v2] mm/memory: add non-anonymous page check in the copy_present_page()
Date: Fri, 28 Oct 2022 09:15:57 -0400 [thread overview]
Message-ID: <Y1vWDbRhXd8jTw8N@x1n> (raw)
In-Reply-To: <20221028030705.2840539-1-songyuanzheng@huawei.com>
On Fri, Oct 28, 2022 at 03:07:05AM +0000, Yuanzheng Song wrote:
> The vma->anon_vma of the child process may be NULL because
> the entire vma does not contain anonymous pages. In this
> case, a BUG will occur when the copy_present_page() passes
> a copy of a non-anonymous page of that vma to the
> page_add_new_anon_rmap() to set up new anonymous rmap.
>
> ------------[ cut here ]------------
> kernel BUG at mm/rmap.c:1044!
> Internal error: Oops - BUG: 0 [#1] SMP
> Modules linked in:
> CPU: 2 PID: 3617 Comm: test Not tainted 5.10.149 #1
> Hardware name: linux,dummy-virt (DT)
> pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)
> pc : __page_set_anon_rmap+0xbc/0xf8
> lr : __page_set_anon_rmap+0xbc/0xf8
> sp : ffff800014c1b870
> x29: ffff800014c1b870 x28: 0000000000000001
> x27: 0000000010100073 x26: ffff1d65c517baa8
> x25: ffff1d65cab0f000 x24: ffff1d65c416d800
> x23: ffff1d65cab5f248 x22: 0000000020000000
> x21: 0000000000000001 x20: 0000000000000000
> x19: fffffe75970023c0 x18: 0000000000000000
> x17: 0000000000000000 x16: 0000000000000000
> x15: 0000000000000000 x14: 0000000000000000
> x13: 0000000000000000 x12: 0000000000000000
> x11: 0000000000000000 x10: 0000000000000000
> x9 : ffffc3096d5fb858 x8 : 0000000000000000
> x7 : 0000000000000011 x6 : ffff5a5c9089c000
> x5 : 0000000000020000 x4 : ffff5a5c9089c000
> x3 : ffffc3096d200000 x2 : ffffc3096e8d0000
> x1 : ffff1d65ca3da740 x0 : 0000000000000000
> Call trace:
> __page_set_anon_rmap+0xbc/0xf8
> page_add_new_anon_rmap+0x1e0/0x390
> copy_pte_range+0xd00/0x1248
> copy_page_range+0x39c/0x620
> dup_mmap+0x2e0/0x5a8
> dup_mm+0x78/0x140
> copy_process+0x918/0x1a20
> kernel_clone+0xac/0x638
> __do_sys_clone+0x78/0xb0
> __arm64_sys_clone+0x30/0x40
> el0_svc_common.constprop.0+0xb0/0x308
> do_el0_svc+0x48/0xb8
> el0_svc+0x24/0x38
> el0_sync_handler+0x160/0x168
> el0_sync+0x180/0x1c0
> Code: 97f8ff85 f9400294 17ffffeb 97f8ff82 (d4210000)
> ---[ end trace a972347688dc9bd4 ]---
> Kernel panic - not syncing: Oops - BUG: Fatal exception
> SMP: stopping secondary CPUs
> Kernel Offset: 0x43095d200000 from 0xffff800010000000
> PHYS_OFFSET: 0xffffe29a80000000
> CPU features: 0x08200022,61806082
> Memory Limit: none
> ---[ end Kernel panic - not syncing: Oops - BUG: Fatal exception ]---
>
> This problem has been fixed by the commit <fb3d824d1a46>
> ("mm/rmap: split page_dup_rmap() into page_dup_file_rmap()
> and page_try_dup_anon_rmap()"), but still exists in the
> linux-5.10.y branch.
>
> This patch is not applicable to this version because
> of the large version differences. Therefore, fix it by
> adding non-anonymous page check in the copy_present_page().
>
> Cc: stable@vger.kernel.org
> Fixes: 70e806e4e645 ("mm: Do early cow for pinned pages during fork() for ptes")
> Signed-off-by: Yuanzheng Song <songyuanzheng@huawei.com>
Acked-by: Peter Xu <peterx@redhat.com>
--
Peter Xu
next prev parent reply other threads:[~2022-10-28 13:16 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-28 3:07 [PATCH STABLE 5.10 v2] mm/memory: add non-anonymous page check in the copy_present_page() Yuanzheng Song
2022-10-28 13:15 ` Peter Xu [this message]
2022-10-31 7:39 ` Greg KH
2022-10-31 7:39 ` Patch "mm/memory: add non-anonymous page check in the copy_present_page()" has been added to the 5.10-stable tree gregkh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y1vWDbRhXd8jTw8N@x1n \
--to=peterx@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=david@redhat.com \
--cc=gregkh@linuxfoundation.org \
--cc=hughd@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=songyuanzheng@huawei.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).