From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752819AbcBOK0c (ORCPT ); Mon, 15 Feb 2016 05:26:32 -0500 Received: from mga01.intel.com ([192.55.52.88]:31262 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751122AbcBOK0b (ORCPT ); Mon, 15 Feb 2016 05:26:31 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.22,449,1449561600"; d="scan'208";a="902834160" Date: Mon, 15 Feb 2016 13:26:28 +0300 From: "Kirill A. Shutemov" To: Grazvydas Ignotas Cc: linux-kernel@vger.kernel.org, Andrew Morton Subject: Re: remap_file_pages regression Message-ID: <20160215102628.GA53150@black.fi.intel.com> References: <1455499975-8390-1-git-send-email-notasas@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1455499975-8390-1-git-send-email-notasas@gmail.com> User-Agent: Mutt/1.5.23.1 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Feb 15, 2016 at 03:32:55AM +0200, Grazvydas Ignotas wrote: > Hi, > > since remap_file_pages() rework the following simple program fails. > I haven't actually bisected this, only know it worked on 3.19 at least > (I bought a new system now and need 4.2+ for hardware support). The patch below should fix the issue. Please test. > If you are curious, the program is an emulator and is using > remap_file_pages() to implement memory mirroring efficiently (and to > remap things during run time). Could you elaborate on this? Why creating file on tmpfs/shmem (using memfd_create() for example) plus plain mmap()s wouldn't work for you? >>From 6b8690c3a983a72212db8cd35eb4cab106a195d4 Mon Sep 17 00:00:00 2001 From: "Kirill A. Shutemov" Date: Mon, 15 Feb 2016 13:06:16 +0300 Subject: [PATCH] mm: fix regression in remap_file_pages() emulation Grazvydas Ignotas has reported a regression in remap_file_pages() emulation. Testcase: #define _GNU_SOURCE #include #include #include #include #define SIZE (4096 * 3) int main(int argc, char **argv) { unsigned long *p; long i; p = mmap(NULL, SIZE, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0); if (p == MAP_FAILED) { perror("mmap"); return -1; } for (i = 0; i < SIZE / 4096; i++) p[i * 4096 / sizeof(*p)] = i; if (remap_file_pages(p, 4096, 0, 1, 0)) { perror("remap_file_pages"); return -1; } if (remap_file_pages(p, 4096 * 2, 0, 1, 0)) { perror("remap_file_pages"); return -1; } assert(p[0] == 1); munmap(p, SIZE); return 0; } The second remap_file_pages() fails with -EINVAL. The reason is that remap_file_pages() emulation assumes that the target vma covers whole area we want to over map. That assumption is broken by first remap_file_pages() call: it split the area into two vma. The solution is to check next adjacent vmas, if they map the same file with the same flags. Signed-off-by: Kirill A. Shutemov Reported-by: Grazvydas Ignotas --- mm/mmap.c | 34 +++++++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 5 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 2f2415a7a688..76d1ec29149b 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2664,12 +2664,29 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, if (!vma || !(vma->vm_flags & VM_SHARED)) goto out; - if (start < vma->vm_start || start + size > vma->vm_end) + if (start < vma->vm_start) goto out; - if (pgoff == linear_page_index(vma, start)) { - ret = 0; - goto out; + if (start + size > vma->vm_end) { + struct vm_area_struct *next; + + for (next = vma->vm_next; next; next = next->vm_next) { + /* hole between vmas ? */ + if (next->vm_start != next->vm_prev->vm_end) + goto out; + + if (next->vm_file != vma->vm_file) + goto out; + + if (next->vm_flags != vma->vm_flags) + goto out; + + if (start + size <= next->vm_end) + break; + } + + if (!next) + goto out; } prot |= vma->vm_flags & VM_READ ? PROT_READ : 0; @@ -2679,9 +2696,16 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, flags &= MAP_NONBLOCK; flags |= MAP_SHARED | MAP_FIXED | MAP_POPULATE; if (vma->vm_flags & VM_LOCKED) { + struct vm_area_struct *tmp; flags |= MAP_LOCKED; + /* drop PG_Mlocked flag for over-mapped range */ - munlock_vma_pages_range(vma, start, start + size); + for (tmp = vma; tmp->vm_start >= start + size; + tmp = tmp->vm_next) { + munlock_vma_pages_range(tmp, + max(tmp->vm_start, start), + min(tmp->vm_end, start + size)); + } } file = get_file(vma->vm_file); -- Kirill A. Shutemov