FAILED: patch "[PATCH] mm: fix possible PMD dirty bit lost in" failed to apply to 4.14-stable tree

FAILED: patch "[PATCH] mm: fix possible PMD dirty bit lost in" failed to apply to 4.14-stable tree

[gregkh]

The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 8a8683ad9ba48b4b52a57f013513d1635c1ca5c4 Mon Sep 17 00:00:00 2001
From: Huang Ying <ying.huang@intel.com>
Date: Thu, 5 Mar 2020 22:28:29 -0800
Subject: [PATCH] mm: fix possible PMD dirty bit lost in
 set_pmd_migration_entry()

In set_pmd_migration_entry(), pmdp_invalidate() is used to change PMD
atomically.  But the PMD is read before that with an ordinary memory
reading.  If the THP (transparent huge page) is written between the PMD
reading and pmdp_invalidate(), the PMD dirty bit may be lost, and cause
data corruption.  The race window is quite small, but still possible in
theory, so need to be fixed.

The race is fixed via using the return value of pmdp_invalidate() to get
the original content of PMD, which is a read/modify/write atomic
operation.  So no THP writing can occur in between.

The race has been introduced when the THP migration support is added in
the commit 616b8371539a ("mm: thp: enable thp migration in generic path").
But this fix depends on the commit d52605d7cb30 ("mm: do not lose dirty
and accessed bits in pmdp_invalidate()").  So it's easy to be backported
after v4.16.  But the race window is really small, so it may be fine not
to backport the fix at all.

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: "Huang, Ying" <ying.huang@intel.com>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: William Kucharski <william.kucharski@oracle.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: <stable@vger.kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Link: http://lkml.kernel.org/r/20200220075220.2327056-1-ying.huang@intel.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index b08b199f9a11..24ad53b4dfc0 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -3043,8 +3043,7 @@ void set_pmd_migration_entry(struct page_vma_mapped_walk *pvmw,
 		return;
 
 	flush_cache_range(vma, address, address + HPAGE_PMD_SIZE);
-	pmdval = *pvmw->pmd;
-	pmdp_invalidate(vma, address, pvmw->pmd);
+	pmdval = pmdp_invalidate(vma, address, pvmw->pmd);
 	if (pmd_dirty(pmdval))
 		set_page_dirty(page);
 	entry = make_migration_entry(page, pmd_write(pmdval));

Re: FAILED: patch "[PATCH] mm: fix possible PMD dirty bit lost in" failed to apply to 4.14-stable tree

[Sasha Levin]

On Mon, Mar 09, 2020 at 08:15:15PM +0100, gregkh@linuxfoundation.org wrote:
>
>The patch below does not apply to the 4.14-stable tree.
>If someone wants it applied there, or to any other stable or longterm
>tree, then please email the backport, including the original git commit
>id to <stable@vger.kernel.org>.
>
>thanks,
>
>greg k-h
>
>------------------ original commit in Linus's tree ------------------
>
>From 8a8683ad9ba48b4b52a57f013513d1635c1ca5c4 Mon Sep 17 00:00:00 2001
>From: Huang Ying <ying.huang@intel.com>
>Date: Thu, 5 Mar 2020 22:28:29 -0800
>Subject: [PATCH] mm: fix possible PMD dirty bit lost in
> set_pmd_migration_entry()
>
>In set_pmd_migration_entry(), pmdp_invalidate() is used to change PMD
>atomically.  But the PMD is read before that with an ordinary memory
>reading.  If the THP (transparent huge page) is written between the PMD
>reading and pmdp_invalidate(), the PMD dirty bit may be lost, and cause
>data corruption.  The race window is quite small, but still possible in
>theory, so need to be fixed.
>
>The race is fixed via using the return value of pmdp_invalidate() to get
>the original content of PMD, which is a read/modify/write atomic
>operation.  So no THP writing can occur in between.
>
>The race has been introduced when the THP migration support is added in
>the commit 616b8371539a ("mm: thp: enable thp migration in generic path").
>But this fix depends on the commit d52605d7cb30 ("mm: do not lose dirty
>and accessed bits in pmdp_invalidate()").  So it's easy to be backported
>after v4.16.  But the race window is really small, so it may be fine not
>to backport the fix at all.

As d52605d7cb30 ("mm: do not lose dirty and accessed bits in
pmdp_invalidate()") has an explicit note asking not to backport it, we
won't backport it or this patch to 4.14.

-- 
Thanks,
Sasha