From patchwork Mon Jun 15 17:22:06 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrea Arcangeli X-Patchwork-Id: 484443 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id DEE7314029E for ; Tue, 16 Jun 2015 03:23:02 +1000 (AEST) Received: from localhost ([::1]:35568 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z4Y68-0003Z1-MC for incoming@patchwork.ozlabs.org; Mon, 15 Jun 2015 13:23:00 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59504) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z4Y5V-0002Gi-Ko for qemu-devel@nongnu.org; Mon, 15 Jun 2015 13:22:22 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Z4Y5R-0000Lq-BP for qemu-devel@nongnu.org; Mon, 15 Jun 2015 13:22:21 -0400 Received: from mx1.redhat.com ([209.132.183.28]:49648) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z4Y5R-0000LR-55 for qemu-devel@nongnu.org; Mon, 15 Jun 2015 13:22:17 -0400 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (Postfix) with ESMTPS id A9964AB847; Mon, 15 Jun 2015 17:22:15 +0000 (UTC) Received: from mail.random (ovpn-116-88.ams2.redhat.com [10.36.116.88]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t5FHMCAI020869 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 15 Jun 2015 13:22:14 -0400 From: Andrea Arcangeli To: Andrew Morton , linux-kernel@vger.kernel.org, linux-mm@kvack.org, qemu-devel@nongnu.org, kvm@vger.kernel.org Date: Mon, 15 Jun 2015 19:22:06 +0200 Message-Id: <1434388931-24487-3-git-send-email-aarcange@redhat.com> In-Reply-To: <1434388931-24487-1-git-send-email-aarcange@redhat.com> References: <1434388931-24487-1-git-send-email-aarcange@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.22 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: zhang.zhanghailiang@huawei.com, Pavel Emelyanov , Johannes Weiner , Hugh Dickins , "Dr. David Alan Gilbert" , Sanidhya Kashyap , Dave Hansen , Andres Lagar-Cavilla , Mel Gorman , Paolo Bonzini , "Kirill A. Shutemov" , "Huangpeng \(Peter\)" , Andy Lutomirski , Linus Torvalds , Peter Feiner Subject: [Qemu-devel] [PATCH 2/7] userfaultfd: propagate the full address in THP faults X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org The THP faults were not propagating the original fault address. The latest version of the API with uffd.arg.pagefault.address is supposed to propagate the full address through THP faults. This was not a kernel crashing bug and it wouldn't risk to corrupt user memory, but it would cause a SIGBUS failure because the wrong page was being copied. For various reasons this wasn't easily reproducible in the qemu workload, but the strestest exposed the problem immediately. Signed-off-by: Andrea Arcangeli --- mm/huge_memory.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 80d4ae1..73eb404 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -717,13 +717,14 @@ static inline pmd_t mk_huge_pmd(struct page *page, pgprot_t prot) static int __do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long haddr, pmd_t *pmd, + unsigned long address, pmd_t *pmd, struct page *page, gfp_t gfp, unsigned int flags) { struct mem_cgroup *memcg; pgtable_t pgtable; spinlock_t *ptl; + unsigned long haddr = address & HPAGE_PMD_MASK; VM_BUG_ON_PAGE(!PageCompound(page), page); @@ -765,7 +766,7 @@ static int __do_huge_pmd_anonymous_page(struct mm_struct *mm, mem_cgroup_cancel_charge(page, memcg); put_page(page); pte_free(mm, pgtable); - ret = handle_userfault(vma, haddr, flags, + ret = handle_userfault(vma, address, flags, VM_UFFD_MISSING); VM_BUG_ON(ret & VM_FAULT_FALLBACK); return ret; @@ -841,7 +842,7 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, if (pmd_none(*pmd)) { if (userfaultfd_missing(vma)) { spin_unlock(ptl); - ret = handle_userfault(vma, haddr, flags, + ret = handle_userfault(vma, address, flags, VM_UFFD_MISSING); VM_BUG_ON(ret & VM_FAULT_FALLBACK); } else { @@ -865,7 +866,8 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, count_vm_event(THP_FAULT_FALLBACK); return VM_FAULT_FALLBACK; } - return __do_huge_pmd_anonymous_page(mm, vma, haddr, pmd, page, gfp, flags); + return __do_huge_pmd_anonymous_page(mm, vma, address, pmd, page, gfp, + flags); } int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,