2021-07-20 16:00:28

by Peter Xu

[permalink] [raw]
Subject: [PATCH stable 5.13.y/5.12.y 0/2] mm/thp: Fix uffd-wp with fork(); crash on pmd migration entry on fork

In summary: this series should be needed for 5.10/5.12/5.13. This is the

5.13.y/5.12.y backport of the series, and it should be able to be applied on

both of the branches. Patch 1 is a dependency of patch 2, while patch 2 should

be the real fix.



This series should be able to fix a rare race that mentioned in thread:



https://lore.kernel.org/linux-mm/[email protected]/



This fact wasn't discovered when the fix got proposed and merged, because the

fix was originally about uffd-wp and its fork event. However it turns out that

the problematic commit b569a1760782f3d is also causing crashing on fork() of

pmd migration entries which is even more severe than the original uffd-wp

problem.



Stable kernels at least on 5.12.y has the crash reproduced, and it's possible

5.13.y and 5.10.y could hit it due to having the problematic commit

b569a1760782f3d but lacking of the uffd-wp fix patch (8f34f1eac382, which is

also patch 2 of this series).



The pmd entry crash problem was reported by Igor Raits <[email protected]> and

debugged by Hugh Dickins <[email protected]>.



Please review, thanks.



Peter Xu (2):

mm/thp: simplify copying of huge zero page pmd when fork

mm/userfaultfd: fix uffd-wp special cases for fork()



include/linux/huge_mm.h | 2 +-

include/linux/swapops.h | 2 ++

mm/huge_memory.c | 36 +++++++++++++++++-------------------

mm/memory.c | 25 +++++++++++++------------

4 files changed, 33 insertions(+), 32 deletions(-)



--

2.31.1





2021-07-20 20:46:08

by Hugh Dickins

[permalink] [raw]
Subject: Re: [PATCH stable 5.13.y/5.12.y 0/2] mm/thp: Fix uffd-wp with fork(); crash on pmd migration entry on fork

On Tue, Jul 20, 2021 at 8:52 AM Peter Xu <[email protected]> wrote:
>
> In summary: this series should be needed for 5.10/5.12/5.13. This is the
> 5.13.y/5.12.y backport of the series, and it should be able to be applied on
> both of the branches. Patch 1 is a dependency of patch 2, while patch 2 should
> be the real fix.
>
> This series should be able to fix a rare race that mentioned in thread:
>
> https://lore.kernel.org/linux-mm/[email protected]/
>
> This fact wasn't discovered when the fix got proposed and merged, because the
> fix was originally about uffd-wp and its fork event. However it turns out that
> the problematic commit b569a1760782f3d is also causing crashing on fork() of
> pmd migration entries which is even more severe than the original uffd-wp
> problem.
>
> Stable kernels at least on 5.12.y has the crash reproduced, and it's possible
> 5.13.y and 5.10.y could hit it due to having the problematic commit
> b569a1760782f3d but lacking of the uffd-wp fix patch (8f34f1eac382, which is
> also patch 2 of this series).
>
> The pmd entry crash problem was reported by Igor Raits <[email protected]> and
> debugged by Hugh Dickins <[email protected]>.
>
> Please review, thanks.

These two 5.13.y patches look just right to me, thank you Peter (and
5.12.19 announced EOL overnight, so nothing more wanted for that).

But these do just amount to asking [email protected] to
cherry-pick the two commits
5fc7a5f6fd04bc18f309d9f979b32ef7d1d0a997
8f34f1eac3820fc2722e5159acceb22545b30b0d

Hugh

(I'd usually reply with alpine rather than gmail, but I see extra
blank lines on these 0/2s that way; but the patches themselves are
good.)

>
> Peter Xu (2):
> mm/thp: simplify copying of huge zero page pmd when fork
> mm/userfaultfd: fix uffd-wp special cases for fork()
>
> include/linux/huge_mm.h | 2 +-
> include/linux/swapops.h | 2 ++
> mm/huge_memory.c | 36 +++++++++++++++++-------------------
> mm/memory.c | 25 +++++++++++++------------
> 4 files changed, 33 insertions(+), 32 deletions(-)
>
> --
> 2.31.1
>
>

2021-07-22 14:07:03

by Greg KH

[permalink] [raw]
Subject: Re: [PATCH stable 5.13.y/5.12.y 0/2] mm/thp: Fix uffd-wp with fork(); crash on pmd migration entry on fork

On Tue, Jul 20, 2021 at 01:32:19PM -0700, Hugh Dickins wrote:
> On Tue, Jul 20, 2021 at 8:52 AM Peter Xu <[email protected]> wrote:
> >
> > In summary: this series should be needed for 5.10/5.12/5.13. This is the
> > 5.13.y/5.12.y backport of the series, and it should be able to be applied on
> > both of the branches. Patch 1 is a dependency of patch 2, while patch 2 should
> > be the real fix.
> >
> > This series should be able to fix a rare race that mentioned in thread:
> >
> > https://lore.kernel.org/linux-mm/[email protected]/
> >
> > This fact wasn't discovered when the fix got proposed and merged, because the
> > fix was originally about uffd-wp and its fork event. However it turns out that
> > the problematic commit b569a1760782f3d is also causing crashing on fork() of
> > pmd migration entries which is even more severe than the original uffd-wp
> > problem.
> >
> > Stable kernels at least on 5.12.y has the crash reproduced, and it's possible
> > 5.13.y and 5.10.y could hit it due to having the problematic commit
> > b569a1760782f3d but lacking of the uffd-wp fix patch (8f34f1eac382, which is
> > also patch 2 of this series).
> >
> > The pmd entry crash problem was reported by Igor Raits <[email protected]> and
> > debugged by Hugh Dickins <[email protected]>.
> >
> > Please review, thanks.
>
> These two 5.13.y patches look just right to me, thank you Peter (and
> 5.12.19 announced EOL overnight, so nothing more wanted for that).
>
> But these do just amount to asking [email protected] to
> cherry-pick the two commits
> 5fc7a5f6fd04bc18f309d9f979b32ef7d1d0a997
> 8f34f1eac3820fc2722e5159acceb22545b30b0d

Thanks for the review, both now queued up to 5.13.y.

greg k-h