2022-02-09 09:52:31

by Muchun Song

[permalink] [raw]
Subject: [PATCH v4 0/5] Fix some cache flush bugs

This series focus on fixing cache maintenance.

v4:
- Replace folio_copy() with copy_user_huge_page().
- Update commit message for patch 2.

v3:
- Collect Reviewed-by tag from Zi Yan.
- Fix hugetlb cache maintenance.

v2:
- Collect Reviewed-by tag from Zi Yan.
- Using a for loop instead of the folio variant for backportability.

Muchun Song (5):
mm: thp: fix wrong cache flush in remove_migration_pmd()
mm: fix missing cache flush for all tail pages of compound page
mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()
mm: hugetlb: fix missing cache flush in hugetlb_mcopy_atomic_pte()
mm: replace multiple dcache flush with flush_dcache_folio()

mm/huge_memory.c | 3 ++-
mm/hugetlb.c | 3 ++-
mm/memory.c | 2 ++
mm/migrate.c | 3 +--
4 files changed, 7 insertions(+), 4 deletions(-)

--
2.11.0



2022-02-09 11:24:54

by Muchun Song

[permalink] [raw]
Subject: [PATCH v4 4/5] mm: hugetlb: fix missing cache flush in hugetlb_mcopy_atomic_pte()

folio_copy() will copy the data from one page to the target page, then
the target page will be mapped to the user space address, which might
have an alias issue with the kernel address used to copy the data from
the page to. There are 2 ways to fix this issue.

1) insert flush_dcache_page() after folio_copy().
2) replace folio_copy() with copy_user_huge_page() which already
considers the cache maintenance.

We chose 2) way to fix the issue since architectures can optimize this
situation.

Fixes: 8cc5fcbb5be8 ("mm, hugetlb: fix racy resv_huge_pages underflow on UFFDIO_COPY")
Signed-off-by: Muchun Song <[email protected]>
---
mm/hugetlb.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index a1baa198519a..eba7681d15d0 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -5818,7 +5818,8 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
*pagep = NULL;
goto out;
}
- folio_copy(page_folio(page), page_folio(*pagep));
+ copy_user_huge_page(page, *pagep, dst_addr, dst_vma,
+ pages_per_huge_page(h));
put_page(*pagep);
*pagep = NULL;
}
--
2.11.0


2022-02-09 23:38:00

by Mike Kravetz

[permalink] [raw]
Subject: Re: [PATCH v4 4/5] mm: hugetlb: fix missing cache flush in hugetlb_mcopy_atomic_pte()

On 2/7/22 23:36, Muchun Song wrote:
> folio_copy() will copy the data from one page to the target page, then
> the target page will be mapped to the user space address, which might
> have an alias issue with the kernel address used to copy the data from
> the page to. There are 2 ways to fix this issue.
>
> 1) insert flush_dcache_page() after folio_copy().
> 2) replace folio_copy() with copy_user_huge_page() which already
> considers the cache maintenance.
>
> We chose 2) way to fix the issue since architectures can optimize this
> situation.
>
> Fixes: 8cc5fcbb5be8 ("mm, hugetlb: fix racy resv_huge_pages underflow on UFFDIO_COPY")
> Signed-off-by: Muchun Song <[email protected]>
> ---
> mm/hugetlb.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)

Thanks! This will also make backports easier.

Reviewed-by: Mike Kravetz <[email protected]>

--
Mike Kravetz