From: Qi Zheng <[email protected]>
In clear_flush(), the original pte may be a present entry, so we should
use ptep_clear() to let page_table_check track the pte clearing operation,
otherwise it may cause false positive in subsequent set_pte_at().
Fixes: 42b2547137f5 ("arm64/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK")
Signed-off-by: Qi Zheng <[email protected]>
---
arch/arm64/mm/hugetlbpage.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 21716c940682..9c52718ea750 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -236,7 +236,7 @@ static void clear_flush(struct mm_struct *mm,
unsigned long i, saddr = addr;
for (i = 0; i < ncontig; i++, addr += pgsize, ptep++)
- pte_clear(mm, addr, ptep);
+ ptep_clear(mm, addr, ptep);
flush_tlb_range(&vma, saddr, addr);
}
--
2.30.2
I wrote wrong Kefeng's email address before, correct it now.
On 2023/8/10 17:32, Qi Zheng wrote:
> From: Qi Zheng <[email protected]>
>
> In clear_flush(), the original pte may be a present entry, so we should
> use ptep_clear() to let page_table_check track the pte clearing operation,
> otherwise it may cause false positive in subsequent set_pte_at().
>
> Fixes: 42b2547137f5 ("arm64/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK")
> Signed-off-by: Qi Zheng <[email protected]>
> ---
> arch/arm64/mm/hugetlbpage.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
> index 21716c940682..9c52718ea750 100644
> --- a/arch/arm64/mm/hugetlbpage.c
> +++ b/arch/arm64/mm/hugetlbpage.c
> @@ -236,7 +236,7 @@ static void clear_flush(struct mm_struct *mm,
> unsigned long i, saddr = addr;
>
> for (i = 0; i < ncontig; i++, addr += pgsize, ptep++)
> - pte_clear(mm, addr, ptep);
> + ptep_clear(mm, addr, ptep);
>
> flush_tlb_range(&vma, saddr, addr);
> }
On Thu, Aug 10, 2023 at 09:32:41AM +0000, Qi Zheng wrote:
> From: Qi Zheng <[email protected]>
>
> In clear_flush(), the original pte may be a present entry, so we should
> use ptep_clear() to let page_table_check track the pte clearing operation,
> otherwise it may cause false positive in subsequent set_pte_at().
Isn't this true for most users of pte_clear()? There are some in the core
code, so could they trigger the false positive as well?
Will
On Fri, Aug 11, 2023 at 07:16:20PM +0800, Qi Zheng wrote:
> Will Deacon <[1][email protected]>于2023年8月11日 周五19:03写道：
>
> On Thu, Aug 10, 2023 at 09:32:41AM +0000, Qi Zheng wrote:
> > From: Qi Zheng <[2][email protected]>
> >
> > In clear_flush(), the original pte may be a present entry, so we
> should
> > use ptep_clear() to let page_table_check track the pte clearing
> operation,
> > otherwise it may cause false positive in subsequent set_pte_at().
>
> Isn't this true for most users of pte_clear()? There are some in the
> core
> code, so could they trigger the false positive as well?
>
> No, the PTE entry in other places where pte_clear() is used is non-present
> PTE.
> The page_table_check does not does track the pte operation in this case,
> so it will not cause false positives.
Are you sure? For example, the call from flush_all_zero_pkmaps() in
highmem.c really looks like it's clearing a valid entry. Not that arm64
cares about highmem, but still.
Will
On Mon, Aug 21, 2023 at 01:21:19PM -0700, Andrew Morton wrote:
> On Fri, 11 Aug 2023 19:28:41 +0800 Qi Zheng <[email protected]> wrote:
>
> > Will Deacon <[email protected]>于2023年8月11日 周五19:21写道：
> >
> > > On Fri, Aug 11, 2023 at 07:16:20PM +0800, Qi Zheng wrote:
> > > > Will Deacon <[1][email protected]>于2023年8月11日 周五19:03写道：
> > > >
> > > > On Thu, Aug 10, 2023 at 09:32:41AM +0000, Qi Zheng wrote:
> > > > > From: Qi Zheng <[2][email protected]>
> > > > >
> > > > > In clear_flush(), the original pte may be a present entry, so we
> > > > should
> > > > > use ptep_clear() to let page_table_check track the pte clearing
> > > > operation,
> > > > > otherwise it may cause false positive in subsequent set_pte_at().
> > > >
> > > > Isn't this true for most users of pte_clear()? There are some in the
> > > > core
> > > > code, so could they trigger the false positive as well?
> > > >
> > > > No, the PTE entry in other places where pte_clear() is used is
> > > non-present
> > > > PTE.
> > > > The page_table_check does not does track the pte operation in this
> > > case,
> > > > so it will not cause false positives.
> > >
> > > Are you sure? For example, the call from flush_all_zero_pkmaps() in
> > > highmem.c really looks like it's clearing a valid entry. Not that arm64
> > > cares about highmem, but still.
> >
> >
> > Ah, this is init_mm, not user mm, page_table_check does not care about this
> > case.
>
> It's unclear where we stand with this patch. An ack or a nack, please?
Sorry Andrew, I saw you'd queued it so I marked it as "done" on my list. I
think it's fine:
Acked-by: Will Deacon <[email protected]>
Will