Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752041AbcDVSie (ORCPT ); Fri, 22 Apr 2016 14:38:34 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:52500 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751719AbcDVSid (ORCPT ); Fri, 22 Apr 2016 14:38:33 -0400 Date: Fri, 22 Apr 2016 11:38:31 -0700 From: Andrew Morton To: Yongji Xie Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, kirill.shutemov@linux.intel.com, jmarchan@redhat.com, mingo@kernel.org, vbabka@suse.cz, dave.hansen@linux.intel.com, dan.j.williams@intel.com, matthew.r.wilcox@intel.com, aarcange@redhat.com, mhocko@suse.com, luto@kernel.org, dahi@linux.vnet.ibm.com Subject: Re: [PATCH] mm: Fix incorrect pfn passed to untrack_pfn in remap_pfn_range Message-Id: <20160422113831.6294e65dbc4fe7a2d3421539@linux-foundation.org> In-Reply-To: <1461321088-3247-1-git-send-email-xyjxie@linux.vnet.ibm.com> References: <1461321088-3247-1-git-send-email-xyjxie@linux.vnet.ibm.com> X-Mailer: Sylpheed 3.4.1 (GTK+ 2.24.23; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1002 Lines: 33 On Fri, 22 Apr 2016 18:31:28 +0800 Yongji Xie wrote: > We used generic hooks in remap_pfn_range to help archs to > track pfnmap regions. The code is something like: > > int remap_pfn_range() > { > ... > track_pfn_remap(vma, &prot, pfn, addr, PAGE_ALIGN(size)); > ... > pfn -= addr >> PAGE_SHIFT; > ... > untrack_pfn(vma, pfn, PAGE_ALIGN(size)); > ... > } > > Here we can easily find the pfn is changed but not recovered > before untrack_pfn() is called. That's incorrect. What are the runtime effects of this bug? > --- a/mm/memory.c > +++ b/mm/memory.c > @@ -1755,6 +1755,7 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr, > break; > } while (pgd++, addr = next, addr != end); > > + pfn += (end - PAGE_ALIGN(size)) >> PAGE_SHIFT; > if (err) > untrack_pfn(vma, pfn, PAGE_ALIGN(size)); I'm having trouble understanding this. Wouldn't it be better to simply save the track_pfn_remap() call's `pfn' arg in a new local variable?