Received: by 2002:a25:ad19:0:0:0:0:0 with SMTP id y25csp4094554ybi; Fri, 19 Jul 2019 14:54:00 -0700 (PDT) X-Google-Smtp-Source: APXvYqx/+XfCD4b3G0N0O24SQ9cE2PAd1I9RBClRSFDlKZRPnURg82Zv53oZSHyc2w4ci9OJJyXs X-Received: by 2002:a63:c70d:: with SMTP id n13mr55633233pgg.171.1563573240019; Fri, 19 Jul 2019 14:54:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1563573240; cv=none; d=google.com; s=arc-20160816; b=H/3aq7JZl2xo94zRYWW/xi6pn+1ps8GYsdAxm5u145SZF4zxczZ4o0MVS3wyQE3O7b JU1Rzo6JnNvjgoScvSftchW/wxI4BhpCddEvHRMJK0DFYOrLeL0/vBU9o7RHDPUEnNAd lgI5uRAhqyrF8jDGBC6jZP63/g7etASN8i7dT0qf/K/nsbZc6Kvup1A/m+Zgg+GbJK6i K4fYiXeYIuyIwrFe3kqYmIW/8TruRFARlsTiLePmIFeGQ+lag9kcNvSKUcX7MQSzvBaD GuCuJ9YtDTlXjjXBsFZuLlvsk50GNqvwY86Yg1uyITtFAlC41zIfH0Se7IWjnEGlpSym uFQA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:dkim-signature:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=xvR8iX2outgELqejVmTcMhX9RlYLy+wU1js0WKyDum8=; b=e08hl3Ysjks6l+3NfLaof+R3NEYF9GOADZTliR0oj932euvod7DRpz51Q2ygmlwb3P G0ZdEHQZ+L4lV9Rv88w+vUEMDEEHm+G1RjEy1fKUvry+01wBNmjZvxxMod3GIlajthcf 3Km0/jDIELUUHUQbaMYIelrtYChlNwFzk9BYpP5LuoPnUdQ9cC04Y4g0Pq42xGsrGJev 3JoUVssoh6H9uBzV/QFB+D3rWlYMO460GiyGiShsmCB7hfu+Qvrru+/MgKnPiXIybM56 VREP0jzKjQkZ0AGi1r+pPZq+dzbcQeBGwN+qT280MKXFsKHzfxsP/TGgcmVEGox9V8h0 JiFQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@nvidia.com header.s=n1 header.b=OKZvq3+z; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=nvidia.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id s66si2387810pgs.592.2019.07.19.14.53.44; Fri, 19 Jul 2019 14:54:00 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@nvidia.com header.s=n1 header.b=OKZvq3+z; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=nvidia.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732479AbfGSTHJ (ORCPT + 99 others); Fri, 19 Jul 2019 15:07:09 -0400 Received: from hqemgate16.nvidia.com ([216.228.121.65]:7442 "EHLO hqemgate16.nvidia.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728164AbfGSTHH (ORCPT ); Fri, 19 Jul 2019 15:07:07 -0400 Received: from hqpgpgate102.nvidia.com (Not Verified[216.228.121.13]) by hqemgate16.nvidia.com (using TLS: TLSv1.2, DES-CBC3-SHA) id ; Fri, 19 Jul 2019 12:07:04 -0700 Received: from hqmail.nvidia.com ([172.20.161.6]) by hqpgpgate102.nvidia.com (PGP Universal service); Fri, 19 Jul 2019 12:07:06 -0700 X-PGP-Universal: processed; by hqpgpgate102.nvidia.com on Fri, 19 Jul 2019 12:07:06 -0700 Received: from HQMAIL109.nvidia.com (172.20.187.15) by HQMAIL107.nvidia.com (172.20.187.13) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 19 Jul 2019 19:07:06 +0000 Received: from HQMAIL105.nvidia.com (172.20.187.12) by HQMAIL109.nvidia.com (172.20.187.15) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 19 Jul 2019 19:07:02 +0000 Received: from hqnvemgw01.nvidia.com (172.20.150.20) by HQMAIL105.nvidia.com (172.20.187.12) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Fri, 19 Jul 2019 19:07:02 +0000 Received: from rcampbell-dev.nvidia.com (Not Verified[10.110.48.66]) by hqnvemgw01.nvidia.com with Trustwave SEG (v7,5,8,10121) id ; Fri, 19 Jul 2019 12:07:02 -0700 From: Ralph Campbell To: CC: , Ralph Campbell , , Christoph Hellwig , Dan Williams , Andrew Morton , "Jason Gunthorpe" , Logan Gunthorpe , "Ira Weiny" , Matthew Wilcox , "Mel Gorman" , Jan Kara , "Kirill A. Shutemov" , Michal Hocko , Andrea Arcangeli , Mike Kravetz , =?UTF-8?q?J=C3=A9r=C3=B4me=20Glisse?= Subject: [PATCH 2/3] mm/hmm: fix ZONE_DEVICE anon page mapping reuse Date: Fri, 19 Jul 2019 12:06:48 -0700 Message-ID: <20190719190649.30096-3-rcampbell@nvidia.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190719190649.30096-1-rcampbell@nvidia.com> References: <20190719190649.30096-1-rcampbell@nvidia.com> MIME-Version: 1.0 X-NVConfidentiality: public Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nvidia.com; s=n1; t=1563563224; bh=xvR8iX2outgELqejVmTcMhX9RlYLy+wU1js0WKyDum8=; h=X-PGP-Universal:From:To:CC:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:X-NVConfidentiality: Content-Type:Content-Transfer-Encoding; b=OKZvq3+z673WKe9ZxHHENZNaFNaPQZoxO8AM7Y6bFKGbam/hN8xmfqFwVzF/1F1Y0 UcnRMsDU67Z51I9cCja1HqAyybrks1U6IV32zBohgz0b+bAkYuAPGZeU4bl49NjQY+ oSgVVuKMaEJ9+usmKExyucb5HPeidwazzVoZM/YEk5eWYU9GEVacTlZdhbiM8F4FYO kTGHcZCLoO2BnoiEjtVY9PoQ05yzaVRFVKbdyj5yNjiVu5piwj6VwAqAvnrT/iU14z ovFCHJs05zX1f6DQI1ic67Zpb+D9KoDGQXGOJbW/SsAnUJVXx0VoaJoAgnvWvg7gvh xrPQ4Hwllt9fA== Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When a ZONE_DEVICE private page is freed, the page->mapping field can be set. If this page is reused as an anonymous page, the previous value can prevent the page from being inserted into the CPU's anon rmap table. For example, when migrating a pte_none() page to device memory: migrate_vma(ops, vma, start, end, src, dst, private) migrate_vma_collect() src[] =3D MIGRATE_PFN_MIGRATE migrate_vma_prepare() /* no page to lock or isolate so OK */ migrate_vma_unmap() /* no page to unmap so OK */ ops->alloc_and_copy() /* driver allocates ZONE_DEVICE page for dst[] */ migrate_vma_pages() migrate_vma_insert_page() page_add_new_anon_rmap() __page_set_anon_rmap() /* This check sees the page's stale mapping field */ if (PageAnon(page)) return /* page->mapping is not updated */ The result is that the migration appears to succeed but a subsequent CPU fault will be unable to migrate the page back to system memory or worse. Clear the page->mapping field when freeing the ZONE_DEVICE page so stale pointer data doesn't affect future page use. Fixes: b7a523109fb5c9d2d6dd ("mm: don't clear ->mapping in hmm_devmem_free"= ) Cc: stable@vger.kernel.org Signed-off-by: Ralph Campbell Cc: Christoph Hellwig Cc: Dan Williams Cc: Andrew Morton Cc: Jason Gunthorpe Cc: Logan Gunthorpe Cc: Ira Weiny Cc: Matthew Wilcox Cc: Mel Gorman Cc: Jan Kara Cc: "Kirill A. Shutemov" Cc: Michal Hocko Cc: Andrea Arcangeli Cc: Mike Kravetz Cc: "J=C3=A9r=C3=B4me Glisse" --- kernel/memremap.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/memremap.c b/kernel/memremap.c index bea6f887adad..238ae5d0ae8a 100644 --- a/kernel/memremap.c +++ b/kernel/memremap.c @@ -408,6 +408,10 @@ void __put_devmap_managed_page(struct page *page) =20 mem_cgroup_uncharge(page); =20 + /* Clear anonymous page mapping to prevent stale pointers */ + if (is_device_private_page(page)) + page->mapping =3D NULL; + page->pgmap->ops->page_free(page); } else if (!count) __put_page(page); --=20 2.20.1