Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates
 216.228.112.34 as permitted sender) receiver=protection.outlook.com;
 client-ip=216.228.112.34; helo=mail.nvidia.com;
From:   Alistair Popple <apopple@nvidia.com>
To:     Hugh Dickins <hughd@google.com>
CC:     Andrew Morton <akpm@linux-foundation.org>,
        Jason Gunthorpe <jgg@nvidia.com>,
        Ralph Campbell <rcampbell@nvidia.com>,
        Christoph Hellwig <hch@lst.de>, Yang Shi <shy828301@gmail.com>,
        "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
        Shakeel Butt <shakeelb@google.com>,
        <linux-kernel@vger.kernel.org>, <linux-mm@kvack.org>
Subject: Re: [PATCH 3/4] mm/rmap: fix new bug: premature return from page_mlock_one()
Date:   Thu, 8 Jul 2021 09:14:03 +1000
Message-ID: <5771626.u1GIez9f9F@nvdebian>
In-Reply-To: <f71f8523-cba7-3342-40a7-114abc5d1f51@google.com>
References: <563ce5b2-7a44-5b4d-1dfd-59a0e65932a9@google.com> <f71f8523-cba7-3342-40a7-114abc5d1f51@google.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Jul 2021 23:14:07.8708
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 738e14d1-5cea-4225-94ec-08d9419cebfc
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.112.34];Helo=[mail.nvidia.com]
X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT030.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR12MB1433
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Thanks Hugh, evidently I missed this when re-adding the VM_LOCKED check
back.

Reviewed-by: Alistair Popple <apopple@nvidia.com>

On Thursday, 8 July 2021 6:11:24 AM AEST Hugh Dickins wrote:
> In the unlikely race case that page_mlock_one() finds VM_LOCKED has been
> cleared by the time it got page table lock, page_vma_mapped_walk_done()
> must be called before returning, either explicitly, or by a final call
> to page_vma_mapped_walk() - otherwise the page table remains locked.
> 
> Fixes: cd62734ca60d ("mm/rmap: split try_to_munlock from try_to_unmap")
> Signed-off-by: Hugh Dickins <hughd@google.com>
> ---
>  mm/rmap.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
> 
> diff --git a/mm/rmap.c b/mm/rmap.c
> index 0e83c3be8568..1235368f0628 100644
> --- a/mm/rmap.c
> +++ b/mm/rmap.c
> @@ -1990,14 +1990,13 @@ static bool page_mlock_one(struct page *page, struct vm_area_struct *vma,
>  			 * this function is never called when PageDoubleMap().
>  			 */
>  			mlock_vma_page(page);
> +			/*
> +			 * No need to scan further once the page is marked
> +			 * as mlocked.
> +			 */
>  			page_vma_mapped_walk_done(&pvmw);
> +			return false;
>  		}
> -
> -		/*
> -		 * no need to continue scanning other vma's if the page has
> -		 * been locked.
> -		 */
> -		return false;
>  	}
>  
>  	return true;
>