Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Peter Xu <peterx@redhat.com>
To:     stable@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-mm@kvack.org
Cc:     Igor Raits <igor@gooddata.com>, peterx@redhat.com,
        Hillf Danton <hdanton@sina.com>,
        Axel Rasmussen <axelrasmussen@google.com>,
        Hugh Dickins <hughd@google.com>,
        Andrew Morton <akpm@linux-foundation.org>
Subject: [PATCH stable 5.10.y 0/2] mm/thp: Fix uffd-wp with fork(); crash on pmd migration entry on fork
Date:   Tue, 20 Jul 2021 11:56:55 -0400
Message-Id: <20210720155657.499127-1-peterx@redhat.com>
In-Reply-To: <796cbb7-5a1c-1ba0-dde5-479aba8224f2@google.com>
References: <796cbb7-5a1c-1ba0-dde5-479aba8224f2@google.com>
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

In summary, this series should be needed for 5.10/5.12/5.13. This is the 5.=
10.y=0D
backport of the series.  Patch 1 is a dependency of patch 2, while patch 2=
=0D
should be the real fix.=0D
=0D
There's a minor conflict on patch 2 when cherry pick due to not having the =
new=0D
helper called page_needs_cow_for_dma().  It's also mentioned at the entry o=
f=0D
patch 2.=0D
=0D
This series should be able to fix a rare race that mentioned in thread:=0D
=0D
https://lore.kernel.org/linux-mm/796cbb7-5a1c-1ba0-dde5-479aba8224f2@google=
.com/=0D
=0D
This fact wasn't discovered when the fix got proposed and merged, because t=
he=0D
fix was originally about uffd-wp and its fork event.  However it turns out =
that=0D
the problematic commit b569a1760782f3d is also causing crashing on fork() o=
f=0D
pmd migration entries which is even more severe than the original uffd-wp=0D
problem.=0D
=0D
Stable kernels at least on 5.12.y has the crash reproduced, and it's possib=
le=0D
5.13.y and 5.10.y could hit it due to having the problematic commit=0D
b569a1760782f3d but lacking of the uffd-wp fix patch (8f34f1eac382, which i=
s=0D
also patch 2 of this series).=0D
=0D
The pmd entry crash problem was reported by Igor Raits <igor@gooddata.com> =
and=0D
debugged by Hugh Dickins <hughd@google.com>.=0D
=0D
Please review, thanks.=0D
=0D
Peter Xu (2):=0D
  mm/thp: simplify copying of huge zero page pmd when fork=0D
  mm/userfaultfd: fix uffd-wp special cases for fork()=0D
=0D
 include/linux/huge_mm.h |  2 +-=0D
 include/linux/swapops.h |  2 ++=0D
 mm/huge_memory.c        | 36 +++++++++++++++++-------------------=0D
 mm/memory.c             | 25 +++++++++++++------------=0D
 4 files changed, 33 insertions(+), 32 deletions(-)=0D
=0D
-- =0D
2.31.1=0D
=0D