Received: by 2002:a05:6a10:2726:0:0:0:0 with SMTP id ib38csp933338pxb; Wed, 6 Apr 2022 04:42:20 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzCZWZhUt79Aj06Eif+RIMhklRsuO4fyoCjejMmBPIDfPp+whr5XMGRPVECXS02PyA59F+F X-Received: by 2002:a05:6a00:130e:b0:4cc:3c7d:4dec with SMTP id j14-20020a056a00130e00b004cc3c7d4decmr8407146pfu.32.1649245340562; Wed, 06 Apr 2022 04:42:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1649245340; cv=none; d=google.com; s=arc-20160816; b=Yko2bmD4NtAnDGOx+Rtm2hqEis9gTxwYWsqvaca9MXE0N9YL/6J51Cdp/SxrVdUoVJ aoFh22ZYCHQfRQ+LdDtAVmfPH4Bmx7iEVSE1usFjWwlng5IF+shMpaY5ACGsU6MhvmIs eSGgD6zFicBQvuQ26knS+/RmFq9uExjqczpupyVnAW0L2p5jY443iZfrLmZQB+FnaRk6 djeadw2f8oxBbJWIsKDRIHAayEhjb2BU2cIqLvXPEHGVM0P/RHq+bNXeMOnqwr2a6czC /79Q1Ce96dp5xdittAwUHGQc5wDQZR3Yc50xPjy+SrTHLoU8PiSXvLpDxCqNij+FeSX3 YeTw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=UhKSUx7NX9nDTvctSg6bHVQIyIEyp0j9l2viM+RiltM=; b=WewlEIlz6otMVoXFRkUvqVwXyKfIDg5HqUO7+4qeg2nNP/rEQU1XIjHEWGPQePkgNG wciZcjr96f7n7/V4/ZrQi3cV7OMbo5xHY5zhlEklO9ujNgPX+fzrsewYRfwH2GMI1IYT Lkt2FBLAhqfT7bMA9SqdjovPeUOr2GpijVtJ1HnYnLv0Fv0rug7MaGpnysTG4Dm+To43 nuBs4/p/wEFDBJjN6KC6YTs28LVJzr9yGlUL/uKVzmJbGvZrXEoj0SzsAv+EVw540ieX uYoJaNCOKDuZsTZAYb99Ed7NqhbT/9IGP0RDvLnKWbZzKzHvEU5UPfeChP7ls48CxDWO SNXg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=pWFpmCXN; spf=softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net. [23.128.96.19]) by mx.google.com with ESMTPS id w9-20020a170902e88900b00153b2d1657fsi16327707plg.391.2022.04.06.04.42.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 06 Apr 2022 04:42:20 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=pWFpmCXN; spf=softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 602261F99DD; Wed, 6 Apr 2022 02:59:30 -0700 (PDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351335AbiDELEa (ORCPT + 99 others); Tue, 5 Apr 2022 07:04:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45558 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237545AbiDEImr (ORCPT ); Tue, 5 Apr 2022 04:42:47 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 816C0E0F6; Tue, 5 Apr 2022 01:35:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 08FCFB81B13; Tue, 5 Apr 2022 08:35:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6DDBBC385A1; Tue, 5 Apr 2022 08:34:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649147699; bh=1DgkdNFO6r6H+hSygsx8JZmtOvDEknQ6vZRdHvFtBQA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pWFpmCXN58YV/PKEeXSIMEc7Hc4gCx2/sjVy0Xa3sR7rRGAo6RSecuz8wgZ0sZG4L IbQC1kOiSz7uo4iq/8Bfn3Dym+iI7CAAF2DiQv/S764UxZs3rXfH68Vf2UDuuM2xKl EYpTWPSGcIHZY9Ys3URg4IOOqnsg0k3GstTciayE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hugh Dickins , Oleg Nesterov , "Liam R. Howlett" , Vlastimil Babka , Andrew Morton , Linus Torvalds Subject: [PATCH 5.16 0090/1017] mempolicy: mbind_range() set_policy() after vma_merge() Date: Tue, 5 Apr 2022 09:16:43 +0200 Message-Id: <20220405070356.865599231@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070354.155796697@linuxfoundation.org> References: <20220405070354.155796697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Hugh Dickins commit 4e0906008cdb56381638aa17d9c32734eae6d37a upstream. v2.6.34 commit 9d8cebd4bcd7 ("mm: fix mbind vma merge problem") introduced vma_merge() to mbind_range(); but unlike madvise, mlock and mprotect, it put a "continue" to next vma where its precedents go to update flags on current vma before advancing: that left vma with the wrong setting in the infamous vma_merge() case 8. v3.10 commit 1444f92c8498 ("mm: merging memory blocks resets mempolicy") tried to fix that in vma_adjust(), without fully understanding the issue. v3.11 commit 3964acd0dbec ("mm: mempolicy: fix mbind_range() && vma_adjust() interaction") reverted that, and went about the fix in the right way, but chose to optimize out an unnecessary mpol_dup() with a prior mpol_equal() test. But on tmpfs, that also pessimized out the vital call to its ->set_policy(), leaving the new mbind unenforced. The user visible effect was that the pages got allocated on the local node (happened to be 0), after the mbind() caller had specifically asked for them to be allocated on node 1. There was not any page migration involved in the case reported: the pages simply got allocated on the wrong node. Just delete that optimization now (though it could be made conditional on vma not having a set_policy). Also remove the "next" variable: it turned out to be blameless, but also pointless. Link: https://lkml.kernel.org/r/319e4db9-64ae-4bca-92f0-ade85d342ff@google.com Fixes: 3964acd0dbec ("mm: mempolicy: fix mbind_range() && vma_adjust() interaction") Signed-off-by: Hugh Dickins Acked-by: Oleg Nesterov Reviewed-by: Liam R. Howlett Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/mempolicy.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -783,7 +783,6 @@ static int vma_replace_policy(struct vm_ static int mbind_range(struct mm_struct *mm, unsigned long start, unsigned long end, struct mempolicy *new_pol) { - struct vm_area_struct *next; struct vm_area_struct *prev; struct vm_area_struct *vma; int err = 0; @@ -798,8 +797,7 @@ static int mbind_range(struct mm_struct if (start > vma->vm_start) prev = vma; - for (; vma && vma->vm_start < end; prev = vma, vma = next) { - next = vma->vm_next; + for (; vma && vma->vm_start < end; prev = vma, vma = vma->vm_next) { vmstart = max(start, vma->vm_start); vmend = min(end, vma->vm_end); @@ -813,10 +811,6 @@ static int mbind_range(struct mm_struct new_pol, vma->vm_userfaultfd_ctx); if (prev) { vma = prev; - next = vma->vm_next; - if (mpol_equal(vma_policy(vma), new_pol)) - continue; - /* vma_merge() joined vma && vma->next, case 8 */ goto replace; } if (vma->vm_start != vmstart) {