Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Sven Schnelle <svens@linux.ibm.com>
To:     Ryan Roberts <ryan.roberts@arm.com>
Cc:     David Hildenbrand <david@redhat.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        Matthew Wilcox <willy@infradead.org>,
        Yin Fengwei <fengwei.yin@intel.com>,
        Yu Zhao <yuzhao@google.com>, Yang Shi <shy828301@gmail.com>,
        "Huang, Ying" <ying.huang@intel.com>, Zi Yan <ziy@nvidia.com>,
        Nathan Chancellor <nathan@kernel.org>,
        linux-kernel@vger.kernel.org, linux-mm@kvack.org,
        linux-s390@vger.kernel.org
Subject: Re: [PATCH v1] mm: Fix use-after-free for MMU_GATHER_NO_GATHER
References: <20230727110224.3333682-1-ryan.roberts@arm.com>
        <b3e305e9-26c3-d4f4-d0ce-79d79d98afe2@redhat.com>
Date:   Thu, 27 Jul 2023 13:35:50 +0200
In-Reply-To: <b3e305e9-26c3-d4f4-d0ce-79d79d98afe2@redhat.com> (David
        Hildenbrand's message of "Thu, 27 Jul 2023 13:15:27 +0200")
Message-ID: <yt9dcz0dbn8p.fsf@linux.ibm.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.0.50 (gnu/linux)
Content-Type: text/plain
MIME-Version: 1.0
Precedence: bulk

Ryan,

David Hildenbrand <david@redhat.com> writes:

> On 27.07.23 13:02, Ryan Roberts wrote:
>> The recent change to batch-zap anonymous ptes did not take into account
>> that for platforms where MMU_GATHER_NO_GATHER is enabled (e.g. s390),
>> __tlb_remove_page() drops a reference to the page. This means that the
>> folio reference count can drop to zero while still in use (i.e. before
>> folio_remove_rmap_range() is called). This does not happen on other
>> platforms because the actual page freeing is deferred.
>> Solve this by appropriately getting/putting the folio to guarrantee
>> it
>> does not get freed early.
>> Given the new need to get/put the folio in the batch path, let's
>> stick
>> to the non-batched path if the folio is not large. In this case batching
>> is not helpful since the batch size is 1.
>> Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
>> Fixes: 904d9713b3b0 ("mm: batch-zap large anonymous folio PTE mappings")
>> Reported-by: Nathan Chancellor <nathan@kernel.org>
>> Link: https://lore.kernel.org/linux-mm/20230726161942.GA1123863@dev-arch.thelio-3990X/
>> ---
>> Hi Andrew,
>> This fixes patch 3 in the series at [1], which is currently in
>> mm-unstable. I'm
>> not sure whether you want to take the fix or whether I should re-post the entire
>> series?
>> 
>
> Please repost the complete thing, you're touching some sensible places
> that really need decent review.

Please also add:

Alexander Gordeev <agordeev@linux.ibm.com>
Gerald Schaefer <gerald.schaefer@linux.ibm.com>

when reposting. Thanks!