Vlastimil noted that pmdp_invalidate() is not atomic and we can loose dirty and access bits if CPU sets them after pmdp dereference, but before set_pmd_at().
The patch change pmdp_invalidate() to make the entry non-present atomically and return previous value of the entry. This value can be used to check if CPU set dirty/accessed bits under us. The race window is very small and I haven't seen any reports that can be attributed to the bug. For this reason, I don't think backporting to stable trees needed. Signed-off-by: Kirill A. Shutemov <[email protected]> Reported-by: Vlastimil Babka <[email protected]> Cc: Hugh Dickins <[email protected]> --- include/asm-generic/pgtable.h | 2 +- mm/pgtable-generic.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h index bf0889eb774d..9df1da175fb0 100644 --- a/include/asm-generic/pgtable.h +++ b/include/asm-generic/pgtable.h @@ -324,7 +324,7 @@ static inline pmd_t generic_pmdp_establish(struct vm_area_struct *vma, #endif #ifndef __HAVE_ARCH_PMDP_INVALIDATE -extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, +extern pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, pmd_t *pmdp); #endif diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c index 1175f6a24fdb..3db8f2f76666 100644 --- a/mm/pgtable-generic.c +++ b/mm/pgtable-generic.c @@ -180,12 +180,12 @@ pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp) #endif #ifndef __HAVE_ARCH_PMDP_INVALIDATE -void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, +pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, pmd_t *pmdp) { - pmd_t entry = *pmdp; - set_pmd_at(vma->vm_mm, address, pmdp, pmd_mknotpresent(entry)); + pmd_t old = pmdp_establish(vma, address, pmdp, pmd_mknotpresent(*pmdp)); flush_pmd_tlb_range(vma, address, address + HPAGE_PMD_SIZE); + return old; } #endif -- 2.14.1
