On Tue, Mar 27, 2018 at 03:17:00PM -0500, Dan Rue wrote: > On Tue, Mar 27, 2018 at 06:27:24PM +0200, Greg Kroah-Hartman wrote: > > 4.4-stable review patch. If anyone has any objections, please let me know. > > > > ------------------ > > > > From: Toshi Kani <[email protected]> > > > > commit b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e upstream. > > > > On architectures with CONFIG_HAVE_ARCH_HUGE_VMAP set, ioremap() may > > create pud/pmd mappings. A kernel panic was observed on arm64 systems > > with Cortex-A75 in the following steps as described by Hanjun Guo. > > > > 1. ioremap a 4K size, valid page table will build, > > 2. iounmap it, pte0 will set to 0; > > 3. ioremap the same address with 2M size, pgd/pmd is unchanged, > > then set the a new value for pmd; > > 4. pte0 is leaked; > > 5. CPU may meet exception because the old pmd is still in TLB, > > which will lead to kernel panic. > > > > This panic is not reproducible on x86. INVLPG, called from iounmap, > > purges all levels of entries associated with purged address on x86. x86 > > still has memory leak. > > > > The patch changes the ioremap path to free unmapped page table(s) since > > doing so in the unmap path has the following issues: > > > > - The iounmap() path is shared with vunmap(). Since vmap() only > > supports pte mappings, making vunmap() to free a pte page is an > > overhead for regular vmap users as they do not need a pte page freed > > up. > > > > - Checking if all entries in a pte page are cleared in the unmap path > > is racy, and serializing this check is expensive. > > > > - The unmap path calls free_vmap_area_noflush() to do lazy TLB purges. > > Clearing a pud/pmd entry before the lazy TLB purges needs extra TLB > > purge. > > > > Add two interfaces, pud_free_pmd_page() and pmd_free_pte_page(), which > > clear a given pud/pmd entry and free up a page for the lower level > > entries. > > > > This patch implements their stub functions on x86 and arm64, which work > > as workaround. > > > > [[email protected]: fix typo in pmd_free_pte_page() stub] > > Link: http://lkml.kernel.org/r/[email protected] > > Fixes: e61ce6ade404e ("mm: change ioremap to set up huge I/O mappings") > > Reported-by: Lei Li <[email protected]> > > Signed-off-by: Toshi Kani <[email protected]> > > Cc: Catalin Marinas <[email protected]> > > Cc: Wang Xuefeng <[email protected]> > > Cc: Will Deacon <[email protected]> > > Cc: Hanjun Guo <[email protected]> > > Cc: Michal Hocko <[email protected]> > > Cc: Thomas Gleixner <[email protected]> > > Cc: Ingo Molnar <[email protected]> > > Cc: "H. Peter Anvin" <[email protected]> > > Cc: Borislav Petkov <[email protected]> > > Cc: Matthew Wilcox <[email protected]> > > Cc: Chintan Pandya <[email protected]> > > Cc: <[email protected]> > > Signed-off-by: Andrew Morton <[email protected]> > > Signed-off-by: Linus Torvalds <[email protected]> > > Signed-off-by: Greg Kroah-Hartman <[email protected]> > > This patch causes the following build error on 4.4 arm64: > > $ make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=build-arm64 defconfig > $ make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- O=build-arm64 > > CC arch/arm64/mm/mmu.o > ../arch/arm64/mm/mmu.c:701:5: error: redefinition of ‘pud_free_pmd_page’ > int pud_free_pmd_page(pud_t *pud) > ^~~~~~~~~~~~~~~~~ > In file included from ../arch/arm64/include/asm/pgtable.h:682:0, > from ../include/linux/mm.h:55, > from ../include/linux/mman.h:4, > from ../arch/arm64/mm/mmu.c:25: > ../include/asm-generic/pgtable.h:777:19: note: previous definition of > ‘pud_free_pmd_page’ was here > static inline int pud_free_pmd_page(pud_t *pud) > ^~~~~~~~~~~~~~~~~ > ../arch/arm64/mm/mmu.c:706:5: error: redefinition of ‘pmd_free_pte_page’ > int pmd_free_pte_page(pmd_t *pmd) > ^~~~~~~~~~~~~~~~~ > In file included from ../arch/arm64/include/asm/pgtable.h:682:0, > from ../include/linux/mm.h:55, > from ../include/linux/mman.h:4, > from ../arch/arm64/mm/mmu.c:25: > ../include/asm-generic/pgtable.h:781:19: note: previous definition of > ‘pmd_free_pte_page’ was here > static inline int pmd_free_pte_page(pmd_t *pmd) > ^~~~~~~~~~~~~~~~~ > make[2]: *** [../scripts/Makefile.build:270: arch/arm64/mm/mmu.o] Error 1 > make[1]: *** [/home/drue/src/linux/4.4-rc/Makefile:969: arch/arm64/mm] Error 2 > make[1]: Leaving directory '/home/drue/src/linux/4.4-rc/build-arm64' > make: *** [Makefile:152: sub-make] Error 2 > >
Both of my arm64 devices built fine with this patch... It seems like the only way to hit that error is if HAVE_ARCH_HUGE_VMAP isn't set, which seems impossible since it is selected by ARM64... Someone smarter than I might have more insight but this patch is unchanged from upstream so I can only assume that this error would manifest there as well. Cheers! Nathan
