[lkml]   [2018]   [Apr]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH -mm] mm, gup: prevent pmd checking race in follow_pmd_mask()
On 5 Apr 2018, at 21:57, huang ying wrote:

> On Wed, Apr 4, 2018 at 11:02 PM, Zi Yan <> wrote:
>> On 3 Apr 2018, at 23:22, Huang, Ying wrote:
>>> From: Huang Ying <>
>>> mmap_sem will be read locked when calling follow_pmd_mask(). But this
>>> cannot prevent PMD from being changed for all cases when PTL is
>>> unlocked, for example, from pmd_trans_huge() to pmd_none() via
>>> MADV_DONTNEED. So it is possible for the pmd_present() check in
>>> follow_pmd_mask() encounter a none PMD. This may cause incorrect
>>> VM_BUG_ON() or infinite loop. Fixed this via reading PMD entry again
>>> but only once and checking the local variable and pmd_none() in the
>>> retry loop.
>>> As Kirill pointed out, with PTL unlocked, the *pmd may be changed
>>> under us, so read it directly again and again may incur weird bugs.
>>> So although using *pmd directly other than pmd_present() checking may
>>> be safe, it is still better to replace them to read *pmd once and
>>> check the local variable for multiple times.
>> I see you point there. The patch wants to provide a consistent value
>> for all race checks. Specifically, this patch is trying to avoid the inconsistent
>> reads of *pmd for if-statements, which causes problem when both if-condition reads *pmd and
>> the statements inside "if" reads *pmd again and two reads can give different values.
>> Am I right about this?
> Yes.
>> If yes, the problem can be solved by something like:
>> if (!pmd_present(tmpval = *pmd)) {
>> check tmpval instead of *pmd;
>> }
>> Right?
> I think this isn't enough yet. we need
> tmpval = READ_ONCE(*pmd);
> To prevent compiler to generate code to read *pmd again and again.
> Please check the comments of pmd_none_or_trans_huge_or_clear_bad()
> about barrier.

Got it. And if there is a barrier (implicit or explicit) inside if-statement, like
pmd_migrationt_entry_wait(mm, pmd), we need to update tmpval with READ_ONCE() after the barrier.

The patch looks good to me. Thanks.

Reviewed-by: Zi Yan <>

Best Regards,
Yan Zi
[unhandled content-type:application/pgp-signature]
 \ /
  Last update: 2018-04-06 04:17    [W:0.064 / U:6.188 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site