Messages in this thread | | | Date | Fri, 2 Sep 2022 16:35:47 -0400 | From | Peter Xu <> | Subject | Re: [PATCH v4 1/4] mm/migrate_device.c: Flush TLB while holding PTL |
| |
On Fri, Sep 02, 2022 at 10:35:51AM +1000, Alistair Popple wrote: > When clearing a PTE the TLB should be flushed whilst still holding the > PTL to avoid a potential race with madvise/munmap/etc. For example > consider the following sequence: > > CPU0 CPU1 > ---- ---- > > migrate_vma_collect_pmd() > pte_unmap_unlock() > madvise(MADV_DONTNEED) > -> zap_pte_range() > pte_offset_map_lock() > [ PTE not present, TLB not flushed ] > pte_unmap_unlock() > [ page is still accessible via stale TLB ] > flush_tlb_range() > > In this case the page may still be accessed via the stale TLB entry > after madvise returns. Fix this by flushing the TLB while holding the > PTL. > > Signed-off-by: Alistair Popple <apopple@nvidia.com> > Reported-by: Nadav Amit <nadav.amit@gmail.com> > Reviewed-by: "Huang, Ying" <ying.huang@intel.com> > Fixes: 8c3328f1f36a ("mm/migrate: migrate_vma() unmap page from vma while collecting pages") > Cc: stable@vger.kernel.org
Acked-by: Peter Xu <peterx@redhat.com>
-- Peter Xu
| |