Hugh Dickins 42ebe63448 khugepaged: retract_page_tables() remember to test exit ... commit 18e77600f7a1ed69f8ce46c9e11cad0985712dfa upstream. Only once have I seen this scenario (and forgot even to notice what forced the eventual crash): a sequence of "BUG: Bad page map" alerts from vm_normal_page(), from zap_pte_range() servicing exit_mmap(); pmd:00000000, pte values corresponding to data in physical page 0. The pte mappings being zapped in this case were supposed to be from a huge page of ext4 text (but could as well have been shmem): my belief is that it was racing with collapse_file()'s retract_page_tables(), found *pmd pointing to a page table, locked it, but *pmd had become 0 by the time start_pte was decided. In most cases, that possibility is excluded by holding mmap lock; but exit_mmap() proceeds without mmap lock. Most of what's run by khugepaged checks khugepaged_test_exit() after acquiring mmap lock: khugepaged_collapse_pte_mapped_thps() and hugepage_vma_revalidate() do so, for example. But retract_page_tables() did not: fix that. The fix is for retract_page_tables() to check khugepaged_test_exit(), after acquiring mmap lock, before doing anything to the page table. Getting the mmap lock serializes with __mmput(), which briefly takes and drops it in __khugepaged_exit(); then the khugepaged_test_exit() check on mm_users makes sure we don't touch the page table once exit_mmap() might reach it, since exit_mmap() will be proceeding without mmap lock, not expecting anyone to be racing with it. Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Hugh Dickins <hughd@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Mike Kravetz <mike.kravetz@oracle.com> Cc: Song Liu <songliubraving@fb.com> Cc: <stable@vger.kernel.org> [4.8+] Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2008021215400.27773@eggly.anvils Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-03-16 16:34:23 +08:00
..
kasan	kasan: disable branch tracing for core runtime	2021-03-16 16:28:20 +08:00
Kconfig	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
Kconfig.debug	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
Makefile	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
backing-dev.c	bdi: add a ->dev_name field to struct backing_dev_info	2021-03-16 16:27:44 +08:00
balloon_compaction.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
cleancache.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
cma.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
cma.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
cma_debug.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
compaction.c	mm, compaction: make capture control handling safe wrt interrupts	2021-03-16 16:31:23 +08:00
debug.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
debug_page_ref.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
dmapool.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
early_ioremap.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
fadvise.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
failslab.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
filemap.c	mm/filemap.c: don't bother dropping mmap_sem for zero size readahead	2021-03-16 16:32:44 +08:00
frame_vector.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
frontswap.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
gup.c	gup: document and work around "COW can break either way" issue	2021-03-16 16:29:05 +08:00
gup_benchmark.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
highmem.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
hmm.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
huge_memory.c	mm: thp: make the THP mapcount atomic against __split_huge_pmd_locked()	2021-03-16 16:29:40 +08:00
hugetlb.c	mm/hugetlb: fix a addressing exception caused by huge_pte_offset	2021-03-16 16:26:56 +08:00
hugetlb_cgroup.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
hwpoison-inject.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
init-mm.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
internal.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
interval_tree.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
khugepaged.c	khugepaged: retract_page_tables() remember to test exit	2021-03-16 16:34:23 +08:00
kmemleak-test.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
kmemleak.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
ksm.c	mm/ksm: fix NULL pointer dereference when KSM zero page is enabled	2021-03-16 16:26:56 +08:00
list_lru.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
maccess.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
madvise.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
memblock.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
memcontrol.c	mm/memcg: fix refcount error while moving and swapping	2021-03-16 16:32:37 +08:00
memfd.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
memory-failure.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
memory.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
memory_hotplug.c	mm/memory_hotplug: fix unpaired mem_hotplug_begin/done	2021-03-16 16:34:07 +08:00
mempolicy.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
mempool.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
memremap.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
memtest.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
migrate.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
mincore.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
mlock.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
mm_init.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
mmap.c	mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls	2021-03-16 16:33:23 +08:00
mmu_context.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
mmu_gather.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
mmu_notifier.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
mmzone.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
mprotect.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
mremap.c	mm: Fix mremap not considering huge pmd devmap	2021-03-16 16:28:43 +08:00
msync.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
nommu.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
oom_kill.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
page-writeback.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
page_alloc.c	mm: call cond_resched() from deferred_init_memmap()	2021-03-16 16:29:40 +08:00
page_counter.c	mm/page_counter.c: fix protection usage propagation	2021-03-16 16:34:07 +08:00
page_ext.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
page_idle.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
page_io.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
page_isolation.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
page_owner.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
page_poison.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
page_vma_mapped.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
pagewalk.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
percpu-internal.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
percpu-km.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
percpu-stats.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
percpu-vm.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
percpu.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
pgtable-generic.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
process_vm_access.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
readahead.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
rmap.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
rodata_test.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
shmem.c	shmem: fix possible deadlocks on shmlock_user_lock	2021-03-16 16:27:44 +08:00
shuffle.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
shuffle.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
slab.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
slab.h	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
slab_common.c	mm: memcg/slab: fix memory leak at non-root kmem_cache destroy	2021-03-16 16:32:38 +08:00
slob.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
slub.c	mm/slub: fix stack overruns with SLUB_STATS	2021-03-16 16:31:14 +08:00
sparse-vmemmap.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
sparse.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
swap.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
swap_cgroup.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
swap_slots.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
swap_state.c	mm: fix swap cache node allocation mask	2021-03-16 16:31:13 +08:00
swapfile.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
truncate.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
usercopy.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
userfaultfd.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
util.c	mm: add kvfree_sensitive() for freeing sensitive data objects	2021-03-16 16:28:58 +08:00
vmacache.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
vmalloc.c	vmalloc: fix remap_vmalloc_range() bounds checks	2021-03-16 16:26:56 +08:00
vmpressure.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
vmscan.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
vmstat.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
workingset.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
z3fold.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
zbud.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
zpool.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
zsmalloc.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00
zswap.c	Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces.	2021-03-16 11:01:34 +08:00