hugetlbfs: flush TLBs correctly after huge_pmd_unshare
authorNadav Amit <namit@vmware.com>
Sun, 21 Nov 2021 20:40:07 +0000 (12:40 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 8 Dec 2021 07:46:52 +0000 (08:46 +0100)
commit a4a118f2eead1d6c49e00765de89878288d4b890 upstream.

When __unmap_hugepage_range() calls to huge_pmd_unshare() succeed, a TLB
flush is missing.  This TLB flush must be performed before releasing the
i_mmap_rwsem, in order to prevent an unshared PMDs page from being
released and reused before the TLB flush took place.

Arguably, a comprehensive solution would use mmu_gather interface to
batch the TLB flushes and the PMDs page release, however it is not an
easy solution: (1) try_to_unmap_one() and try_to_migrate_one() also call
huge_pmd_unshare() and they cannot use the mmu_gather interface; and (2)
deferring the release of the page reference for the PMDs page until
after i_mmap_rwsem is dropeed can confuse huge_pmd_unshare() into
thinking PMDs are shared when they are not.

Fix __unmap_hugepage_range() by adding the missing TLB flush, and
forcing a flush when unshare is successful.

Fixes: 24669e58477e ("hugetlb: use mmu_gather instead of a temporary linked list for accumulating pages)" # 3.6
Signed-off-by: Nadav Amit <namit@vmware.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
arch/arm/include/asm/tlb.h
arch/ia64/include/asm/tlb.h
arch/s390/include/asm/tlb.h
arch/sh/include/asm/tlb.h
arch/um/include/asm/tlb.h
include/asm-generic/tlb.h
mm/hugetlb.c
mm/memory.c

index d5562f9ce60079139d360e5d6afac59469051454..fd9717e9fee3e00265bd18b9c77a46458a8d20f5 100644 (file)
@@ -280,6 +280,14 @@ tlb_remove_pmd_tlb_entry(struct mmu_gather *tlb, pmd_t *pmdp, unsigned long addr
        tlb_add_flush(tlb, addr);
 }
 
+static inline void
+tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address,
+                   unsigned long size)
+{
+       tlb_add_flush(tlb, address);
+       tlb_add_flush(tlb, address + size - PMD_SIZE);
+}
+
 #define pte_free_tlb(tlb, ptep, addr)  __pte_free_tlb(tlb, ptep, addr)
 #define pmd_free_tlb(tlb, pmdp, addr)  __pmd_free_tlb(tlb, pmdp, addr)
 #define pud_free_tlb(tlb, pudp, addr)  pud_free((tlb)->mm, pudp)
index 44f0ac0df30823d49807d91c4234c6556d0a885b..26d49489498b8d7ada9879906d47a9a57b2d0bd3 100644 (file)
@@ -269,6 +269,16 @@ __tlb_remove_tlb_entry (struct mmu_gather *tlb, pte_t *ptep, unsigned long addre
        tlb->end_addr = address + PAGE_SIZE;
 }
 
+static inline void
+tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address,
+                   unsigned long size)
+{
+       if (tlb->start_addr > address)
+               tlb->start_addr = address;
+       if (tlb->end_addr < address + size)
+               tlb->end_addr = address + size;
+}
+
 #define tlb_migrate_finish(mm) platform_tlb_migrate_finish(mm)
 
 #define tlb_start_vma(tlb, vma)                        do { } while (0)
index 457b7ba0fbb66de24fd82219e18a51ad2663221f..c216a24ddff871065c6f138a704179bbabc99259 100644 (file)
@@ -116,6 +116,20 @@ static inline void tlb_remove_page_size(struct mmu_gather *tlb,
        return tlb_remove_page(tlb, page);
 }
 
+static inline void tlb_flush_pmd_range(struct mmu_gather *tlb,
+                               unsigned long address, unsigned long size)
+{
+       /*
+        * the range might exceed the original range that was provided to
+        * tlb_gather_mmu(), so we need to update it despite the fact it is
+        * usually not updated.
+        */
+       if (tlb->start > address)
+               tlb->start = address;
+       if (tlb->end < address + size)
+               tlb->end = address + size;
+}
+
 /*
  * pte_free_tlb frees a pte table and clears the CRSTE for the
  * page table from the tlb.
index 77abe192fb43d90cd6d56bfe878b54126188ac34..adcb0bfe238e3a202e64c5e1d10926928d9e96c3 100644 (file)
@@ -127,6 +127,16 @@ static inline void tlb_remove_page_size(struct mmu_gather *tlb,
        return tlb_remove_page(tlb, page);
 }
 
+static inline void
+tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address,
+                   unsigned long size)
+{
+       if (tlb->start > address)
+               tlb->start = address;
+       if (tlb->end < address + size)
+               tlb->end = address + size;
+}
+
 #define tlb_remove_check_page_size_change tlb_remove_check_page_size_change
 static inline void tlb_remove_check_page_size_change(struct mmu_gather *tlb,
                                                     unsigned int page_size)
index dce6db147f24563eb14310aaabf76cada9a878bb..02e61f6abfcab3ae39ab65a6c2a4fd2e3f8265be 100644 (file)
@@ -130,6 +130,18 @@ static inline void tlb_remove_page_size(struct mmu_gather *tlb,
        return tlb_remove_page(tlb, page);
 }
 
+static inline void
+tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address,
+                   unsigned long size)
+{
+       tlb->need_flush = 1;
+
+       if (tlb->start > address)
+               tlb->start = address;
+       if (tlb->end < address + size)
+               tlb->end = address + size;
+}
+
 /**
  * tlb_remove_tlb_entry - remember a pte unmapping for later tlb invalidation.
  *
index faddde44de8c902e6884e64eeb8b22bd0d11b75a..5e7e4aaf36c52450d8afd32bfc210109045a7b7c 100644 (file)
@@ -117,6 +117,8 @@ void arch_tlb_gather_mmu(struct mmu_gather *tlb,
 void tlb_flush_mmu(struct mmu_gather *tlb);
 void arch_tlb_finish_mmu(struct mmu_gather *tlb,
                         unsigned long start, unsigned long end, bool force);
+void tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address,
+                        unsigned long size);
 extern bool __tlb_remove_page_size(struct mmu_gather *tlb, struct page *page,
                                   int page_size);
 
index c765fd01f0aa4d35920c10fe57ea3379ba5cee43..515ba949c06a1851a056f25c6f6f8e93da44b761 100644 (file)
@@ -3386,6 +3386,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
        unsigned long sz = huge_page_size(h);
        const unsigned long mmun_start = start; /* For mmu_notifiers */
        const unsigned long mmun_end   = end;   /* For mmu_notifiers */
+       bool force_flush = false;
 
        WARN_ON(!is_vm_hugetlb_page(vma));
        BUG_ON(start & ~huge_page_mask(h));
@@ -3407,6 +3408,8 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
                ptl = huge_pte_lock(h, mm, ptep);
                if (huge_pmd_unshare(mm, &address, ptep)) {
                        spin_unlock(ptl);
+                       tlb_flush_pmd_range(tlb, address & PUD_MASK, PUD_SIZE);
+                       force_flush = true;
                        continue;
                }
 
@@ -3463,6 +3466,22 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
        }
        mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
        tlb_end_vma(tlb, vma);
+
+       /*
+        * If we unshared PMDs, the TLB flush was not recorded in mmu_gather. We
+        * could defer the flush until now, since by holding i_mmap_rwsem we
+        * guaranteed that the last refernece would not be dropped. But we must
+        * do the flushing before we return, as otherwise i_mmap_rwsem will be
+        * dropped and the last reference to the shared PMDs page might be
+        * dropped as well.
+        *
+        * In theory we could defer the freeing of the PMD pages as well, but
+        * huge_pmd_unshare() relies on the exact page_count for the PMD page to
+        * detect sharing, so we cannot defer the release of the page either.
+        * Instead, do flush now.
+        */
+       if (force_flush)
+               tlb_flush_mmu(tlb);
 }
 
 void __unmap_hugepage_range_final(struct mmu_gather *tlb,
index c4f142d1ff98f4a13f3a0f29d626dc5e9e95a95b..b001670c9615f9a98dd0eef469aa54e7a2009a30 100644 (file)
@@ -335,6 +335,16 @@ bool __tlb_remove_page_size(struct mmu_gather *tlb, struct page *page, int page_
        return false;
 }
 
+void tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address,
+                        unsigned long size)
+{
+       if (tlb->page_size != 0 && tlb->page_size != PMD_SIZE)
+               tlb_flush_mmu(tlb);
+
+       tlb->page_size = PMD_SIZE;
+       tlb->start = min(tlb->start, address);
+       tlb->end = max(tlb->end, address + size);
+}
 #endif /* HAVE_GENERIC_MMU_GATHER */
 
 #ifdef CONFIG_HAVE_RCU_TABLE_FREE