From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 3830B8125B for ; Wed, 4 Nov 2026 18:07:06 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A4I5pQr025790; Wed, 4 Nov 2026 21:05:52 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A4I5pQr025790 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="q4HLWSDw" Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A4I5kgA025773 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 4 Nov 2026 21:05:46 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A4I5kgA025773 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-48e0389d6f9so703253f8f.1 for ; Wed, 04 Nov 2026 10:05:46 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBxQN1/OVU2OaoVw7AN5TtV8qJH5gcoWODgCPLKgd1TwfrJOwXrsQehaNDhtDGi7llQ0oCS4xQ==@openvz.org X-Gm-Message-State: APuU4Z83lEhMBW+NaKYXMZJodnGsblPne21oPOTMYcnVvY0gk7p3aXuE x6Ta7XvgovOpXmKiKmw8vVz/hF9Qgj2J3nuRW2saNaL5cnI0EMb9SbDcCFyq5N3JUcetjSAjsfz cChytO7UjQsP3hdojfKCVTg/4JD7DMyQxtm31nlQt4Qn55MDATV9Emg== X-Gm-Gg: AYBFou3wDX+TSXWLnrwCIJ+ZB6olvAhKV7+idDgF4QNnMPZkyJcBMfkXAvtl9u9Wrbb CmoxKLSLhlb4ctk2U/X3TtrY0YdyDVSGud/bBBigkACngPtLm26QbV8dyUVvS5DD/LoDgJ1PLcl YrO/FLQxq1HsKERta6BRB3Lx0Q8eQhIQUcFzBD2Ik7pk+ukartZqU0vExqACkAOZNcukFApxUbz Kg6dZaAZycfESq92Lj0rqlz/rlpBO8owlNiEXo42GqjC77z9GuRTRQq40IcnXuaZq5KncjXaXnI 7rFYMlZVnX6abb5yVbMdHd1MxUwsJ5QM+lzcVe8xHq5oKzNQs10MnQUfwp8+UrMCiahMKPZmEf9 HjwQu39fmupiwmcZ4 X-Received: by 2002:a5d:5e92:0:b0:491:286f:8e56 with SMTP id ffacd0b85a97d-491286f912fmr88781f8f.33.1793815546407; Wed, 04 Nov 2026 10:05:46 -0800 (PST) X-Received: by 2002:a5d:5e92:0:b0:491:286f:8e56 with SMTP id ffacd0b85a97d-491286f912fmr88746f8f.33.1793815545893; Wed, 04 Nov 2026 10:05:45 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793815545; cv=none; d=google.com; s=arc-20260327; b=P7Sy+IrmdvZcN912stXSCerwE8DAdWxz1zZ0IltjN6Nn5jEc5pPXKnTdh2vsKJ9Hl7 QMu4hLPpNJyYWsnjQ8r+9+/IQ262SnTIqtdxtlmkXkWWl2q0gb7AjJPOLqylDZLGxYwa m418HDWHpFzDdvbsozrx1FYx5P8ids7MVnEUJ+6Ia+Rf34h6h/7oPJqmBjKAAVvaHXCN Zx3WPQP/5c4IWj75Uzh6GJxMiterLN0VUNt0ipj94xYRG/nUeFylMjSZC284mAkXdfsq YWJWu0BjCgJSFERKTghlCC5DJQl7slUgCgAVAjxWB5aG4oNhrmipm6uQs67vnXKvVFHj dUKw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:dkim-signature; bh=TPXPRnV37Kgf6ZlD315zzLR/L+GVPlWp173rNHJidzE=; fh=abIpJkmHIgqMVCNUyuYIDt/6GCMqAdsBq4YKsDJk+cQ=; b=SiFxzeg6PgxPN/1FeMI2DUl6/wkTd9rPHqDuZVppxchlgolmFvJrXwIfWeiXWR1DhZ 9g3BeMllcv4n8/6JLSe3SaWbskUG9V3fveOoIOtC09Q8zEUHMksztxamS01IWmUEHh/6 smPSMsf/BENXAJHsFrYPcwf3Rt8LSrBQq4IPJ32OL+FtOpaaAAs6QW/TBgVcqoHjNM8z G2tWGRyvRv5PaCIAcK4RbZyXo76rh62Z0aODBj+uN8sdMjxkxBkryvj+VUMRnbSU1LmV AqDhBftgR9TtobnhNNRuskkwzmHSDVM8Lc28xxFnK173sk3dJRPyZL2x2/7dlwJiK8j8 eF3g==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=q4HLWSDw; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48feeb51eaasi7860251f8f.253.2026.11.04.10.05.45 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 10:05:45 -0800 (PST) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=q4HLWSDw; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=TPXPRnV37Kgf6ZlD315zzLR/L+GVPlWp173rNHJidzE=; b=q4HLWSDw1XwABGn1nSe niQ0enO1Fa2wM8mN9TSUMKKSjx9CrORqRyQuZ9gGp+91w7Ej6pQ9RpdMkwSrTbyz66PmH5qiMk55n HAmeDKsGzV6DWN7y/jabgq1FzPtDxoAKTEpb1tZDFDl6tRwBfEz8hyNORpdW4bm9c8fjRG+K2z8s9 UyYAo6ev0RQXw9xHlNhEIO8tw/Su0G9ExN7pwmR/qcYa2ykEwiXMsqZtKpKQje85AKn19lxK0j+mP T71tEDbWSPUxAj7t/Ra5FHuy7bIMS8dwh/hCJgK31ox4AealFBRvJYovaCnjREHl7g96aKUKmHVNz cd4i5RWpRIEGipA==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xOfIq-00G4X6-1j; Wed, 04 Nov 2026 19:05:44 +0100 From: Konstantin Khorenko Date: Wed, 04 Nov 2026 19:05:40 +0100 MIME-Version: 1.0 Message-Id: <20261104-b4-prep-khorenko-vstor-149847-1-upstream-fixes-v2-1-2974ec52f0fe@virtuozzo.com> References: <20261104-b4-prep-khorenko-vstor-149847-1-upstream-fixes-v2-0-2974ec52f0fe@virtuozzo.com> In-Reply-To: <20261104-b4-prep-khorenko-vstor-149847-1-upstream-fixes-v2-0-2974ec52f0fe@virtuozzo.com> To: Pavel Tikhomirov , Vasileios Almpanis X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3193; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=M+yea1dx7nqL3z4/vg/tMQDNW3gs9duTPRou4I75O6Y=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBq63P4S+INpS5vjAQMZ9Wc6dPpCUOTTpDiQwtl/ aj4lpFaIjiJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCautz+AAKCRBRlgpH+WFc Khq5D/0dDZ0iruKISEb4ngQdkq1Ri8BuI7mpzER5olXw7IS3iB90hiuBtQSaruTJpipCmjtxYEF M7ZhWobsoFPgEhWBcCL7IqKgZ3lYWFjnKH5f0wTmcNzUIW8S48AdajFJPa75MKGgoiUcmcm4iRS tJfRCgp1aoYYhEB+/3VKYv/z3td4whSXExK7CjCTUQNBxm/0ESHsJiQ0E//zejxD+1GM015Q7Oi fgXBkJAhCDyBhT8anmWOtn+XRFnYEWkLekSkhFa9RIenL8UWJSQShs8WcPbVjH4rx9IBpzbAk8a Z+wnP9gdCg9aT47pjju4NWuMw2PQfswhxjGwc9XTeAw5VJ7m5z2RFGthR/vc0+WXI/D2XuO0gs9 yMQ1atsuZfubMgZAu9UjR0XuMt3Xkn33QEs7wo1yfInjYOs45l1dpAXgTYpPXhvWoOLslDOtHeH Mvg8RRpYywr7aSYFg+MhJKjZnmh5IkHx9q4ibATRPEKRcJBwYhCwb8nLwxiqoNwdWsFhT0yEJJj 9F5xFlw+0+KmCxvpSP3XyGh/PMCX15//fkTr3oQVVw8ozQEjDdier1jqzq8HmPKLYImYqkqJHrn TE89/DQpQh01FRcgHdkyXF3cEZOFPKFUIzr5U9J0dVG4jSc/8GAuVZH5BrB8Y/bYCSqcSAjM3BE fGVBhFr0f+aq4hg== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v2 1/2] mm/huge_memory: recheck a special PMD under the lock in copy_huge_pmd() X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org copy_huge_pmd() reads a special PMD without the page table lock and copies that value to the child. The mmap write lock held by fork does not stop unmap_mapping_range(): it zaps under i_mmap_rwsem and the PMD lock. The zap visits the parent VMA before the child's, as dup_mmap() links the child right after the parent in i_mmap. If it clears the parent PMD after fork has read it, and passes the child before fork copies it, the child keeps a mapping the driver has revoked: - vfio-pci: the child reaches the BAR after the device memory was disabled or the device was reset, instead of getting SIGBUS; - panthor: the child maps the pages of an evicted buffer object after they are freed. Read the PMD again under the source PMD lock, which the zap takes to clear it. Either the zap got there first, and the PMD is none, or the copy is in place before the zap reaches the child. Faults are locked out, so only a zap can change the PMD, and pmd_none() is the test. Backport note: in mainline this is patch 1 of a two-patch series. Here the lockless check has no huge zero PMD test and the CoW warning uses is_cow_mapping(), as this tree does. Commit bc02afbd4d73 ("mm/fork: accept huge pfnmap entries") and the vfio-pci huge fault handler are in this tree; panthor maps no huge PMDs here. Patch 2 of the mainline series, which deposits a page table for the copy on ppc64 in hash mode, is not needed: this tree has no huge pfnmap support on ppc64. Fixes: bc02afbd4d73 ("mm/fork: accept huge pfnmap entries") https://virtuozzo.atlassian.net/browse/VSTOR-150144 Feature: fix ms/mm Signed-off-by: Konstantin Khorenko --- mm/huge_memory.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 90868f69ee338..dc254430d6929 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1618,13 +1618,22 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm, src_ptl = pmd_lockptr(src_mm, src_pmd); spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING); /* - * No need to recheck the pmd, it can't change with write - * mmap lock held here. - * - * Meanwhile, making sure it's not a CoW VMA with writable - * mapping, otherwise it means either the anon page wrongly - * applied special bit, or we made the PRIVATE mapping be - * able to wrongly write to the backend MMIO. + * The mmap and VMA write locks of the source keep faults + * out, but unmap_mapping_range() does not take the mmap + * lock and may have cleared the pmd since the lockless + * read. Let copy_pmd_range() skip it then. + */ + pmd = pmdp_get(src_pmd); + if (unlikely(pmd_none(pmd))) { + spin_unlock(src_ptl); + spin_unlock(dst_ptl); + return -EAGAIN; + } + /* + * Make sure it's not a CoW VMA with writable mapping, + * otherwise it means either the anon page wrongly applied + * special bit, or we made the PRIVATE mapping be able to + * wrongly write to the backend MMIO. */ VM_WARN_ON_ONCE(is_cow_mapping(src_vma->vm_flags) && pmd_write(pmd)); goto set_pmd; -- 2.43.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel