From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 07A22802A5 for ; Wed, 14 Oct 2026 17:05:31 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69EH46IT001090; Wed, 14 Oct 2026 20:04:07 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69EH46IT001090 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="S0tmeUTf" Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69EH3tfO001061 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 14 Oct 2026 20:03:55 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69EH3tfO001061 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-48c6a1d4034so3890622f8f.0 for ; Wed, 14 Oct 2026 10:03:55 -0700 (PDT) X-Gm-Message-State: AFq9FYJGIvcWWHebfevmoJ3IGi32vwi+CFusQc6UHRtV3qQdaNOG0Asn Y3kttvOebRkZYUBGWZmCXkGKYT3nDXkXxFbhJkWd0G9r624N6S5MhvUi6pBabgTM9MtNRDMP28I AXXMDqQIEF8wa+Pv9k83ZnJT7pbordcj/0n125huEpmgFpe01WH7Nrw== X-Gm-Gg: AYBFou1YPzTGD57zmTttCLE/+AWirGfiqaKv2rnzhH42jF9J6TV5VLkmn8VBg65rFmy TK6ZOtpXlbyE5KaeEevuo1kAGX3q7C9nESW9R5LcwNNHa7fg1ze7iYtKn1K9sa48DS5i3lRnStX jI3P23nyKYpEIa/7Od64uqtWKyCuSX84YxAElZHnmJdM+blSvn8GT4p0yBoRD1E3wyLVxi2a7i/ qyB+vnTOpmjtAMt6KsaxpjgE0pM36Q0FbxD8EFGYsegrP0kgEHANpNzzXOZp2e0jfksaG37rE27 GDZ2uxoAcczztSrCuwDYWhHobq4WGWOMIibz8sndAErMUgKC1VawaHGK+zW+DzTkLc4DDF/9aJr cT0dNN/vGbtyXoBfL X-Received: by 2002:a05:6000:250d:b0:48d:eec5:2b07 with SMTP id ffacd0b85a97d-48deec52c65mr3625017f8f.34.1791997433572; Wed, 14 Oct 2026 10:03:53 -0700 (PDT) X-Received: by 2002:a05:6000:250d:b0:48d:eec5:2b07 with SMTP id ffacd0b85a97d-48deec52c65mr3624929f8f.34.1791997432808; Wed, 14 Oct 2026 10:03:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791997432; cv=none; d=google.com; s=arc-20260327; b=Qzq8ZxvI09TazttNwXl0yUFXeinlZWmglA8NSdKive496huyTrPWnodVwghYZEDDjC m1BPUPPfscntNDRpVzMBgWnZM2OWuB88EgZrracAVEE85RPtK/yFf2Uw93DqbcVmK6Eu xjeuKYt+amaip1w0lmxQwgoHgUHNparfutcVJCNwu6ki/4yUis/PmMBT7TtvBmbxGllM 0DdI/MD2eCWZiVzn5IuDZOah6fFhpVAfxVPrMWlvOnUudL+L1MSHP9uJk0OZaUZSuiqC Dva+hHRA216bi7ZQWKOt/gwT9V3RlK7G1LZIdLZ8sfDCEFSl5i9lMmcU0FN7lU0vGZEV s2+w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:dkim-signature; bh=qbucO2U4UsiEtD5ramOxxiQWgpw0K/N1pEXNf9ByLZk=; fh=xUcS46XhSaUOWFT7CPWNuABJ4EJ7/+S5u4N+e+rlWN4=; b=ESfJeRr790bHL4tEWcv+fbab9rF/776S0bEqNwBIUwLozuXsfsDjmrn7fDN1VTP2jt fC1ONNNq4w50OuA05soXW6vHgVIJA4n4EKedzUmD0SdmbmcvnqSO8iVa6bqgMtUENIzL sPeCqiytaBPIn1VbfpQcMc3SyIGPuciywdUagRBLDQqZLkmq5f8cqHFzC3rtRwZSH++x tUCPgzMp6gPWFEqdQz36mFTbO2Ez4PHic9Wdfz3vQVjXJtEDaj+s1Bo4utkOKHtBgyiE pAuwk8EmQaaGRoBJVwR/uej6CjRW3ma8MlOyM3jjLvhgu4LUB8jsrO3pOFiV3vAtZJv0 ekjg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=S0tmeUTf; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48def24c93dsi2815577f8f.310.2026.10.14.10.03.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 10:03:52 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=S0tmeUTf; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=qbucO2U4UsiEtD5ramOxxiQWgpw0K/N1pEXNf9ByLZk=; b=S0tmeUTfLNpEngmJI6g C2Cmxp/ZbctfFLUz00rVsarAzIICDvKaysurUGsdS9gJy8G5+WsjnZgXqcTaRqN6mVrOQDpvge7ed gE9MXbsdUOioPZUPIxKtDh3GfZmQlOYKA8qvDyNWVCKyuKanoQvdcDsJznSGFjkqy/OF822X4usAu ktLCOoMeKMzlaqfPXmugrEfGXwXRwX1154QlyQXnVcp14Q+XYQL6DT8B+3spJKehmG2r5ha3CCkqp cW//O/ajEt4QhnWBUxSFkdGlwJWyf7pWgzK9+WCKqWk+icCHVCcujPGfXe4dx97a6iTqAi9dJjYMH p+9VnyZQi3IwhWQ==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xH2Kx-007syU-1A; Wed, 14 Oct 2026 19:03:51 +0200 From: Konstantin Khorenko Date: Wed, 14 Oct 2026 19:03:19 +0200 MIME-Version: 1.0 Message-Id: <20261014-b4-prep-khorenko-vstor-149847-1-upstream-fixes-v1-1-7fde9ffbebe9@virtuozzo.com> References: <20261014-b4-prep-khorenko-vstor-149847-1-upstream-fixes-v1-0-7fde9ffbebe9@virtuozzo.com> In-Reply-To: <20261014-b4-prep-khorenko-vstor-149847-1-upstream-fixes-v1-0-7fde9ffbebe9@virtuozzo.com> To: Pavel Tikhomirov , Andrey Drobyshev , Vasileios Almpanis X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3211; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=VGg8cMaSz/K0KiTZib7j3kfr7pona73kwvesoLOqAfc=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBqz7X3epRaohTtWGB6ZOE3TcVaXt7O2KBxg9cVb UGcTgJMzzKJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCas+19wAKCRBRlgpH+WFc KikKEACt2v6TaXzrAGjWCyvIREgniP5bfFfbcmoEUGzDueir/DmzhJXoFADoU4lqOpeRM+x51d5 +lW0So2E1WRL+YUHDhnq02CTPe789N5a9nfX3TVPul//9h/Xb790emjFpYAS/lu2Gl925SZXElx rz0sDlfv3VDAMqDFbDVMLZQiFSDclJV7dyC8IlAdwGzIRXaGQ2TeilCMyUruJsAZB+V9FJUfS7B SjogU5megyoFPFHM+FiIEPZISdA9NA4m8kbs1a6x0u1yeE76vrUVDTixsZpKZ/a/4Ahg6ibO3wF ECDA5IQYI0uRyOO8rqXgQMNpv9a5NVD5/pmHmLMTzvcDfPdWPS1YDof8FqxlP/gecb799Jd/ZA8 ewG8AMre8NetYZgr2WcoAMC8rhz6KNotCLBdYx3/cYziJ2w8wbv8fkyYnYFJsldf6rb0d3kd2Bp ffIbF3oDAV6XESQahbhlYDOh5aO61WW6zyn2z7RNM8nbc/YvK6h8JvfgcSQLFpulFctIt4+fmye u/3EBUna9T08yyvrkTPbWqpK8VaOExkQV/edILtpClHl2PBJW2hi1z9wpLade/wZX7jfZGECsIF V2UwSX/LyyruvKFqucdE0VVmTtX8XKYFKNTH0wvblrFd+6Ma7gjAsiJfxrIB0aMszArmOIkN/iP c/8Qeo+UGGosUOg== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 1/2] mm/huge_memory: recheck a special PMD under the lock in copy_huge_pmd() X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org copy_huge_pmd() reads a special PMD without the page table lock and copies that value to the child. The mmap write lock held by fork does not stop unmap_mapping_range(): it zaps under i_mmap_rwsem and the PMD lock. The zap visits the parent VMA before the child's, as dup_mmap() links the child right after the parent in i_mmap. If it clears the parent PMD after fork has read it, and passes the child before fork copies it, the child keeps a mapping the driver has revoked: - vfio-pci: the child reaches the BAR after the device memory was disabled or the device was reset, instead of getting SIGBUS; - panthor: the child maps the pages of an evicted buffer object after they are freed. Read the PMD again under the source PMD lock, which the zap takes to clear it. Either the zap got there first, and the PMD is none, or the copy is in place before the zap reaches the child. Faults are locked out, so only a zap can change the PMD, and pmd_none() is the test. Backport note: in mainline this is patch 1 of a two-patch series. Here the lockless check has no huge zero PMD test and the CoW warning uses is_cow_mapping(), as this tree does. Commit bc02afbd4d73 ("mm/fork: accept huge pfnmap entries") and the vfio-pci huge fault handler are in this tree; panthor maps no huge PMDs here. Patch 2 of the mainline series, which deposits a page table for the copy on ppc64 in hash mode, is not needed: this tree has no huge pfnmap support on ppc64. Fixes: bc02afbd4d73 ("mm/fork: accept huge pfnmap entries") https://virtuozzo.atlassian.net/browse/VSTOR-150144 Feature: fix ms/mm Assisted-by: LLM Signed-off-by: Konstantin Khorenko --- mm/huge_memory.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 90868f69ee338..dc254430d6929 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1618,13 +1618,22 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm, src_ptl = pmd_lockptr(src_mm, src_pmd); spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING); /* - * No need to recheck the pmd, it can't change with write - * mmap lock held here. - * - * Meanwhile, making sure it's not a CoW VMA with writable - * mapping, otherwise it means either the anon page wrongly - * applied special bit, or we made the PRIVATE mapping be - * able to wrongly write to the backend MMIO. + * The mmap and VMA write locks of the source keep faults + * out, but unmap_mapping_range() does not take the mmap + * lock and may have cleared the pmd since the lockless + * read. Let copy_pmd_range() skip it then. + */ + pmd = pmdp_get(src_pmd); + if (unlikely(pmd_none(pmd))) { + spin_unlock(src_ptl); + spin_unlock(dst_ptl); + return -EAGAIN; + } + /* + * Make sure it's not a CoW VMA with writable mapping, + * otherwise it means either the anon page wrongly applied + * special bit, or we made the PRIVATE mapping be able to + * wrongly write to the backend MMIO. */ VM_WARN_ON_ONCE(is_cow_mapping(src_vma->vm_flags) && pmd_write(pmd)); goto set_pmd; -- 2.43.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel