| Message ID | 1584876733-17405-3-git-send-email-kernelfans@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | fix omission of check on FOLL_LONGTERM in gup fast path | expand |
On 3/22/20 4:32 AM, Pingfan Liu wrote: > FOLL_LONGTERM is a special case of FOLL_PIN. It suggests a pin which is > going to be given to hardware and can't move. It would truncate CMA > permanently and should be excluded. > > In gup slow path, where > __gup_longterm_locked->check_and_migrate_cma_pages() handles FOLL_LONGTERM, > but in fast path, there lacks such a check, which means a possible leak of > CMA page to longterm pinned. > > Place a check in try_grab_compound_head() in the fast path to fix the leak, > and if FOLL_LONGTERM happens on CMA, it will fall back to slow path to > migrate the page. > > Some note about the check: > Huge page's subpages have the same migrate type due to either > allocation from a free_list[] or alloc_contig_range() with param > MIGRATE_MOVABLE. So it is enough to check on a single subpage > by is_migrate_cma_page(subpage) > > Signed-off-by: Pingfan Liu <kernelfans@gmail.com> > Reviewed-by: Christoph Hellwig <hch@lst.de> > Reviewed-by: Jason Gunthorpe <jgg@mellanox.com> > Cc: Ira Weiny <ira.weiny@intel.com> > Cc: Andrew Morton <akpm@linux-foundation.org> > Cc: Mike Rapoport <rppt@linux.ibm.com> > Cc: Dan Williams <dan.j.williams@intel.com> > Cc: Matthew Wilcox <willy@infradead.org> > Cc: John Hubbard <jhubbard@nvidia.com> > Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com> > Cc: Christoph Hellwig <hch@infradead.org> > Cc: Shuah Khan <shuah@kernel.org> > Cc: Jason Gunthorpe <jgg@ziepe.ca> > To: linux-mm@kvack.org > Cc: linux-kernel@vger.kernel.org > --- > mm/gup.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/mm/gup.c b/mm/gup.c > index 02a95b1..3fe75c4 100644 > --- a/mm/gup.c > +++ b/mm/gup.c > @@ -89,6 +89,14 @@ static __maybe_unused struct page *try_grab_compound_head(struct page *page, > int orig_refs = refs; > > /* > + * Can't do FOLL_LONGTERM + FOLL_PIN with CMA in the gup fast > + * path, so fail and let the caller fall back to the slow path. > + */ > + if (unlikely(flags & FOLL_LONGTERM) && > + is_migrate_cma_page(page)) > + return NULL; > + > + /* Reviewed-by: John Hubbard <jhubbard@nvidia.com> thanks,
diff --git a/mm/gup.c b/mm/gup.c index 02a95b1..3fe75c4 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -89,6 +89,14 @@ static __maybe_unused struct page *try_grab_compound_head(struct page *page, int orig_refs = refs; /* + * Can't do FOLL_LONGTERM + FOLL_PIN with CMA in the gup fast + * path, so fail and let the caller fall back to the slow path. + */ + if (unlikely(flags & FOLL_LONGTERM) && + is_migrate_cma_page(page)) + return NULL; + + /* * When pinning a compound page of order > 1 (which is what * hpage_pincount_available() checks for), use an exact count to * track it, via hpage_pincount_add/_sub().