From patchwork Wed Nov 13 16:31:19 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vlastimil Babka X-Patchwork-Id: 13874002 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 780A7D462D7 for ; Wed, 13 Nov 2024 16:31:41 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id EAE636B00BD; Wed, 13 Nov 2024 11:31:40 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id E5E046B00BE; Wed, 13 Nov 2024 11:31:40 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D25E36B00C0; Wed, 13 Nov 2024 11:31:40 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id B5D8E6B00BD for ; Wed, 13 Nov 2024 11:31:40 -0500 (EST) Received: from smtpin22.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 617551C1421 for ; Wed, 13 Nov 2024 16:31:40 +0000 (UTC) X-FDA: 82781611500.22.DB10B29 Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.223.131]) by imf19.hostedemail.com (Postfix) with ESMTP id 17A2D1A0006 for ; Wed, 13 Nov 2024 16:30:43 +0000 (UTC) Authentication-Results: imf19.hostedemail.com; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=KlO6blfZ; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=UD6JcsaI; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=KlO6blfZ; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=UD6JcsaI; dmarc=none; spf=pass (imf19.hostedemail.com: domain of vbabka@suse.cz designates 195.135.223.131 as permitted sender) smtp.mailfrom=vbabka@suse.cz ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1731515321; a=rsa-sha256; cv=none; b=pt00Nv0I0xFwH93v1HH2ZA5k2vlb7Urtst+PDXYg+LcJifnRN08ZdCswfU/DBESV4vmQfV kLMIpPjuqg06A9+/1B7fQUgleurxyWp6GvmTw1fh2qv98whJSGCdn4TA5DcApqNMaxkVI6 fX1d4hI+lc8+/zVh1maB6kNJ0O7TRDM= ARC-Authentication-Results: i=1; imf19.hostedemail.com; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=KlO6blfZ; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=UD6JcsaI; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=KlO6blfZ; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=UD6JcsaI; dmarc=none; spf=pass (imf19.hostedemail.com: domain of vbabka@suse.cz designates 195.135.223.131 as permitted sender) smtp.mailfrom=vbabka@suse.cz ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1731515321; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=UJ9p2hM3bZfX2o8ZGBOr5efbxsYAS1Sgn1cJzwQSjzs=; b=sKI7+Ot+F6giXh2PJsx0kwxi7nKr+Jjf45N/a88LFbsfWMVTW1L4+uM3vC+eCPe0uu7n6q 6uNGaGa8/pG+R0QzXG1MGTMi/5deJktyL2uUcsrklA9YlWFvaBwbNzXL57ZBirmSlTQSg+ +rt1GkFSfdytFM1lfwKIiMhXmiVzbIs= Received: from imap1.dmz-prg2.suse.org (imap1.dmz-prg2.suse.org [IPv6:2a07:de40:b281:104:10:150:64:97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 6B3131F38C; Wed, 13 Nov 2024 16:31:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_rsa; t=1731515496; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=UJ9p2hM3bZfX2o8ZGBOr5efbxsYAS1Sgn1cJzwQSjzs=; b=KlO6blfZb21ASHjpfopdKFbePe3nb5C7A7CnLwpegbDbQy4feysezIJlCjFNVCjQimT31C bEO3ki0LemWJBNBG8XYWYWQaZtQuzQnyMv7yKkSa6C+vFeJiPK/vZpmbK5v15yim9rCUs7 vKRhq662Sg5ymI81fHxA0uk849bRtZ8= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_ed25519; t=1731515496; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=UJ9p2hM3bZfX2o8ZGBOr5efbxsYAS1Sgn1cJzwQSjzs=; b=UD6JcsaI7Yv0fHQHq/Ur/M23hBWX7292bkgIjYij5NC+68l1i8jDrnPL32SqsAcFSsBkBN bv5UYbRNAfDzRSBg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_rsa; t=1731515496; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=UJ9p2hM3bZfX2o8ZGBOr5efbxsYAS1Sgn1cJzwQSjzs=; b=KlO6blfZb21ASHjpfopdKFbePe3nb5C7A7CnLwpegbDbQy4feysezIJlCjFNVCjQimT31C bEO3ki0LemWJBNBG8XYWYWQaZtQuzQnyMv7yKkSa6C+vFeJiPK/vZpmbK5v15yim9rCUs7 vKRhq662Sg5ymI81fHxA0uk849bRtZ8= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_ed25519; t=1731515496; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=UJ9p2hM3bZfX2o8ZGBOr5efbxsYAS1Sgn1cJzwQSjzs=; b=UD6JcsaI7Yv0fHQHq/Ur/M23hBWX7292bkgIjYij5NC+68l1i8jDrnPL32SqsAcFSsBkBN bv5UYbRNAfDzRSBg== Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id 50CC313A6E; Wed, 13 Nov 2024 16:31:36 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id i2FpE2jUNGdfNQAAD6G6ig (envelope-from ); Wed, 13 Nov 2024 16:31:36 +0000 From: Vlastimil Babka To: stable@vger.kernel.org Cc: David Hildenbrand , Peter Xu , linux-mm@kvack.org, Yuanzheng Song , Vlastimil Babka Subject: [PATCH stable 5.15] mm/memory: add non-anonymous page check in the copy_present_page() Date: Wed, 13 Nov 2024 17:31:19 +0100 Message-ID: <20241113163118.54834-2-vbabka@suse.cz> X-Mailer: git-send-email 2.47.0 MIME-Version: 1.0 X-Rspamd-Action: no action X-Stat-Signature: i1rpwah1554fbswqw7g96gmjyef1fywe X-Rspamd-Queue-Id: 17A2D1A0006 X-Rspamd-Server: rspam08 X-Rspam-User: X-HE-Tag: 1731515443-469388 X-HE-Meta: U2FsdGVkX1+wfab4z3uWcGdhRmTFek0AGufgFv1bPndbSccdPugpuzlvcRgv2PM7ECPcCjh8vD8UDzBRwdxzj0u1JXw33AKQGJnhwKR0Rfs3+V3GV0MfcxoAvrN72O9vSxNkBRasHw8B5ajFWp/W+tGdG0luH6O4YzSHir5EwDfLWcM3nvsLmqlL0fKm8K+leORvsOh+riOBDvtW3HS30zCm9QPaIr6JXnoWuwEc6AYrNbLo+UH5uL53tgQQIiPPY0TI9hBFFxkMgBbfcHNgHcWEt7Ta3im0b+f/wuLa6dnS4NiRuWlHKljCirofwXuJy3m3SUSkXh6n8DxmSOgdPaZQs6O4ssuv0hharfOdfpiHbqT0cDvvQ23bSGnqPJTRDG6dN+n+ZSk2KGqXMpRIn07vVb3TJ03zBDSzy495v+T/SHSTHAUSWOn8te7XKQ4teNmZOEUj03SVfEfe+x0ONhYpsew84YHKQupDFcGTQpjOgSkfn2jk3Srvfh45r+lea8qQqtE7In0Ux+NFULBGT3lhjWXYIJS8eGBi+La4FZSNp14cFNJR7emrl4bxpQ+L8APetL5metyI8vt0gX3Nyu1f4bq2tzy43sHhdsWFXsdiddh3GoMwGNWiVW0cCOdopbg4O62yRzDGbnEbKiLEoh5wiDLSQGNhojVmdI8izFmsJbLAJ6AyBDeZ2oxn2zWpw36Oi7rOU77kCOw8NCBHx8wH5F/ascrtEzn8CpvL5R6BIjEhDlKRS8zmxB8Czf50iFKiqLhA+vOmCpt/oEvy34wx77Htexw5PqKX07l12YmK62oEh+TcNZ3xBnSQes3nJkQQXC5sOIxkNG3QXeR7nFn7M1wX+fS6TlvdT3uYfw8J+rEzNyxqGLUjd9b6Q37+wJnO0zwVnH7iwaI3zdXpIZWtjXdwBZdL8S6JQ4oN3GvTlIpAMtzdmxldtBRwqDToupku70k6W5dfFF2EquJ pKuEDu1i KJtbkNyOi8NyoYlkZ85enT+BpP+tmwHlvY0kuyUuE39U3kWBKMMrnPA86TrWJzjfwSGdd2KLKwph6kSfMqWQfpP/cbHyTHBGCkrX0M5i9wWIPrJqAlnvRWWbbQRJ0AmayrE2vEVCeMryTtAjULLECs9PH6ExQg6AlH/PTNw3ENcIAc6QB3lR1stINRUYVOGb0+OkW8h/ktceVPOQlzjHkdQTpr0heljbMxsBnpsmonJKi5WyK7SW5CIqCV4+Fy3W3WbuqSlLBtO/8Emb6qfsAg16NP3i5nuBE88lw6Tkc9EHFw/nSqalkxpEFA5zH6I6UPyy7xG1C1eW+6YA= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Yuanzheng Song The vma->anon_vma of the child process may be NULL because the entire vma does not contain anonymous pages. In this case, a BUG will occur when the copy_present_page() passes a copy of a non-anonymous page of that vma to the page_add_new_anon_rmap() to set up new anonymous rmap. ------------[ cut here ]------------ kernel BUG at mm/rmap.c:1052! Internal error: Oops - BUG: 0 [#1] SMP Modules linked in: CPU: 4 PID: 4652 Comm: test Not tainted 5.15.75 #1 Hardware name: linux,dummy-virt (DT) pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __page_set_anon_rmap+0xc0/0xe8 lr : __page_set_anon_rmap+0xc0/0xe8 sp : ffff80000e773860 x29: ffff80000e773860 x28: fffffc13cf006ec0 x27: ffff04f3ccd68000 x26: ffff04f3c5c33248 x25: 0000000010100073 x24: ffff04f3c53c0a80 x23: 0000000020000000 x22: 0000000000000001 x21: 0000000020000000 x20: fffffc13cf006ec0 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffdddc5581377c x8 : 0000000000000000 x7 : 0000000000000011 x6 : ffff2717a8433000 x5 : ffff80000e773810 x4 : ffffdddc55400000 x3 : 0000000000000000 x2 : ffffdddc56b20000 x1 : ffff04f3c9a48040 x0 : 0000000000000000 Call trace: __page_set_anon_rmap+0xc0/0xe8 page_add_new_anon_rmap+0x13c/0x200 copy_pte_range+0x6b8/0x1018 copy_page_range+0x3a8/0x5e0 dup_mmap+0x3a0/0x6e8 dup_mm+0x78/0x140 copy_process+0x1528/0x1b08 kernel_clone+0xac/0x610 __do_sys_clone+0x78/0xb0 __arm64_sys_clone+0x30/0x40 invoke_syscall+0x68/0x170 el0_svc_common.constprop.0+0x80/0x250 do_el0_svc+0x48/0xb8 el0_svc+0x48/0x1a8 el0t_64_sync_handler+0xb0/0xb8 el0t_64_sync+0x1a0/0x1a4 Code: 97f899f4 f9400273 17ffffeb 97f899f1 (d4210000) ---[ end trace dc65e5edd0f362fa ]--- Kernel panic - not syncing: Oops - BUG: Fatal exception SMP: stopping secondary CPUs Kernel Offset: 0x5ddc4d400000 from 0xffff800008000000 PHYS_OFFSET: 0xfffffb0c80000000 CPU features: 0x44000cf1,00000806 Memory Limit: none ---[ end Kernel panic - not syncing: Oops - BUG: Fatal exception ]--- This problem has been fixed by the commit ("mm/rmap: split page_dup_rmap() into page_dup_file_rmap() and page_try_dup_anon_rmap()"), but still exists in the linux-5.15.y branch. This patch is not applicable to this version because of the large version differences. Therefore, fix it by adding non-anonymous page check in the copy_present_page(). Cc: stable@vger.kernel.org Fixes: 70e806e4e645 ("mm: Do early cow for pinned pages during fork() for ptes") Signed-off-by: Yuanzheng Song Signed-off-by: Vlastimil Babka Reviewed-by: David Hildenbrand --- Hi, this was posted in [1] but seems stable@ was not actually included in the recipients. The 5.10 version [2] was applied as 935a8b62021 but 5.15 is missing. [1] https://lore.kernel.org/all/20221028075244.3112566-1-songyuanzheng@huawei.com/T/#u [2] https://lore.kernel.org/all/20221028030705.2840539-1-songyuanzheng@huawei.com/ mm/memory.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/mm/memory.c b/mm/memory.c index 6d058973a97e..4785aecca9a8 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -903,6 +903,17 @@ copy_present_page(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma if (likely(!page_needs_cow_for_dma(src_vma, page))) return 1; + /* + * The vma->anon_vma of the child process may be NULL + * because the entire vma does not contain anonymous pages. + * A BUG will occur when the copy_present_page() passes + * a copy of a non-anonymous page of that vma to the + * page_add_new_anon_rmap() to set up new anonymous rmap. + * Return 1 if the page is not an anonymous page. + */ + if (!PageAnon(page)) + return 1; + new_page = *prealloc; if (!new_page) return -EAGAIN;