Re: [PATCH 1/1] mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED

On Tue, 23 Feb 2016 19:49:10 +0100 Andrea Arcangeli [off-list ref] wrote:

pmd_trans_unstable()/pmd_none_or_trans_huge_or_clear_bad() were
introduced to locklessy (but atomically) detect when a pmd is a
regular (stable) pmd or when the pmd is unstable and can infinitely
transition from pmd_none() and pmd_trans_huge() from under us, while
only holding the mmap_sem for reading (for writing not).

While holding the mmap_sem only for reading, MADV_DONTNEED can run
from under us and so before we can assume the pmd to be a regular
stable pmd we need to compare it against pmd_none() and
pmd_trans_huge() in an atomic way, with pmd_trans_unstable(). The old
pmd_trans_huge() left a tiny window for a race.

Useful applications are unlikely to notice the difference as doing
MADV_DONTNEED concurrently with a page fault would lead to undefined
behavior.

Thanks.

I put a cc:stable on this as it appears to be applicable to 4.4 and
perhaps earlier.

It generates a reject against 4.4 because of the recently-added
pmd_devmap() test.  It's easily fixed but I don't have a process to
handle -stable rejects.  This means that when Greg hits the reject
he'll ask us for a fixed up version.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>