qiurui
/
linux-kernelorg-stable
mirror of https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
1,319,163 Commits 111 Branches 5,428 Tags 6.8 GiB
C 97.3%
Assembly 1%
Shell 0.6%
Python 0.4%
Makefile 0.3%
Other 0.2%
Go to file
Ryan Roberts 510a29d776 mm: close theoretical race where stale TLB entries could linger 
commit 383c4613c6 upstream.

Commit 3ea277194d ("mm, mprotect: flush TLB if potentially racing with a
parallel reclaim leaving stale TLB entries") described a theoretical race
as such:


"""
Nadav Amit identified a theoretical race between page reclaim and mprotect
due to TLB flushes being batched outside of the PTL being held.

He described the race as follows:

	CPU0                            CPU1
	----                            ----
					user accesses memory using RW PTE
					[PTE now cached in TLB]
	try_to_unmap_one()
	==> ptep_get_and_clear()
	==> set_tlb_ubc_flush_pending()
					mprotect(addr, PROT_READ)
					==> change_pte_range()
					==> [ PTE non-present - no flush ]

					user writes using cached RW PTE
	...

	try_to_unmap_flush()

The same type of race exists for reads when protecting for PROT_NONE and
also exists for operations that can leave an old TLB entry behind such as
munmap, mremap and madvise.
"""

The solution was to introduce flush_tlb_batched_pending() and call it
under the PTL from mprotect/madvise/munmap/mremap to complete any pending
tlb flushes.

However, while madvise_free_pte_range() and
madvise_cold_or_pageout_pte_range() were both retro-fitted to call
flush_tlb_batched_pending() immediately after initially acquiring the PTL,
they both temporarily release the PTL to split a large folio if they
stumble upon one.  In this case, where re-acquiring the PTL
flush_tlb_batched_pending() must be called again, but it previously was
not.  Let's fix that.

There are 2 Fixes: tags here: the first is the commit that fixed
madvise_free_pte_range().  The second is the commit that added
madvise_cold_or_pageout_pte_range(), which looks like it copy/pasted the
faulty pattern from madvise_free_pte_range().

This is a theoretical bug discovered during code review.

Link: https://lkml.kernel.org/r/20250606092809.4194056-1-ryan.roberts@arm.com
Fixes: 3ea277194d ("mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries")
Fixes: 9c276cc65a ("mm: introduce MADV_COLD")
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
Reviewed-by: Jann Horn <jannh@google.com>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Mel Gorman <mgorman <mgorman@suse.de>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2025-06-27 11:11:38 +01:00
Documentation
…
LICENSES
…
arch LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() 2025-06-27 11:11:37 +01:00
block
…
certs
…
crypto
…
drivers nvme: always punt polled uring_cmd end_io work to task_work 2025-06-27 11:11:38 +01:00
fs smb: improve directory cache reuse for readdir operations 2025-06-27 11:11:37 +01:00
include Revert "mac80211: Dynamically set CoDel parameters per station" 2025-06-27 11:11:33 +01:00
init
…
io_uring io_uring: fix task leak issue in io_wq_create() 2025-06-27 11:11:36 +01:00
ipc
…
kernel bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index 2025-06-27 11:11:33 +01:00
lib
…
mm mm: close theoretical race where stale TLB entries could linger 2025-06-27 11:11:38 +01:00
net net: clear the dst when changing skb protocol 2025-06-27 11:11:38 +01:00
rust
…
samples
…
scripts Make 'cc-option' work correctly for the -Wno-xyzzy pattern 2025-06-27 11:11:27 +01:00
security
…
sound
…
tools libbpf: Add identical pointer detection to btf_dedup_is_equiv() 2025-06-27 11:11:32 +01:00
usr
…
virt
…
.clang-format
…
.clippy.toml
…
.cocciconfig
…
.editorconfig
…
.get_maintainer.ignore
…
.gitattributes
…
.gitignore
…
.mailmap
…
.rustfmt.toml
…
COPYING
…
CREDITS
…
Kbuild
…
Kconfig
…
MAINTAINERS
…
Makefile
…
README
…

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.