Toshi Kani 31895cfd79 mm/vmalloc: add interfaces to free unmapped page table ... commit b6bdb7517c upstream. On architectures with CONFIG_HAVE_ARCH_HUGE_VMAP set, ioremap() may create pud/pmd mappings. A kernel panic was observed on arm64 systems with Cortex-A75 in the following steps as described by Hanjun Guo. 1. ioremap a 4K size, valid page table will build, 2. iounmap it, pte0 will set to 0; 3. ioremap the same address with 2M size, pgd/pmd is unchanged, then set the a new value for pmd; 4. pte0 is leaked; 5. CPU may meet exception because the old pmd is still in TLB, which will lead to kernel panic. This panic is not reproducible on x86. INVLPG, called from iounmap, purges all levels of entries associated with purged address on x86. x86 still has memory leak. The patch changes the ioremap path to free unmapped page table(s) since doing so in the unmap path has the following issues: - The iounmap() path is shared with vunmap(). Since vmap() only supports pte mappings, making vunmap() to free a pte page is an overhead for regular vmap users as they do not need a pte page freed up. - Checking if all entries in a pte page are cleared in the unmap path is racy, and serializing this check is expensive. - The unmap path calls free_vmap_area_noflush() to do lazy TLB purges. Clearing a pud/pmd entry before the lazy TLB purges needs extra TLB purge. Add two interfaces, pud_free_pmd_page() and pmd_free_pte_page(), which clear a given pud/pmd entry and free up a page for the lower level entries. This patch implements their stub functions on x86 and arm64, which work as workaround. [akpm@linux-foundation.org: fix typo in pmd_free_pte_page() stub] Link: http://lkml.kernel.org/r/20180314180155.19492-2-toshi.kani@hpe.com Fixes: e61ce6ade4 ("mm: change ioremap to set up huge I/O mappings") Reported-by: Lei Li <lious.lilei@hisilicon.com> Signed-off-by: Toshi Kani <toshi.kani@hpe.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Wang Xuefeng <wxf.wang@hisilicon.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Hanjun Guo <guohanjun@huawei.com> Cc: Michal Hocko <mhocko@suse.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Borislav Petkov <bp@suse.de> Cc: Matthew Wilcox <willy@infradead.org> Cc: Chintan Pandya <cpandya@codeaurora.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> [ tweak arm64 portion to rely on CONFIG_ARCH_HAVE_HUGE_VMAP - gregkh] Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-03-28 18:40:14 +02:00
..
842
fonts
lz4	lib: lz4: fixed zram with lz4 on big endian machines	2016-05-04 14:48:41 -07:00
lzo
mpi	lib/mpi: Fix umul_ppmm() for MIPS64r6	2018-03-03 10:19:42 +01:00
raid6
reed_solomon
xz
zlib_deflate
zlib_inflate
.gitignore
argv_split.c
asn1_decoder.c	ASN.1: check for error from ASN1_OP_END__ACT actions	2017-12-16 10:33:48 +01:00
assoc_array.c	assoc_array: Fix a buggy node-splitting case	2017-11-02 09:40:49 +01:00
atomic64_test.c
atomic64.c
audit.c
bcd.c
bch.c
bitmap.c
bitrev.c
bsearch.c
btree.c
bug.c
build_OID_registry
bust_spinlocks.c
check_signature.c
checksum.c
clz_ctz.c
clz_tab.c
cmdline.c	lib/cmdline.c: fix get_options() overflow while parsing ranges	2017-06-29 12:48:51 +02:00
compat_audit.c
cordic.c
cpu_rmap.c
cpu-notifier-error-inject.c
cpumask.c
crc-ccitt.c
crc-itu-t.c
crc-t10dif.c
crc7.c
crc8.c
crc16.c
crc32.c
crc32defs.h
ctype.c
debug_info.c
debug_locks.c
debugobjects.c
dec_and_lock.c
decompress_bunzip2.c
decompress_inflate.c
decompress_unlz4.c
decompress_unlzma.c
decompress_unlzo.c
decompress_unxz.c
decompress.c
devres.c
digsig.c	lib/digsig: fix dereference of NULL user_key_payload	2017-10-27 10:23:17 +02:00
div64.c
dma-debug.c	dma-debug: avoid spinlock recursion when disabling dma-debug	2016-06-07 18:14:37 -07:00
dump_stack.c	dump_stack: avoid potential deadlocks	2016-02-25 12:01:23 -08:00
dynamic_debug.c	dynamic-debug-howto: fix optional/omitted ending line number to be LARGE instead of 0	2017-12-16 10:33:54 +01:00
dynamic_queue_limits.c
earlycpio.c
extable.c
fault-inject.c
fdt_empty_tree.c
fdt_ro.c
fdt_rw.c
fdt_strerror.c
fdt_sw.c
fdt_wip.c
fdt.c
find_bit.c
flex_array.c
flex_proportions.c
gcd.c
gen_crc32table.c
genalloc.c	lib/genalloc.c: make the avail variable an atomic_long_t	2017-12-16 10:33:54 +01:00
glob.c
halfmd4.c
hexdump.c
hweight.c
idr.c
inflate.c
int_sqrt.c
interval_tree_test.c
interval_tree.c
iomap_copy.c
iomap.c
iommu-common.c
iommu-helper.c
ioremap.c	mm/vmalloc: add interfaces to free unmapped page table	2018-03-28 18:40:14 +02:00
iov_iter.c	fix iov_iter_fault_in_readable()	2016-09-24 10:07:43 +02:00
irq_regs.c
is_single_threaded.c
jedec_ddr_data.c
kasprintf.c
Kconfig	lib: sw842: select crc32	2016-03-03 15:07:24 -08:00
Kconfig.debug	kasan: rework Kconfig settings	2018-02-25 11:03:52 +01:00
Kconfig.kasan
Kconfig.kgdb
Kconfig.kmemcheck
kfifo.c
klist.c
kobject_uevent.c
kobject.c
kstrtox.c	lib: add "on"/"off" support to kstrtobool	2016-10-28 03:01:31 -04:00
kstrtox.h
lcm.c
libcrc32c.c
list_debug.c
list_sort.c
llist.c
locking-selftest-hardirq.h
locking-selftest-mutex.h
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c
lockref.c
lru_cache.c
Makefile
md5.c
memory-notifier-error-inject.c
memweight.c
net_utils.c
nlattr.c
nmi_backtrace.c
notifier-error-inject.c
notifier-error-inject.h
of-reconfig-notifier-error-inject.c
oid_registry.c	509: fix printing uninitialized stack memory when OID is empty	2018-02-25 11:03:40 +01:00
once.c
parser.c
pci_iomap.c
percpu_counter.c
percpu_ida.c
percpu_test.c
percpu-refcount.c
plist.c
pm-notifier-error-inject.c
proportions.c
radix-tree.c	radix-tree: fix race in gang lookup	2016-02-25 12:01:23 -08:00
random32.c
ratelimit.c
rational.c
rbtree_test.c
rbtree.c
reciprocal_div.c
rhashtable.c
scatterlist.c
seq_buf.c
sg_split.c
sha1.c
show_mem.c
smp_processor_id.c
sort.c
stmp_device.c
string_helpers.c	string_helpers: fix precision loss for some inputs	2016-02-25 12:01:21 -08:00
string.c	lib: move strtobool() to kstrtobool()	2016-10-28 03:01:30 -04:00
strncpy_from_user.c
strnlen_user.c
swiotlb.c	swiotlb: ensure that page-sized mappings are page-aligned	2017-07-05 14:37:20 +02:00
syscall.c
test_bpf.c	bpf: introduce BPF_JIT_ALWAYS_ON config	2018-02-03 17:04:24 +01:00
test_firmware.c	test: firmware_class: report errors properly on failure	2017-11-15 17:13:13 +01:00
test_kasan.c
test_module.c
test_printf.c
test_rhashtable.c
test_static_key_base.c
test_static_keys.c
test_user_copy.c	usercopy: Adjust tests to deal with SMAP/PAN	2017-06-14 13:16:27 +02:00
test-hexdump.c
test-kstrtox.c
test-string_helpers.c	lib/test-string_helpers.c: fix and improve string_get_size() tests	2016-05-11 11:21:26 +02:00
textsearch.c
timerqueue.c
ts_bm.c
ts_fsm.c
ts_kmp.c
ucs2_string.c	lib/ucs2_string: Correct ucs2 -> utf8 conversion	2016-03-03 15:07:09 -08:00
usercopy.c
uuid.c
vsprintf.c