Linux kernel source tree
Go to file
Yu Zhao b98072af60 mm/hugetlb_vmemmap: fix memory loads ordering
Using x86_64 as an example, for a 32KB struct page[] area describing a 2MB
hugeTLB, HVO reduces the area to 4KB by the following steps:

1. Split the (r/w vmemmap) PMD mapping the area into 512 (r/w) PTEs;
2. For the 8 PTEs mapping the area, remap PTE 1-7 to the page mapped
   by PTE 0, and at the same time change the permission from r/w to
   r/o;
3. Free the pages PTE 1-7 used to map, hence the reduction from 32KB
   to 4KB.

However, the following race can happen due to improperly memory loads
ordering:
  CPU 1 (HVO)                     CPU 2 (speculative PFN walker)

  page_ref_freeze()
  synchronize_rcu()
                                  rcu_read_lock()
                                  page_is_fake_head() is false
  vmemmap_remap_pte()
  XXX: struct page[] becomes r/o

  page_ref_unfreeze()
                                  page_ref_count() is not zero

                                  atomic_add_unless(&page->_refcount)
                                  XXX: try to modify r/o struct page[]

Specifically, page_is_fake_head() must be ordered after page_ref_count()
on CPU 2 so that it can only return true for this case, to avoid the later
attempt to modify r/o struct page[].

This patch adds the missing memory barrier and makes the tests on
page_is_fake_head() and page_ref_count() done in the proper order.

Link: https://lkml.kernel.org/r/20250108074822.722696-1-yuzhao@google.com
Fixes: bd225530a4 ("mm/hugetlb_vmemmap: fix race with speculative PFN walkers")
Signed-off-by: Yu Zhao <yuzhao@google.com>
Reported-by: Will Deacon <will@kernel.org>
Closes: https://lore.kernel.org/20241128142028.GA3506@willie-the-truck/
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Muchun Song <muchun.song@linux.dev>
Acked-by: Will Deacon <will@kernel.org>
Cc: Mateusz Guzik <mjguzik@gmail.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-04-01 15:14:42 -07:00
arch Driver core updates for 6.15-rc1 2025-04-01 11:02:03 -07:00
block for-6.15/block-20250322 2025-03-26 18:08:55 -07:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2024-09-20 19:52:48 +03:00
crypto This update includes the following changes: 2025-03-29 10:01:55 -07:00
Documentation Char/Misc/IIO driver updates for 6.15-rc1 2025-04-01 11:26:08 -07:00
drivers Char/Misc/IIO driver updates for 6.15-rc1 2025-04-01 11:26:08 -07:00
fs mm/userfaultfd: fix release hang over concurrent GUP 2025-04-01 15:14:42 -07:00
include mm/hugetlb_vmemmap: fix memory loads ordering 2025-04-01 15:14:42 -07:00
init [ Merge note: this pull request depends on you having merged 2025-03-24 22:06:11 -07:00
io_uring for-6.15/io_uring-reg-vec-20250327 2025-03-28 15:07:04 -07:00
ipc treewide: const qualify ctl_tables where applicable 2025-01-28 13:48:37 +01:00
kernel Driver core updates for 6.15-rc1 2025-04-01 11:02:03 -07:00
lib Char/Misc/IIO driver updates for 6.15-rc1 2025-04-01 11:26:08 -07:00
LICENSES LICENSES: add 0BSD license text 2024-09-01 20:43:24 -07:00
mm - The 6 patch series "Enable strict percpu address space checks" from 2025-04-01 09:29:18 -07:00
net - The 6 patch series "Enable strict percpu address space checks" from 2025-04-01 09:29:18 -07:00
rust Char/Misc/IIO driver updates for 6.15-rc1 2025-04-01 11:26:08 -07:00
samples Char/Misc/IIO driver updates for 6.15-rc1 2025-04-01 11:26:08 -07:00
scripts Char/Misc/IIO driver updates for 6.15-rc1 2025-04-01 11:26:08 -07:00
security Driver core updates for 6.15-rc1 2025-04-01 11:02:03 -07:00
sound - The 7 patch series "powerpc/crash: use generic crashkernel 2025-04-01 10:06:52 -07:00
tools Char/Misc/IIO driver updates for 6.15-rc1 2025-04-01 11:26:08 -07:00
usr kbuild: hdrcheck: fix cross build with clang 2025-03-05 04:06:45 +09:00
virt ARM: 2025-03-25 14:22:07 -07:00
.clang-format clang-format: Update with v6.11-rc1's for_each macro list 2024-08-02 13:20:31 +02:00
.clippy.toml rust: give Clippy the minimum supported Rust version 2025-01-10 00:17:25 +01:00
.cocciconfig
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-13 16:47:52 +02:00
.get_maintainer.ignore MAINTAINERS: Retire Ralf Baechle 2024-11-12 15:48:59 +01:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore rust: use host dylib naming convention to support macOS 2025-01-10 01:01:24 +01:00
.mailmap - The 7 patch series "powerpc/crash: use generic crashkernel 2025-04-01 10:06:52 -07:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS - The 6 patch series "Enable strict percpu address space checks" from 2025-04-01 09:29:18 -07:00
Kbuild drm: ensure drm headers are self-contained and pass kernel-doc 2025-02-12 10:44:43 +02:00
Kconfig io_uring: Rename KConfig to Kconfig 2025-02-19 14:53:27 -07:00
MAINTAINERS Char/Misc/IIO driver updates for 6.15-rc1 2025-04-01 11:26:08 -07:00
Makefile [ Merge note: this pull request depends on you having merged 2025-03-24 22:06:11 -07:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.