Files
kernel_xiaomi_cepheus/include/linux
Kirill A. Shutemov 1d798ca3f1 mm: make compound_head() robust
Hugh has pointed that compound_head() call can be unsafe in some
context. There's one example:

	CPU0					CPU1

isolate_migratepages_block()
  page_count()
    compound_head()
      !!PageTail() == true
					put_page()
					  tail->first_page = NULL
      head = tail->first_page
					alloc_pages(__GFP_COMP)
					   prep_compound_page()
					     tail->first_page = head
					     __SetPageTail(p);
      !!PageTail() == true
    <head == NULL dereferencing>

The race is pure theoretical. I don't it's possible to trigger it in
practice. But who knows.

We can fix the race by changing how encode PageTail() and compound_head()
within struct page to be able to update them in one shot.

The patch introduces page->compound_head into third double word block in
front of compound_dtor and compound_order. Bit 0 encodes PageTail() and
the rest bits are pointer to head page if bit zero is set.

The patch moves page->pmd_huge_pte out of word, just in case if an
architecture defines pgtable_t into something what can have the bit 0
set.

hugetlb_cgroup uses page->lru.next in the second tail page to store
pointer struct hugetlb_cgroup. The patch switch it to use page->private
in the second tail page instead. The space is free since ->first_page is
removed from the union.

The patch also opens possibility to remove HUGETLB_CGROUP_MIN_ORDER
limitation, since there's now space in first tail page to store struct
hugetlb_cgroup pointer. But that's out of scope of the patch.

That means page->compound_head shares storage space with:

 - page->lru.next;
 - page->next;
 - page->rcu_head.next;

That's too long list to be absolutely sure, but looks like nobody uses
bit 0 of the word.

page->rcu_head.next guaranteed[1] to have bit 0 clean as long as we use
call_rcu(), call_rcu_bh(), call_rcu_sched(), or call_srcu(). But future
call_rcu_lazy() is not allowed as it makes use of the bit and we can
get false positive PageTail().

[1] http://lkml.kernel.org/g/20150827163634.GD4029@linux.vnet.ibm.com

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-11-06 17:50:42 -08:00
..
2015-10-01 12:48:11 -07:00
2015-06-25 11:49:31 +03:00
2015-10-17 21:22:08 -07:00
2015-10-07 18:08:15 +01:00
2015-08-27 20:47:09 +01:00
2015-10-27 19:34:54 -07:00
2015-05-13 12:04:55 -05:00
2015-08-03 12:01:54 -04:00
2015-10-07 16:02:49 -07:00
2015-09-04 16:54:41 -07:00
2015-09-08 15:35:28 -07:00
2015-10-18 10:14:39 -07:00
2015-10-31 19:05:59 -04:00
2015-06-24 17:49:45 -07:00
2015-11-05 23:10:54 -08:00
2015-05-12 10:46:53 +02:00
2015-06-01 14:33:35 +02:00
2015-06-19 15:18:28 +02:00
2015-09-08 15:35:28 -07:00
2015-05-05 13:40:42 -06:00
2015-10-23 05:44:28 -07:00
2015-08-27 19:40:58 -04:00
2015-10-01 15:06:43 +02:00
2015-10-13 19:01:25 +02:00
2015-06-25 12:06:45 +02:00
2015-08-18 15:49:15 -07:00
2015-07-28 08:50:42 +01:00
2015-04-29 17:17:17 -05:00
2015-04-14 16:49:05 -07:00
2015-11-06 17:50:42 -08:00
2015-06-24 17:49:41 -07:00
2015-11-06 17:50:42 -08:00
2015-10-20 22:10:45 +08:00
2015-07-21 10:39:05 -07:00
2015-06-25 04:20:04 -04:00
2015-10-08 05:26:35 -07:00
2015-08-17 13:32:56 -05:00
2015-09-10 13:29:01 -07:00
2015-09-10 13:29:01 -07:00
2015-11-06 17:50:42 -08:00
2015-09-08 15:35:28 -07:00
2015-09-13 11:27:30 +02:00
2015-04-12 21:03:31 +02:00
2015-10-06 17:08:19 +02:00
2015-10-22 08:59:18 -07:00
2015-08-17 15:40:20 +02:00
2015-05-26 15:23:23 +02:00
2015-06-25 01:13:43 +02:00
2015-04-11 15:53:35 -04:00
2015-09-10 15:36:59 -04:00
2015-06-25 17:00:39 -07:00
2015-10-22 06:22:13 -07:00
2015-08-17 11:25:28 -07:00
2015-10-01 09:57:59 -07:00
2015-10-19 01:01:21 +02:00
2015-10-17 21:32:21 -07:00
2015-04-11 22:29:44 -04:00
2015-09-08 15:35:28 -07:00