In gather_pte_stats() a THP pmd is cast into a pte, which is wrong because the layouts may differ depending on the architecture. On s390 this will lead to inaccurate numa_maps accounting in /proc because of misguided pte_present() and pte_dirty() checks on the fake pte. On other architectures pte_present() and pte_dirty() may work by chance, but there may be an issue with direct-access (dax) mappings w/o underlying struct pages when HAVE_PTE_SPECIAL is set and THP is available. In vm_normal_page() the fake pte will be checked with pte_special() and because there is no "special" bit in a pmd, this will always return false and the VM_PFNMAP | VM_MIXEDMAP checking will be skipped. On dax mappings w/o struct pages, an invalid struct page pointer would then be returned that can crash the kernel. This patch fixes the numa_maps THP handling by introducing new "_pmd" variants of the can_gather_numa_stats() and vm_normal_page() functions.
Showing the changes to include/linux (1 of 3 files). Show all
Unified · Split
| @@ -1140,6 +1140,8 @@ struct zap_details { · 1139 unmodified lines | |||
| 1140 | 1140 | ||
| 1141 | struct page *vm_normal_page(struct vm_area_struct *vma, unsigned long addr, | 1141 | struct page *vm_normal_page(struct vm_area_struct *vma, unsigned long addr, |
| 1142 | pte_t pte); | 1142 | pte_t pte); |
| 1143 | struct page *vm_normal_page_pmd(struct vm_area_struct *vma, unsigned long addr, | ||
| 1144 | pmd_t pmd); | ||
| 1143 | 1145 | ||
| 1144 | int zap_vma_ptes(struct vm_area_struct *vma, unsigned long address, | 1146 | int zap_vma_ptes(struct vm_area_struct *vma, unsigned long address, |
| 1145 | unsigned long size); | 1147 | unsigned long size); |