mm: thp: refix false positive BUG in page_move_anon_rmap()

The VM_BUG_ON_PAGE in page_move_anon_rmap() is more trouble than it's worth: the syzkaller fuzzer hit it again. It's still wrong for some THP cases, because linear_page_index() was never intended to apply to addresses before the start of a vma. That's easily fixed with a signed long cast inside linear_page_index(); and Dmitry has tested such a patch, to verify the false positive. But why extend linear_page_index() just for this case? when the avoidance in page_move_anon_rmap() has already grown ugly, and there's no reason for the check at all (nothing else there is using address or index). Remove address arg from page_move_anon_rmap(), remove VM_BUG_ON_PAGE, remove CONFIG_DEBUG_VM PageTransHuge adjustment. And one more thing: should the compound_head(page) be done inside or outside page_move_anon_rmap()? It's usually pushed down to the lowest level nowadays (and mm/memory.c shows no other explicit use of it), so I think it's better done in page_move_anon_rmap() than by caller.

Hugh Dickins committed 10 years ago

Commit 5a499731 parent 55bda434 files · +6 −10Browse files

Unified · Split

4 files

include/linux/rmap.h +1 −1
mm/hugetlb.c +1 −1
mm/memory.c +1 −2
mm/rmap.c +3 −6

include/linux/rmap.h+1−1

@@ -158,7 +158,7 @@ struct anon_vma page_get_anon_vma(struct page page); · 157 unmodified lines
158	/*	158	/*
159	* rmap interfaces called when adding or removing pte of page	159	* rmap interfaces called when adding or removing pte of page
160	*/	160	*/
161	void page_move_anon_rmap(struct page , struct vm_area_struct , unsigned long);	161	void page_move_anon_rmap(struct page , struct vm_area_struct );
162	void page_add_anon_rmap(struct page , struct vm_area_struct ,	162	void page_add_anon_rmap(struct page , struct vm_area_struct ,
163	unsigned long, bool);	163	unsigned long, bool);
164	void do_page_add_anon_rmap(struct page , struct vm_area_struct ,	164	void do_page_add_anon_rmap(struct page , struct vm_area_struct ,

mm/hugetlb.c+1−1

@@ -3383,7 +3383,7 @@ retry_avoidcopy: · 3382 unmodified lines
3383	/* If no-one else is actually using this page, avoid the copy	3383	/* If no-one else is actually using this page, avoid the copy
3384	* and just make the page writable */	3384	* and just make the page writable */
3385	if (page_mapcount(old_page) == 1 && PageAnon(old_page)) {	3385	if (page_mapcount(old_page) == 1 && PageAnon(old_page)) {
3386	page_move_anon_rmap(old_page, vma, address);	3386	page_move_anon_rmap(old_page, vma);
3387	set_huge_ptep_writable(vma, address, ptep);	3387	set_huge_ptep_writable(vma, address, ptep);
3388	return 0;	3388	return 0;
3389	}	3389	}

mm/memory.c+1−2

 				 * Protected against the rmap code by
 				 * the page lock.
 				 */
-				page_move_anon_rmap(compound_head(old_page),
+				page_move_anon_rmap(old_page, vma);
-						    vma, address);
 			}
 			unlock_page(old_page);
 			return wp_page_reuse(mm, vma, address, page_table, ptl,

mm/rmap.c+3−6

  * page_move_anon_rmap - move a page to our anon_vma
  * @page:	the page to move to our anon_vma
  * @vma:	the vma the page belongs to
- * @address:	the user virtual address mapped
  *
  * When a page belongs exclusively to one process after a COW event,
  * that page can be moved into the anon_vma that belongs to just that
  * process, so the rmap code will not search the parent or sibling
  * processes.
  */
-void page_move_anon_rmap(struct page *page,
+void page_move_anon_rmap(struct page *page, struct vm_area_struct *vma)
-	struct vm_area_struct *vma, unsigned long address)
 {
 	struct anon_vma *anon_vma = vma->anon_vma;
+	page = compound_head(page);
 	VM_BUG_ON_PAGE(!PageLocked(page), page);
 	VM_BUG_ON_VMA(!anon_vma, vma);
-	if (IS_ENABLED(CONFIG_DEBUG_VM) && PageTransHuge(page))
-		address &= HPAGE_PMD_MASK;
-	VM_BUG_ON_PAGE(page->index != linear_page_index(vma, address), page);
 	anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON;
 	/*

mm: thp: refix false positive BUG in page_move_anon_rmap()

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code