We shouldn't be using a GUP-internal helper if it can be avoided.
Similar to smaps_pte_entry() that uses vm_normal_page(), let's use
vm_normal_page_pmd() that similarly refuses to return the huge zeropage.
In contrast to follow_trans_huge_pmd(), vm_normal_page_pmd():
(1) Will always return the head page, not a tail page of a THP.
If we'd ever call smaps_account with a tail page while setting "compound
= true", we could be in trouble, because smaps_account() would look at
the memmap of unrelated pages.
If we're unlucky, that memmap does not exist at all. Before we removed
PG_doublemap, we could have triggered something similar as in
commit 24d7275ce279 ("fs/proc: task_mmu.c: don't read mapcount for
migration entry").
This can theoretically happen ever since commit ff9f47f6f00c ("mm: proc:
smaps_rollup: do not stall write attempts on mmap_lock"):
(a) We're in show_smaps_rollup() and processed a VMA
(b) We release the mmap lock in show_smaps_rollup() because it is
contended
(c) We merged that VMA with another VMA
(d) We collapsed a THP in that merged VMA at that position
If the end address of the original VMA falls into the middle of a THP
area, we would call smap_gather_stats() with a start address that falls
into a PMD-mapped THP. It's probably very rare to trigger when not
really forced.
(2) Will succeed on a is_pci_p2pdma_page(), like vm_normal_page()
Treat such PMDs here just like smaps_pte_entry() would treat such PTEs.
If such pages would be anonymous, we most certainly would want to
account them.
(3) Will skip over pmd_devmap(), like vm_normal_page() for pte_devmap()
As noted in vm_normal_page(), that is only for handling legacy ZONE_DEVICE
pages. So just like smaps_pte_entry(), we'll now also ignore such PMD
entries.
Especially, follow_pmd_mask() never ends up calling
follow_trans_huge_pmd() on pmd_devmap(). Instead it calls
follow_devmap_pmd() -- which will fail if neither FOLL_GET nor FOLL_PIN
is set.
So skipping pmd_devmap() pages seems to be the right thing to do.
(4) Will properly handle VM_MIXEDMAP/VM_PFNMAP, like vm_normal_page()
We won't be returning a memmap that should be ignored by core-mm, or
worse, a memmap that does not even exist. Note that while
walk_page_range() will skip VM_PFNMAP mappings, walk_page_vma() won't.
Most probably this case doesn't currently really happen on the PMD level,
otherwise we'd already be able to trigger kernel crashes when reading
smaps / smaps_rollup.
So most probably only (1) is relevant in practice as of now, but could only
cause trouble in extreme corner cases.
Fixes: ff9f47f6f00c ("mm: proc: smaps_rollup: do not stall write attempts on mmap_lock")
Signed-off-by: David Hildenbrand <david@redhat.com>
---
fs/proc/task_mmu.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index bf25178ae66a..7a7d6e2e6a14 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -571,8 +571,7 @@ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
bool migration = false;
if (pmd_present(*pmd)) {
- /* FOLL_DUMP will return -EFAULT on huge zero page */
- page = follow_trans_huge_pmd(vma, addr, pmd, FOLL_DUMP);
+ page = vm_normal_page_pmd(vma, addr, *pmd);
} else if (unlikely(thp_migration_supported() && is_swap_pmd(*pmd))) {
swp_entry_t entry = pmd_to_swp_entry(*pmd);
--
2.41.0On Tue, Aug 01, 2023 at 02:48:38PM +0200, David Hildenbrand wrote:
> We shouldn't be using a GUP-internal helper if it can be avoided.
>
> Similar to smaps_pte_entry() that uses vm_normal_page(), let's use
> vm_normal_page_pmd() that similarly refuses to return the huge zeropage.
>
> In contrast to follow_trans_huge_pmd(), vm_normal_page_pmd():
>
> (1) Will always return the head page, not a tail page of a THP.
>
> If we'd ever call smaps_account with a tail page while setting "compound
> = true", we could be in trouble, because smaps_account() would look at
> the memmap of unrelated pages.
>
> If we're unlucky, that memmap does not exist at all. Before we removed
> PG_doublemap, we could have triggered something similar as in
> commit 24d7275ce279 ("fs/proc: task_mmu.c: don't read mapcount for
> migration entry").
>
> This can theoretically happen ever since commit ff9f47f6f00c ("mm: proc:
> smaps_rollup: do not stall write attempts on mmap_lock"):
>
> (a) We're in show_smaps_rollup() and processed a VMA
> (b) We release the mmap lock in show_smaps_rollup() because it is
> contended
> (c) We merged that VMA with another VMA
> (d) We collapsed a THP in that merged VMA at that position
>
> If the end address of the original VMA falls into the middle of a THP
> area, we would call smap_gather_stats() with a start address that falls
> into a PMD-mapped THP. It's probably very rare to trigger when not
> really forced.
>
> (2) Will succeed on a is_pci_p2pdma_page(), like vm_normal_page()
>
> Treat such PMDs here just like smaps_pte_entry() would treat such PTEs.
> If such pages would be anonymous, we most certainly would want to
> account them.
>
> (3) Will skip over pmd_devmap(), like vm_normal_page() for pte_devmap()
>
> As noted in vm_normal_page(), that is only for handling legacy ZONE_DEVICE
> pages. So just like smaps_pte_entry(), we'll now also ignore such PMD
> entries.
>
> Especially, follow_pmd_mask() never ends up calling
> follow_trans_huge_pmd() on pmd_devmap(). Instead it calls
> follow_devmap_pmd() -- which will fail if neither FOLL_GET nor FOLL_PIN
> is set.
>
> So skipping pmd_devmap() pages seems to be the right thing to do.
>
> (4) Will properly handle VM_MIXEDMAP/VM_PFNMAP, like vm_normal_page()
>
> We won't be returning a memmap that should be ignored by core-mm, or
> worse, a memmap that does not even exist. Note that while
> walk_page_range() will skip VM_PFNMAP mappings, walk_page_vma() won't.
>
> Most probably this case doesn't currently really happen on the PMD level,
> otherwise we'd already be able to trigger kernel crashes when reading
> smaps / smaps_rollup.
>
> So most probably only (1) is relevant in practice as of now, but could only
> cause trouble in extreme corner cases.
>
> Fixes: ff9f47f6f00c ("mm: proc: smaps_rollup: do not stall write attempts on mmap_lock")
> Signed-off-by: David Hildenbrand <david@redhat.com>
Maybe move the follow_trans_huge_pmd() declaration from linux/huge_mm.h
to mm/internal.h to discourage future mistakes? Otherwise
Acked-by: Mel Gorman <mgorman@techsingularity.net>
--
Mel Gorman
SUSE Labs
On 02.08.23 17:16, Mel Gorman wrote:
> On Tue, Aug 01, 2023 at 02:48:38PM +0200, David Hildenbrand wrote:
>> We shouldn't be using a GUP-internal helper if it can be avoided.
>>
>> Similar to smaps_pte_entry() that uses vm_normal_page(), let's use
>> vm_normal_page_pmd() that similarly refuses to return the huge zeropage.
>>
>> In contrast to follow_trans_huge_pmd(), vm_normal_page_pmd():
>>
>> (1) Will always return the head page, not a tail page of a THP.
>>
>> If we'd ever call smaps_account with a tail page while setting "compound
>> = true", we could be in trouble, because smaps_account() would look at
>> the memmap of unrelated pages.
>>
>> If we're unlucky, that memmap does not exist at all. Before we removed
>> PG_doublemap, we could have triggered something similar as in
>> commit 24d7275ce279 ("fs/proc: task_mmu.c: don't read mapcount for
>> migration entry").
>>
>> This can theoretically happen ever since commit ff9f47f6f00c ("mm: proc:
>> smaps_rollup: do not stall write attempts on mmap_lock"):
>>
>> (a) We're in show_smaps_rollup() and processed a VMA
>> (b) We release the mmap lock in show_smaps_rollup() because it is
>> contended
>> (c) We merged that VMA with another VMA
>> (d) We collapsed a THP in that merged VMA at that position
>>
>> If the end address of the original VMA falls into the middle of a THP
>> area, we would call smap_gather_stats() with a start address that falls
>> into a PMD-mapped THP. It's probably very rare to trigger when not
>> really forced.
>>
>> (2) Will succeed on a is_pci_p2pdma_page(), like vm_normal_page()
>>
>> Treat such PMDs here just like smaps_pte_entry() would treat such PTEs.
>> If such pages would be anonymous, we most certainly would want to
>> account them.
>>
>> (3) Will skip over pmd_devmap(), like vm_normal_page() for pte_devmap()
>>
>> As noted in vm_normal_page(), that is only for handling legacy ZONE_DEVICE
>> pages. So just like smaps_pte_entry(), we'll now also ignore such PMD
>> entries.
>>
>> Especially, follow_pmd_mask() never ends up calling
>> follow_trans_huge_pmd() on pmd_devmap(). Instead it calls
>> follow_devmap_pmd() -- which will fail if neither FOLL_GET nor FOLL_PIN
>> is set.
>>
>> So skipping pmd_devmap() pages seems to be the right thing to do.
>>
>> (4) Will properly handle VM_MIXEDMAP/VM_PFNMAP, like vm_normal_page()
>>
>> We won't be returning a memmap that should be ignored by core-mm, or
>> worse, a memmap that does not even exist. Note that while
>> walk_page_range() will skip VM_PFNMAP mappings, walk_page_vma() won't.
>>
>> Most probably this case doesn't currently really happen on the PMD level,
>> otherwise we'd already be able to trigger kernel crashes when reading
>> smaps / smaps_rollup.
>>
>> So most probably only (1) is relevant in practice as of now, but could only
>> cause trouble in extreme corner cases.
>>
>> Fixes: ff9f47f6f00c ("mm: proc: smaps_rollup: do not stall write attempts on mmap_lock")
>> Signed-off-by: David Hildenbrand <david@redhat.com>
>
> Maybe move the follow_trans_huge_pmd() declaration from linux/huge_mm.h
> to mm/internal.h to discourage future mistakes? Otherwise
>
Makes sense.
> Acked-by: Mel Gorman <mgorman@techsingularity.net>
Thanks!
--
Cheers,
David / dhildenb
© 2016 - 2026 Red Hat, Inc.