On Thu, Nov 26, 2020 at 02:06:19PM +0100, Peter Zijlstra wrote: > On Thu, Nov 26, 2020 at 12:56:06PM +0000, Matthew Wilcox wrote: > > On Thu, Nov 26, 2020 at 01:42:07PM +0100, Peter Zijlstra wrote: > > > + pgdp = pgd_offset(mm, addr); > > > + pgd = READ_ONCE(*pgdp); > > > > I forget how x86-32-PAE maps to Linux's PGD/P4D/PUD/PMD scheme, but > > according to volume 3, section 4.4.2, PAE paging uses a 64-bit PDE, so > > whether a PDE is a PGD or a PMD, we're only reading it with READ_ONCE > > rather than the lockless-retry method used by ptep_get_lockless(). > > So it's potentially racy? Do we need a pmdp_get_lockless() or > > pgdp_get_lockless()? > > Oh gawd... this isn't new here though, right? Current gup_fast also gets > that wrong, if it is in deed wrong. > > I suppose it's a race far more likely today, with THP and all, than it > ever was back then. Right, it's not new. I wouldn't block this patchset for that fix. Just want to get the problem on your radar ;-) I just never reviewed the gup fast codepath before, and this jumped out at me.
