On Wed, 7 Mar 2018 11:32:26 -0700 Toshi Kani <toshi.kani@xxxxxxx> wrote: > On architectures with CONFIG_HAVE_ARCH_HUGE_VMAP set, ioremap() > may create pud/pmd mappings. Kernel panic was observed on arm64 > systems with Cortex-A75 in the following steps as described by > Hanjun Guo. > > 1. ioremap a 4K size, valid page table will build, > 2. iounmap it, pte0 will set to 0; > 3. ioremap the same address with 2M size, pgd/pmd is unchanged, > then set the a new value for pmd; > 4. pte0 is leaked; > 5. CPU may meet exception because the old pmd is still in TLB, > which will lead to kernel panic. > > This panic is not reproducible on x86. INVLPG, called from iounmap, > purges all levels of entries associated with purged address on x86. > x86 still has memory leak. > > Add two interfaces, pud_free_pmd_page() and pmd_free_pte_page(), > which clear a given pud/pmd entry and free up a page for the lower > level entries. > > This patch implements their stub functions on x86 and arm64, which > work as workaround. Also, as this fixes an arm64 kernel panic, should we be using cc:stable?
