On Tue, 5 Nov 2019 22:09:29 -0800 Song Liu <songliubraving@xxxxxx> wrote: > In collapse_file(), for !is_shmem case, current check cannot guarantee > the locked page is up-to-date. Specifically, xas_unlock_irq() should > not be called before lock_page() and get_page(); and it is necessary to > recheck PageUptodate() after locking the page. > > With this bug and CONFIG_READ_ONLY_THP_FOR_FS=y, madvise(HUGE)'ed .text > may contain corrupted data. This is because khugepaged mistakenly > collapses some not up-to-date sub pages into a huge page, and assumes > the huge page is up-to-date. This will NOT corrupt data in the disk, > because the page is read-only and never written back. Fix this by > properly checking PageUptodate() after locking the page. This check > replaces "VM_BUG_ON_PAGE(!PageUptodate(page), page);". > > Also, move PageDirty() check after locking the page. Current > khugepaged should not try to collapse dirty file THP, because it is > limited to read-only .text. The only case we hit a dirty page here is > when the page hasn't been written since write. Bail out and retry when > this happens. Incorrect data is pretty serious. Should we backport this into -stable kernels? (I suspect I already asked this in response to earier versions, sorry ;))
