On Thu, May 18, 2023 at 5:07 AM Ryan Roberts <ryan.roberts@xxxxxxx> wrote:
>
> It is racy to non-atomically read a pte, then clear the young bit, then
> write it back as this could discard dirty information. Further, it is
> bad practice to directly set a pte entry within a table. Instead
> clearing young must go through the arch-provided helper,
> ptep_test_and_clear_young() to ensure it is modified atomically and to
> give the arch code visibility and allow it to check (and potentially
> modify) the operation.
>
> Fixes: 46c3a0accdc4 ("mm/damon/vaddr: separate commonly usable functions")
This should be a separate patch, since it's independent from what the
series tries to do.
And that patch should cc stable, since it fixes user data corruption.
> Signed-off-by: Ryan Roberts <ryan.roberts@xxxxxxx>
> Reviewed-by: Zi Yan <ziy@xxxxxxxxxx>
> ---
> mm/damon/ops-common.c | 16 ++++++----------
> mm/damon/ops-common.h | 4 ++--
> mm/damon/paddr.c | 4 ++--
> mm/damon/vaddr.c | 4 ++--
> 4 files changed, 12 insertions(+), 16 deletions(-)
>
> diff --git a/mm/damon/ops-common.c b/mm/damon/ops-common.c
> index cc63cf953636..acc264b97903 100644
> --- a/mm/damon/ops-common.c
> +++ b/mm/damon/ops-common.c
> @@ -37,7 +37,7 @@ struct folio *damon_get_folio(unsigned long pfn)
> return folio;
> }
>
> -void damon_ptep_mkold(pte_t *pte, struct mm_struct *mm, unsigned long addr)
> +void damon_ptep_mkold(pte_t *pte, struct vm_area_struct *vma, unsigned long addr)
> {
> bool referenced = false;
> struct folio *folio = damon_get_folio(pte_pfn(*pte));
> @@ -45,13 +45,11 @@ void damon_ptep_mkold(pte_t *pte, struct mm_struct *mm, unsigned long addr)
> if (!folio)
> return;
>
> - if (pte_young(*pte)) {
> + if (ptep_test_and_clear_young(vma, addr, pte))
> referenced = true;
> - *pte = pte_mkold(*pte);
> - }
>
> #ifdef CONFIG_MMU_NOTIFIER
> - if (mmu_notifier_clear_young(mm, addr, addr + PAGE_SIZE))
> + if (mmu_notifier_clear_young(vma->vm_mm, addr, addr + PAGE_SIZE))
> referenced = true;
> #endif /* CONFIG_MMU_NOTIFIER */
Use ptep_clear_young_notify(). Similar below.
