On Thu, Jan 03, 2019 at 09:31:16AM -0500, Jerome Glisse wrote: > On Wed, Jan 02, 2019 at 04:21:26PM -0800, Matthew Wilcox wrote: > > > > One of the paths in follow_pte_pmd() initialised the mmu_notifier_range > > incorrectly. > > > > Signed-off-by: Matthew Wilcox <willy@xxxxxxxxxxxxx> > > Fixes: ac46d4f3c432 ("mm/mmu_notifier: use structure for invalidate_range_start/end calls v2") > > Tested-by: Dave Chinner <dchinner@xxxxxxxxxx> > > Actually now that i have read the code again this is not ok to > do so. The caller of follow_pte_pmd() will call range_init and > follow pmd will only update the range address. So existing code > is ok. I think you need to re-read your own patch. `git show ac46d4f3c43241ffa23d5bf36153a0830c0e02cc` @@ -4058,10 +4059,10 @@ static int __follow_pte_pmd(struct mm_struct *mm, unsigned long address, if (!pmdpp) goto out; - if (start && end) { - *start = address & PMD_MASK; - *end = *start + PMD_SIZE; - mmu_notifier_invalidate_range_start(mm, *start, *end); + if (range) { + mmu_notifier_range_init(range, mm, address & PMD_MASK, + (address & PMD_MASK) + PMD_SIZE); + mmu_notifier_invalidate_range_start(range); ... so it's fine to call range_init() *here*. @@ -4069,17 +4070,17 @@ static int __follow_pte_pmd(struct mm_struct *mm, unsign ed long address, [...] if (pmd_none(*pmd) || unlikely(pmd_bad(*pmd))) goto out; - if (start && end) { - *start = address & PAGE_MASK; - *end = *start + PAGE_SIZE; - mmu_notifier_invalidate_range_start(mm, *start, *end); + if (range) { + range->start = address & PAGE_MASK; + range->end = range->start + PAGE_SIZE; + mmu_notifier_invalidate_range_start(range); ... but then *not* here later in the same function? You're not making any sense.