Subject: + x86-mm-do-not-leak-page-ptl-for-pmd-page-tables.patch added to -mm tree To: kirill.shutemov@xxxxxxxxxxxxxxx,avagin@xxxxxxxxxx,mingo@xxxxxxxxxx,peterz@xxxxxxxxxxxxx From: akpm@xxxxxxxxxxxxxxxxxxxx Date: Wed, 20 Nov 2013 14:47:05 -0800 The patch titled Subject: x86, mm: do not leak page->ptl for pmd page tables has been added to the -mm tree. Its filename is x86-mm-do-not-leak-page-ptl-for-pmd-page-tables.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/x86-mm-do-not-leak-page-ptl-for-pmd-page-tables.patch and later at http://ozlabs.org/~akpm/mmotm/broken-out/x86-mm-do-not-leak-page-ptl-for-pmd-page-tables.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: "Kirill A. Shutemov" <kirill.shutemov@xxxxxxxxxxxxxxx> Subject: x86, mm: do not leak page->ptl for pmd page tables There are two code paths how page with pmd page table can be freed: pmd_free() and pmd_free_tlb(). I've missed the second one and didn't add page table destructor call there. It leads to leak of page->ptl for pmd page tables, if dynamically allocated page->ptl is in use. The patch adds the missed destructor and modifies documentation accordingly. Signed-off-by: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx> Reported-by: Andrey Vagin <avagin@xxxxxxxxxx> Tested-by: Andrey Vagin <avagin@xxxxxxxxxx> Cc: Ingo Molnar <mingo@xxxxxxxxxx> Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- Documentation/vm/split_page_table_lock | 6 +++--- arch/x86/mm/pgtable.c | 4 +++- 2 files changed, 6 insertions(+), 4 deletions(-) diff -puN Documentation/vm/split_page_table_lock~x86-mm-do-not-leak-page-ptl-for-pmd-page-tables Documentation/vm/split_page_table_lock --- a/Documentation/vm/split_page_table_lock~x86-mm-do-not-leak-page-ptl-for-pmd-page-tables +++ a/Documentation/vm/split_page_table_lock @@ -63,9 +63,9 @@ levels. PMD split lock enabling requires pgtable_pmd_page_ctor() call on PMD table allocation and pgtable_pmd_page_dtor() on freeing. -Allocation usually happens in pmd_alloc_one(), freeing in pmd_free(), but -make sure you cover all PMD table allocation / freeing paths: i.e X86_PAE -preallocate few PMDs on pgd_alloc(). +Allocation usually happens in pmd_alloc_one(), freeing in pmd_free() and +pmd_free_tlb(), but make sure you cover all PMD table allocation / freeing +paths: i.e X86_PAE preallocate few PMDs on pgd_alloc(). With everything in place you can set CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK. diff -puN arch/x86/mm/pgtable.c~x86-mm-do-not-leak-page-ptl-for-pmd-page-tables arch/x86/mm/pgtable.c --- a/arch/x86/mm/pgtable.c~x86-mm-do-not-leak-page-ptl-for-pmd-page-tables +++ a/arch/x86/mm/pgtable.c @@ -61,6 +61,7 @@ void ___pte_free_tlb(struct mmu_gather * #if PAGETABLE_LEVELS > 2 void ___pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd) { + struct page *page = virt_to_page(pmd); paravirt_release_pmd(__pa(pmd) >> PAGE_SHIFT); /* * NOTE! For PAE, any changes to the top page-directory-pointer-table @@ -69,7 +70,8 @@ void ___pmd_free_tlb(struct mmu_gather * #ifdef CONFIG_X86_PAE tlb->need_flush_all = 1; #endif - tlb_remove_page(tlb, virt_to_page(pmd)); + pgtable_pmd_page_dtor(page); + tlb_remove_page(tlb, page); } #if PAGETABLE_LEVELS > 3 _ Patches currently in -mm which might be from kirill.shutemov@xxxxxxxxxxxxxxx are origin.patch x86-mm-do-not-leak-page-ptl-for-pmd-page-tables.patch x86-mm-get-aslr-work-for-hugetlb-mappings.patch linux-next.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html