On Thu, Nov 26, 2020 at 12:56:06PM +0000, Matthew Wilcox wrote: > On Thu, Nov 26, 2020 at 01:42:07PM +0100, Peter Zijlstra wrote: > > + pgdp = pgd_offset(mm, addr); > > + pgd = READ_ONCE(*pgdp); > > I forget how x86-32-PAE maps to Linux's PGD/P4D/PUD/PMD scheme, but > according to volume 3, section 4.4.2, PAE paging uses a 64-bit PDE, so > whether a PDE is a PGD or a PMD, we're only reading it with READ_ONCE > rather than the lockless-retry method used by ptep_get_lockless(). > So it's potentially racy? Do we need a pmdp_get_lockless() or > pgdp_get_lockless()? Oh gawd... this isn't new here though, right? Current gup_fast also gets that wrong, if it is in deed wrong. I suppose it's a race far more likely today, with THP and all, than it ever was back then.
