Hi Huacai,
On Thu, 2022-11-17 at 12:25 +0800, Huacai Chen wrote:
> Now {pmd,pte}_mkdirty() set _PAGE_DIRTY bit unconditionally, this causes
> random segmentation fault after commit 0ccf7f168e17bb7e ("mm/thp: carry
> over dirty bit when thp splits on pmd").
Hmm, the pte_mkdirty call is already removed in commit 624a2c94f5b7a081
("Partly revert \"mm/thp: carry over dirty bit when thp splits on
pmd\"").
Not sure if this issue is related to some random segfaults I've observed
recently though. My last kernel build contains 0ccf7f168e17bb7e but
does not contain 624a2c94f5b7a081.
>
> The reason is: when fork(), parent process use pmd_wrprotect() to clear
> huge page's _PAGE_WRITE and _PAGE_DIRTY (for COW); then pte_mkdirty() set
> _PAGE_DIRTY as well as _PAGE_MODIFIED while splitting dirty huge pages;
> once _PAGE_DIRTY is set, there will be no tlb modify exception so the COW
> machanism fails; and at last memory corruption occurred between parent
> and child processes.
>
> So, we should set _PAGE_DIRTY only when _PAGE_WRITE is set in {pmd,pte}_
> mkdirty().
>
> Cc: stable@xxxxxxxxxxxxxxx
> Cc: Peter Xu <peterx@xxxxxxxxxx>
> Signed-off-by: Huacai Chen <chenhuacai@xxxxxxxxxxx>
> ---
> Note: CC sparc maillist because they have similar issues.
>
> arch/loongarch/include/asm/pgtable.h | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/arch/loongarch/include/asm/pgtable.h b/arch/loongarch/include/asm/pgtable.h
> index 946704bee599..debbe116f105 100644
> --- a/arch/loongarch/include/asm/pgtable.h
> +++ b/arch/loongarch/include/asm/pgtable.h
> @@ -349,7 +349,9 @@ static inline pte_t pte_mkclean(pte_t pte)
>
> static inline pte_t pte_mkdirty(pte_t pte)
> {
> - pte_val(pte) |= (_PAGE_DIRTY | _PAGE_MODIFIED);
> + pte_val(pte) |= _PAGE_MODIFIED;
> + if (pte_val(pte) & _PAGE_WRITE)
> + pte_val(pte) |= _PAGE_DIRTY;
> return pte;
> }
>
> @@ -478,7 +480,9 @@ static inline pmd_t pmd_mkclean(pmd_t pmd)
>
> static inline pmd_t pmd_mkdirty(pmd_t pmd)
> {
> - pmd_val(pmd) |= (_PAGE_DIRTY | _PAGE_MODIFIED);
> + pmd_val(pmd) |= _PAGE_MODIFIED;
> + if (pmd_val(pmd) & _PAGE_WRITE)
> + pmd_val(pmd) |= _PAGE_DIRTY;
> return pmd;
> }
>
--
Xi Ruoyao <xry111@xxxxxxxxxxx>
School of Aerospace Science and Technology, Xidian University
