On Tue, Jan 3, 2023 at 6:14 PM Jann Horn <jannh@xxxxxxxxxx> wrote:
> Since commit 70cbc3cc78a99 ("mm: gup: fix the fast GUP race against THP
> collapse"), the lockless_pages_from_mm() fastpath rechecks the pmd_t to
> ensure that the page table was not removed by khugepaged in between.
>
> However, lockless_pages_from_mm() still requires that the page table is
> not concurrently freed. Fix it by sending IPIs (if the architecture uses
> semi-RCU-style page table freeing) before freeing/reusing page tables.
>
> Link: https://lkml.kernel.org/r/20221129154730.2274278-2-jannh@xxxxxxxxxx
> Link: https://lkml.kernel.org/r/20221128180252.1684965-2-jannh@xxxxxxxxxx
> Link: https://lkml.kernel.org/r/20221125213714.4115729-2-jannh@xxxxxxxxxx
> Fixes: ba76149f47d8 ("thp: khugepaged")
> Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
> Reviewed-by: Yang Shi <shy828301@xxxxxxxxx>
> Acked-by: David Hildenbrand <david@xxxxxxxxxx>
> Cc: John Hubbard <jhubbard@xxxxxxxxxx>
> Cc: Peter Xu <peterx@xxxxxxxxxx>
> Cc: <stable@xxxxxxxxxxxxxxx>
> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> [manual backport: two of the three places in khugepaged that can free
> ptes were refactored into a common helper between 5.15 and 6.0;
> TLB flushing was refactored between 5.4 and 5.10;
> TLB flushing was refactored between 4.19 and 5.4;
> pmd collapse for PTE-mapped THP was only added in 5.4;
> ugly hack for s390 and arm in <=4.19]
Or if you just want a fixup commit, you can add this to 4.9, 4.14 and 4.19:
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index 0f217bb9b534..0a4cace1cfc4 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -24,7 +24,7 @@
#include "internal.h"
/* gross hack for <=4.19 stable */
-#ifdef CONFIG_S390
+#if defined(CONFIG_S390) || defined(CONFIG_ARM)
static void tlb_remove_table_smp_sync(void *arg)
{
/* Simply deliver the interrupt */
Let me know if you want me to send a fixup instead, since the
broken-on-arm version of this patch is already in a stable RC...
