linux-kernel - [PATCH] mm: Fix force_flush behavior in zap_pte

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun,  4 May 2014 01:37:27 +0200
From:	Richard Weinberger <richard@....at>
To:	linux-kernel@...r.kernel.org
Cc:	linux-mm@...ck.org, Richard Weinberger <richard@....at>,
	Dave Jones <davej@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	"Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
	Johannes Weiner <hannes@...xchg.org>,
	Sasha Levin <sasha.levin@...cle.com>,
	Hugh Dickins <hughd@...gle.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	toralf.foerster@....de
Subject: [PATCH] mm: Fix force_flush behavior in zap_pte_range()

Commit 1cf35d47 (mm: split 'tlb_flush_mmu()' into tlb flushing and memory freeing parts)
accidently changed the behavior of the force_flush variable.
Before the patch it was set by __tlb_remove_page(). Now it is only set to 1
if __tlb_remove_page() returns false but never set back to 0 if __tlb_remove_page()
returns true. And therefore the flush happens now too often.
This patch restores the old behavior.

Fixes BUG: Bad rss-counter state ...
and
kernel BUG at mm/filemap.c:202!

Reported-by: Dave Jones <davej@...hat.com>
Reported-by: toralf.foerster@....de
Cc: Dave Jones <davej@...hat.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
Cc: Johannes Weiner <hannes@...xchg.org>
Cc: Sasha Levin <sasha.levin@...cle.com>
Cc: Hugh Dickins <hughd@...gle.com> 
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: toralf.foerster@....de
Signed-off-by: Richard Weinberger <richard@....at>
---
 mm/memory.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/mm/memory.c b/mm/memory.c
index 037b812..585885b 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1148,10 +1148,10 @@ again:
 			page_remove_rmap(page);
 			if (unlikely(page_mapcount(page) < 0))
 				print_bad_pte(vma, addr, ptent, page);
-			if (unlikely(!__tlb_remove_page(tlb, page))) {
-				force_flush = 1;
+			force_flush = !__tlb_remove_page(tlb, page);
+			if (force_flush)
 				break;
-			}
+
 			continue;
 		}
 		/*
-- 
1.8.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/