lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Tue,  6 Oct 2015 18:23:33 +0300
From:	"Kirill A. Shutemov" <>
To:	Andrew Morton <>,
	Andrea Arcangeli <>,
	Hugh Dickins <>
Cc:	Dave Hansen <>, Mel Gorman <>,
	Rik van Riel <>,
	Vlastimil Babka <>,
	Christoph Lameter <>,
	Naoya Horiguchi <>,
	Steve Capper <>,
	"Aneesh Kumar K.V" <>,
	Johannes Weiner <>,
	Michal Hocko <>,
	Jerome Marchand <>,
	Sasha Levin <>,,,
	"Kirill A. Shutemov" <>
Subject: [PATCHv12 06/37] mm: handle PTE-mapped tail pages in gerneric fast gup implementaiton

With new refcounting we are going to see THP tail pages mapped with PTE.
Generic fast GUP rely on page_cache_get_speculative() to obtain
reference on page. page_cache_get_speculative() always fails on tail
pages, because ->_count on tail pages is always zero.

Let's handle tail pages in gup_pte_range().

New split_huge_page() will rely on migration entries to freeze page's
counts. Recheck PTE value after page_cache_get_speculative() on head
page should be enough to serialize against split.

Signed-off-by: Kirill A. Shutemov <>
Tested-by: Sasha Levin <>
Tested-by: Aneesh Kumar K.V <>
Acked-by: Jerome Marchand <>
Acked-by: Vlastimil Babka <>
 mm/gup.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/mm/gup.c b/mm/gup.c
index 745a50f2d57d..6880085d3790 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1097,7 +1097,7 @@ static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end,
 		 * for an example see gup_get_pte in arch/x86/mm/gup.c
 		pte_t pte = READ_ONCE(*ptep);
-		struct page *page;
+		struct page *head, *page;
 		 * Similar to the PMD case below, NUMA hinting must take slow
@@ -1109,15 +1109,17 @@ static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end,
 		page = pte_page(pte);
+		head = compound_head(page);
-		if (!page_cache_get_speculative(page))
+		if (!page_cache_get_speculative(head))
 			goto pte_unmap;
 		if (unlikely(pte_val(pte) != pte_val(*ptep))) {
-			put_page(page);
+			put_page(head);
 			goto pte_unmap;
+		VM_BUG_ON_PAGE(compound_head(page) != head, page);
 		pages[*nr] = page;

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

Powered by blists - more mailing lists