LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH v2 0/2] fix memory leak / panic in ioremap huge pages
@ 2018-03-14 18:01 Toshi Kani
  2018-03-14 18:01 ` [PATCH v2 1/2] mm/vmalloc: Add interfaces to free unmapped page table Toshi Kani
  2018-03-14 18:01 ` [PATCH v2 2/2] x86/mm: implement free pmd/pte page interfaces Toshi Kani
  0 siblings, 2 replies; 24+ messages in thread
From: Toshi Kani @ 2018-03-14 18:01 UTC (permalink / raw)
  To: mhocko, akpm, tglx, mingo, hpa, bp, catalin.marinas
  Cc: guohanjun, will.deacon, wxf.wang, willy, cpandya, linux-mm, x86,
	linux-arm-kernel, linux-kernel

On architectures with CONFIG_HAVE_ARCH_HUGE_VMAP set, ioremap()
may create pud/pmd mappings.  Kernel panic was observed on arm64
systems with Cortex-A75 in the following steps as described by
Hanjun Guo. [1]

 1. ioremap a 4K size, valid page table will build,
 2. iounmap it, pte0 will set to 0;
 3. ioremap the same address with 2M size, pgd/pmd is unchanged,
    then set the a new value for pmd;
 4. pte0 is leaked;
 5. CPU may meet exception because the old pmd is still in TLB,
    which will lead to kernel panic.

This panic is not reproducible on x86.  INVLPG, called from iounmap,
purges all levels of entries associated with purged address on x86.
x86 still has memory leak.

The patch changes the ioremap path to free unmapped page table(s) since
doing so in the unmap path has the following issues:

 - The iounmap() path is shared with vunmap().  Since vmap() only
   supports pte mappings, making vunmap() to free a pte page is an
   overhead for regular vmap users as they do not need a pte page
   freed up.
 - Checking if all entries in a pte page are cleared in the unmap path
   is racy, and serializing this check is expensive.
 - The unmap path calls free_vmap_area_noflush() to do lazy TLB purges.
   Clearing a pud/pmd entry before the lazy TLB purges needs extra TLB
   purge.

Patch 01 adds new interfaces as stubs, which work as workaround of
this issue.  This patch 01 was leveraged from Hanjun's patch. [1]

Patch 02 fixes the issue on x86 by implementing the interfaces.
A separate patch (not included in this series) is necessary for arm64.

[1] https://patchwork.kernel.org/patch/10134581/

---
v2
 - Added cc to stable (Andrew Morton)
 - Added proper function headers (Matthew Wilcox)
 - Added descriptions why fixing in the ioremap path. (Will Deacon)

---
Toshi Kani (2):
 1/2 mm/vmalloc: Add interfaces to free unmapped page table
 2/2 x86/mm: implement free pmd/pte page interfaces

---
 arch/arm64/mm/mmu.c           | 10 ++++++++++
 arch/x86/mm/pgtable.c         | 44 +++++++++++++++++++++++++++++++++++++++++++
 include/asm-generic/pgtable.h | 10 ++++++++++
 lib/ioremap.c                 |  6 ++++--
 4 files changed, 68 insertions(+), 2 deletions(-)

^ permalink raw reply	[flat|nested] 24+ messages in thread

end of thread, other threads:[~2018-04-30 13:43 UTC | newest]

Thread overview: 24+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-03-14 18:01 [PATCH v2 0/2] fix memory leak / panic in ioremap huge pages Toshi Kani
2018-03-14 18:01 ` [PATCH v2 1/2] mm/vmalloc: Add interfaces to free unmapped page table Toshi Kani
2018-03-14 22:38   ` Andrew Morton
2018-03-15 14:27     ` Kani, Toshi
2018-03-14 18:01 ` [PATCH v2 2/2] x86/mm: implement free pmd/pte page interfaces Toshi Kani
2018-03-15  7:39   ` Chintan Pandya
2018-03-15 14:51     ` Kani, Toshi
2018-04-26 14:19   ` Joerg Roedel
2018-04-26 16:21     ` Kani, Toshi
2018-04-26 17:23       ` joro
2018-04-26 17:49         ` Kani, Toshi
2018-04-26 20:07           ` joro
2018-04-26 22:30             ` Kani, Toshi
2018-04-27  7:37               ` joro
2018-04-27 11:39                 ` Michal Hocko
2018-04-27 11:46                   ` joro
2018-04-27 11:52                 ` Chintan Pandya
2018-04-27 12:48                   ` joro
2018-04-27 13:42                     ` Chintan Pandya
2018-04-27 14:31                 ` Kani, Toshi
2018-04-28  9:02                   ` joro
2018-04-28 20:54                     ` Kani, Toshi
2018-04-30  7:30                       ` Chintan Pandya
2018-04-30 13:43                         ` Kani, Toshi

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).