linux/arch/sparc
Rik van Riel 2084140594 mm: fix TLB flush race between migration, and change_protection_range
There are a few subtle races, between change_protection_range (used by
mprotect and change_prot_numa) on one side, and NUMA page migration and
compaction on the other side.

The basic race is that there is a time window between when the PTE gets
made non-present (PROT_NONE or NUMA), and the TLB is flushed.

During that time, a CPU may continue writing to the page.

This is fine most of the time, however compaction or the NUMA migration
code may come in, and migrate the page away.

When that happens, the CPU may continue writing, through the cached
translation, to what is no longer the current memory location of the
process.

This only affects x86, which has a somewhat optimistic pte_accessible.
All other architectures appear to be safe, and will either always flush,
or flush whenever there is a valid mapping, even with no permissions
(SPARC).

The basic race looks like this:

CPU A			CPU B			CPU C

						load TLB entry
make entry PTE/PMD_NUMA
			fault on entry
						read/write old page
			start migrating page
			change PTE/PMD to new page
						read/write old page [*]
flush TLB
						reload TLB from new entry
						read/write new page
						lose data

[*] the old page may belong to a new user at this point!

The obvious fix is to flush remote TLB entries, by making sure that
pte_accessible aware of the fact that PROT_NONE and PROT_NUMA memory may
still be accessible if there is a TLB flush pending for the mm.

This should fix both NUMA migration and compaction.

[mgorman@suse.de: fix build]
Signed-off-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Mel Gorman <mgorman@suse.de>
Cc: Alex Thorlton <athorlton@sgi.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-12-18 19:04:51 -08:00
..
boot sparc: Fix piggyback with newer binutils. 2012-12-03 11:24:25 -08:00
configs perf: Remove PERF_COUNTERS config option 2012-04-26 13:52:52 +02:00
crypto sparc64: Set CRYPTO_TFM_REQ_MAY_SLEEP consistently in CAMELLIA code. 2012-12-19 15:44:31 -08:00
include mm: fix TLB flush race between migration, and change_protection_range 2013-12-18 19:04:51 -08:00
kernel Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2013-11-19 10:40:00 -08:00
lib sparc64: Make PAGE_OFFSET variable. 2013-11-12 15:22:34 -08:00
math-emu sparc64: Make montmul/montsqr/mpmul usable in 32-bit threads. 2012-10-26 15:18:37 -07:00
mm sparc64: merge fix 2013-11-18 15:08:52 -08:00
net net: fix unsafe set_memory_rw from softirq 2013-10-07 15:16:45 -04:00
oprofile sparc: using HZ needs an include of linux/param.h 2009-10-05 00:46:08 -07:00
power sparc64: Hibernation support 2013-03-20 11:06:54 -07:00
prom arch: sparc: prom: looping issue, need additional length check in the outside looping 2013-06-19 02:10:29 -07:00
Kbuild sparc64: Add SHA1 driver making use of the 'sha1' instruction. 2012-08-20 15:08:49 -07:00
Kconfig Kconfig cleanups for v3.13 2013-11-15 14:05:15 -08:00
Kconfig.debug lib: consolidate DEBUG_STACK_USAGE option 2011-05-25 08:39:54 -07:00
Makefile sparc64: Hibernation support 2013-03-20 11:06:54 -07:00