Hugh Dickins 940e8922c1 mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma ... commit ab0c3f1251 upstream. uprobe_write_opcode() uses collapse_pte_mapped_thp() to restore huge pmd, when removing a breakpoint from hugepage text: vma->anon_vma is always set in that case, so undo the prohibition. And MADV_COLLAPSE ought to be able to collapse some page tables in a vma which happens to have anon_vma set from CoWing elsewhere. Is anon_vma lock required? Almost not: if any page other than expected subpage of the non-anon huge page is found in the page table, collapse is aborted without making any change. However, it is possible that an anon page was CoWed from this extent in another mm or vma, in which case a concurrent lookup might look here: so keep it away while clearing pmd (but perhaps we shall go back to using pmd_lock() there in future). Note that collapse_pte_mapped_thp() is exceptional in freeing a page table without having cleared its ptes: I'm uneasy about that, and had thought pte_clear()ing appropriate; but exclusive i_mmap lock does fix the problem, and we would have to move the mmu_notification if clearing those ptes. What this fixes is not a dangerous instability. But I suggest Cc stable because uprobes "healing" has regressed in that way, so this should follow 8d3c106e19 into those stable releases where it was backported (and may want adjustment there - I'll supply backports as needed). Link: https://lkml.kernel.org/r/b740c9fb-edba-92ba-59fb-7a5592e5dfc@google.com Fixes: 8d3c106e19 ("mm/khugepaged: take the right locks for page table retraction") Signed-off-by: Hugh Dickins <hughd@google.com> Acked-by: David Hildenbrand <david@redhat.com> Cc: Jann Horn <jannh@google.com> Cc: Yang Shi <shy828301@gmail.com> Cc: Zach O'Keefe <zokeefe@google.com> Cc: Song Liu <songliubraving@fb.com> Cc: <stable@vger.kernel.org> [5.4+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-01-24 07:22:49 +01:00
..
damon	mm/damon/dbgfs: check if rm_contexts input is for a real context	2022-11-16 09:58:27 +01:00
kasan	kasan: prevent cpu_quarantine corruption when CPU offline and cache shrink occur at same time	2022-05-09 09:14:41 +02:00
kfence	mm/kfence: reset PG_slab and memcg_data before freeing __kfence_pool	2022-05-25 09:57:23 +02:00
Kconfig	kmap_local: don't assume kmap PTEs are linear arrays in memory	2021-11-25 09:48:43 +01:00
Kconfig.debug	…
Makefile	mm: introduce Data Access MONitor (DAMON)	2021-09-08 11:50:24 -07:00
backing-dev.c	writeback: avoid use-after-free after removing device	2022-08-31 17:16:47 +02:00
balloon_compaction.c	…
bootmem_info.c	bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem	2022-08-31 17:16:48 +02:00
cleancache.c	…
cma.c	Revert "mm/cma.c: remove redundant cma_mutex lock"	2022-06-09 10:23:27 +02:00
cma.h	…
cma_debug.c	…
cma_sysfs.c	…
compaction.c	mm, compaction: fix fast_isolate_around() to stay within boundaries	2023-01-12 11:58:47 +01:00
debug.c	mm/debug: sync up latest migrate_reason to migrate_reason_names	2021-09-24 16:13:35 -07:00
debug_page_ref.c	…
debug_vm_pgtable.c	mm/debug_vm_pgtable: remove pte entry from the page table	2022-02-08 18:34:05 +01:00
dmapool.c	…
early_ioremap.c	mm/early_ioremap.c: remove redundant early_ioremap_shutdown()	2021-09-08 11:50:24 -07:00
fadvise.c	…
failslab.c	…
filemap.c	mm: fs: initialize fsdata passed to write_begin/write_end interface	2022-11-26 09:24:51 +01:00
frontswap.c	…
gup.c	mm/gup: fix gup_pud_range() for dax	2022-12-14 11:37:20 +01:00
gup_test.c	…
gup_test.h	…
highmem.c	highmem: fix checks in __kmap_local_sched_{in,out}	2022-04-13 20:59:21 +02:00
hmm.c	mm/hmm: fault non-owner device private entries	2022-08-03 12:03:54 +02:00
huge_memory.c	mm/huge_memory: use pfn_to_online_page() in split_huge_pages_all()	2022-10-12 09:53:28 +02:00
hugetlb.c	hugetlb: unshare some PMDs when splitting VMAs	2023-01-24 07:22:43 +01:00
hugetlb_cgroup.c	…
hugetlb_vmemmap.c	…
hugetlb_vmemmap.h	…
hwpoison-inject.c	mm/hwpoison: avoid the impact of hwpoison_filter() return value on mce handler	2022-07-12 16:35:05 +02:00
init-mm.c	…
internal.h	mm/numa: automatically generate node migration order	2021-09-03 09:58:16 -07:00
interval_tree.c	…
io-mapping.c	…
ioremap.c	mm: move ioremap_page_range to vmalloc.c	2021-09-08 11:50:24 -07:00
khugepaged.c	mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma	2023-01-24 07:22:49 +01:00
kmemleak.c	Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()"	2022-09-15 11:30:00 +02:00
ksm.c	mm/ksm: remove old GCC 4.9+ check	2021-09-13 10:18:28 -07:00
list_lru.c	…
maccess.c	maccess: Fix writing offset in case of fault in strncpy_from_kernel_nofault()	2022-11-26 09:24:47 +01:00
madvise.c	mm: fix madivse_pageout mishandling on non-LRU page	2022-10-05 10:39:39 +02:00
mapping_dirty_helpers.c	…
memblock.c	mm: Always release pages to the buddy allocator in memblock_free_late().	2023-01-18 11:48:57 +01:00
memcontrol.c	memcg: fix possible use-after-free in memcg_write_event_control()	2022-12-14 11:37:19 +01:00
memfd.c	memfd: fix F_SEAL_WRITE after shmem huge page allocated	2022-03-08 19:12:48 +01:00
memory-failure.c	hugetlbfs: don't delete error page from pagecache	2022-11-26 09:24:33 +01:00
memory.c	mm: fix page leak with multiple threads mapping the same page	2022-08-03 12:03:42 +02:00
memory_hotplug.c	Merge branch 'akpm' (patches from Andrew)	2021-09-08 12:55:35 -07:00
mempolicy.c	mm/mempolicy: fix get_nodes out of bound access	2022-08-17 14:23:47 +02:00
mempool.c	…
memremap.c	mm/memremap.c: map FS_DAX device memory as decrypted	2022-11-16 09:58:27 +01:00
memtest.c	…
migrate.c	mm/migrate_device.c: flush TLB while holding PTL	2022-10-05 10:39:39 +02:00
mincore.c	…
mlock.c	mm/mlock: fix potential imbalanced rlimit ucounts adjustment	2022-05-15 20:18:53 +02:00
mm_init.c	…
mmap.c	mm/mmap: undo ->mmap() when arch_validate_flags() fails	2022-10-26 12:34:24 +02:00
mmap_lock.c	…
mmu_gather.c	mm/khugepaged: fix GUP-fast interaction by sending IPI	2022-12-14 11:37:17 +01:00
mmu_notifier.c	mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove()	2022-04-27 14:38:58 +02:00
mmzone.c	…
mprotect.c	mm: don't try to NUMA-migrate COW pages that have other uses	2022-02-23 12:03:03 +01:00
mremap.c	mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)	2022-04-13 20:59:22 +02:00
msync.c	…
nommu.c	Merge tag 'denywrite-for-5.15' of git://github.com/davidhildenbrand/linux	2021-09-04 11:35:47 -07:00
oom_kill.c	oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup	2022-04-27 14:38:58 +02:00
page-writeback.c	writeback: avoid use-after-free after removing device	2022-08-31 17:16:47 +02:00
page_alloc.c	mm: prevent page_frag_alloc() from corrupting the memory	2022-10-05 10:39:39 +02:00
page_counter.c	…
page_ext.c	mm/migrate: add CPU hotplug to demotion #ifdef	2021-10-18 20:22:02 -10:00
page_idle.c	mm/idle_page_tracking: make PG_idle reusable	2021-09-08 11:50:24 -07:00
page_io.c	mm: fix unexpected zeroed page mapping with zram swap	2022-04-20 09:34:18 +02:00
page_isolation.c	Merge branch 'akpm' (patches from Andrew)	2021-09-08 12:55:35 -07:00
page_owner.c	mm: remove pfn_valid_within() and CONFIG_HOLES_IN_ZONE	2021-09-08 11:50:22 -07:00
page_poison.c	…
page_reporting.c	…
page_reporting.h	…
page_vma_mapped.c	…
pagewalk.c	mm: pagewalk: Fix race between unmap and page walker	2022-09-08 12:28:05 +02:00
percpu-internal.h	…
percpu-km.c	…
percpu-stats.c	…
percpu-vm.c	…
percpu.c	Merge branch 'akpm' (patches from Andrew)	2021-09-08 12:55:35 -07:00
pgalloc-track.h	…
pgtable-generic.c	…
process_vm_access.c	…
ptdump.c	mm: pagewalk: Fix race between unmap and page walker	2022-09-08 12:28:05 +02:00
readahead.c	…
rmap.c	mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse	2022-09-05 10:30:07 +02:00
rodata_test.c	…
secretmem.c	mm: fix dereferencing possible ERR_PTR	2022-10-05 10:39:39 +02:00
shmem.c	mm: shmem: don't truncate page if memory failure happens	2022-11-26 09:24:28 +01:00
shuffle.c	…
shuffle.h	…
slab.c	mm, kfence: support kmem_dump_obj() for KFENCE objects	2022-04-27 14:38:51 +02:00
slab.h	mm, kfence: support kmem_dump_obj() for KFENCE objects	2022-04-27 14:38:51 +02:00
slab_common.c	mm, kfence: support kmem_dump_obj() for KFENCE objects	2022-04-27 14:38:51 +02:00
slob.c	mm, kfence: support kmem_dump_obj() for KFENCE objects	2022-04-27 14:38:51 +02:00
slub.c	mm: slub: fix flush_cpu_slab()/__free_slab() invocations in task context.	2022-09-28 11:11:44 +02:00
sparse-vmemmap.c	…
sparse.c	mm: introduce memmap_alloc() to unify memory map allocation	2021-09-03 09:58:15 -07:00
swap.c	mm: fs: invalidate bh_lrus for only cold path	2021-09-24 16:13:35 -07:00
swap_cgroup.c	…
swap_slots.c	…
swap_state.c	mm: swap: get rid of livelock in swapin readahead	2022-03-23 09:16:41 +01:00
swapfile.c	mm, memcg: inline swap-related functions to improve disabled memcg config	2021-09-03 09:58:12 -07:00
truncate.c	Merge branch 'akpm' (patches from Andrew)	2021-09-03 10:08:28 -07:00
usercopy.c	mm/usercopy: return 1 from hardened_usercopy __setup() handler	2022-04-08 14:24:14 +02:00
userfaultfd.c	mm: shmem: don't truncate page if memory failure happens	2022-11-26 09:24:28 +01:00
util.c	mm: vmalloc: introduce array allocation functions	2022-07-12 16:35:01 +02:00
vmacache.c	…
vmalloc.c	mm: defer kmemleak object creation of module_alloc()	2022-03-08 19:12:38 +01:00
vmpressure.c	mm/vmpressure: replace vmpressure_to_css() with vmpressure_to_memcg()	2021-09-03 09:58:17 -07:00
vmscan.c	mm: __isolate_lru_page_prepare() in isolate_migratepages_block()	2022-12-08 11:28:44 +01:00
vmstat.c	mm/vmstat: protect per cpu variables with preempt disable on RT	2021-09-08 15:32:34 -07:00
workingset.c	memcg: sync flush only if periodic flush is delayed	2022-04-27 14:38:57 +02:00
z3fold.c	…
zbud.c	…
zpool.c	…
zsmalloc.c	zsmalloc: fix races between asynchronous zspage free and page migration	2022-06-06 08:43:39 +02:00
zswap.c	…