From 50c150f26261e723523f077a67378736fa7511a4 Mon Sep 17 00:00:00 2001 From: Rik van Riel Date: Fri, 17 Aug 2018 15:48:53 -0700 Subject: [PATCH] Revert "mm: always flush VMA ranges affected by zap_page_range" There was a bug in Linux that could cause madvise (and mprotect?) system calls to return to userspace without the TLB having been flushed for all the pages involved. This could happen when multiple threads of a process made simultaneous madvise and/or mprotect calls. This was noticed in the summer of 2017, at which time two solutions were created: 56236a59556c ("mm: refactor TLB gathering API") 99baac21e458 ("mm: fix MADV_[FREE|DONTNEED] TLB flush miss problem") and 4647706ebeee ("mm: always flush VMA ranges affected by zap_page_range") We need only one of these solutions, and the former appears to be a little more efficient than the latter, so revert that one. This reverts 4647706ebeee6e50 ("mm: always flush VMA ranges affected by zap_page_range") Link: http://lkml.kernel.org/r/20180706131019.51e3a5f0@imladris.surriel.com Signed-off-by: Rik van Riel Acked-by: Mel Gorman Cc: Andy Lutomirski Cc: Michal Hocko Cc: Minchan Kim Cc: "Kirill A. Shutemov" Cc: Mel Gorman Cc: "Aneesh Kumar K.V" Cc: Nicholas Piggin Cc: Nadav Amit Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- mm/memory.c | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-) diff --git a/mm/memory.c b/mm/memory.c index ae2ec887508b..19f47d7b9b86 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1613,20 +1613,8 @@ void zap_page_range(struct vm_area_struct *vma, unsigned long start, tlb_gather_mmu(&tlb, mm, start, end); update_hiwater_rss(mm); mmu_notifier_invalidate_range_start(mm, start, end); - for ( ; vma && vma->vm_start < end; vma = vma->vm_next) { + for ( ; vma && vma->vm_start < end; vma = vma->vm_next) unmap_single_vma(&tlb, vma, start, end, NULL); - - /* - * zap_page_range does not specify whether mmap_sem should be - * held for read or write. That allows parallel zap_page_range - * operations to unmap a PTE and defer a flush meaning that - * this call observes pte_none and fails to flush the TLB. - * Rather than adding a complex API, ensure that no stale - * TLB entries exist when this call returns. - */ - flush_tlb_range(vma, start, end); - } - mmu_notifier_invalidate_range_end(mm, start, end); tlb_finish_mmu(&tlb, start, end); }