Jean-Philippe Brucker
484354b26e
mm/mmu_notifier: use hlist_add_head_rcu() ...
[ Upstream commit 543bdb2d825fe2400d6e951f1786d92139a16931 ]
Make mmu_notifier_register() safer by issuing a memory barrier before
registering a new notifier. This fixes a theoretical bug on weakly
ordered CPUs. For example, take this simplified use of notifiers by a
driver:
my_struct->mn.ops = &my_ops; /* (1) */
mmu_notifier_register(&my_struct->mn, mm)
...
hlist_add_head(&mn->hlist, &mm->mmu_notifiers); /* (2) */
...
Once mmu_notifier_register() releases the mm locks, another thread can
invalidate a range:
mmu_notifier_invalidate_range()
...
hlist_for_each_entry_rcu(mn, &mm->mmu_notifiers, hlist) {
if (mn->ops->invalidate_range)
The read side relies on the data dependency between mn and ops to ensure
that the pointer is properly initialized. But the write side doesn't have
any dependency between (1) and (2), so they could be reordered and the
readers could dereference an invalid mn->ops. mmu_notifier_register()
does take all the mm locks before adding to the hlist, but those have
acquire semantics which isn't sufficient.
By calling hlist_add_head_rcu() instead of hlist_add_head() we update the
hlist using a store-release, ensuring that readers see prior
initialization of my_struct. This situation is better illustated by
litmus test MP+onceassign+derefonce.
Link: http://lkml.kernel.org/r/20190502133532.24981-1-jean-philippe.brucker@arm.com
Fixes: cddb8a5c14
2019-08-04 09:33:42 +02:00
kasan: avoid -Wmaybe-uninitialized warning
2019-05-08 07:19:07 +02:00
writeback: synchronize sync(2) against cgroup writeback membership switches
2019-05-21 18:49:01 +02:00
mm: balloon: use general non-lru movable page feature
2016-07-26 16:19:19 -07:00
mm: kmemleak: avoid using __va() on addresses that don't have a lowmem mapping
2016-10-11 15:06:33 -07:00
mm/cma.c: fix crash on CMA allocation if bitmap allocation fails
2019-06-22 08:17:12 +02:00
mm/cma_debug.c: fix the break condition in cma_maxchunk_get()
2019-06-22 08:17:12 +02:00
mm, compaction: fix NR_ISOLATED_* stats for pfn based migration
2017-01-12 11:39:32 +01:00
mm: get rid of vmacache_flush_all() entirely
2018-09-19 22:47:17 +02:00
mm/page_ref: add tracepoint to track down page reference manipulation
2016-03-17 15:09:34 -07:00
mm: convert printk(KERN_<LEVEL> to pr_<level>
2016-03-17 15:09:34 -07:00
mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep
2018-02-25 11:05:49 +01:00
mm/fadvise.c: fix signed overflow UBSAN complaint
2018-09-15 09:42:57 +02:00
mm: fault-inject take over bootstrap kmem_cache check
2016-03-15 16:55:16 -07:00
mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
2018-04-24 09:34:18 +02:00
mm/frame_vector.c: release a semaphore in 'get_vaddr_frames()'
2018-11-10 07:42:52 -08:00
mm, frontswap: convert frontswap_enabled to static key
2016-07-26 16:19:19 -07:00
mm: prevent get_user_pages() from overflowing page refcount
2019-06-11 12:22:45 +02:00
mm/highmem: make nr_free_highpages() handles all highmem zones by itself
2016-05-19 19:12:14 -07:00
mm/huge_memory: fix lockdep complaint on 32-bit i_size_read()
2018-12-05 19:42:36 +01:00
hugetlbfs: on restore reserve error path retain subpool reservation
2019-06-22 08:17:12 +02:00
mm, hugetlb_cgroup: round limit_in_bytes down to hugepage size
2016-05-20 17:58:30 -07:00
mm: Add a user_ns owner to mm_struct and fix ptrace permission checks
2017-01-06 10:40:13 +01:00
mm: fix 100% CPU kswapd busyloop on unreclaimable nodes
2018-01-31 12:55:53 +01:00
mm: don't allow deferred pages with NEED_PER_CPU_KM
2018-05-22 16:57:57 +02:00
PM / Hibernate: allow hibernation with PAGE_POISONING_ZERO
2016-09-13 02:35:27 +02:00
mm/khugepaged: collapse_shmem() do not crash on Compound
2018-12-05 19:42:38 +01:00
mm: convert printk(KERN_<LEVEL> to pr_<level>
2016-03-17 15:09:34 -07:00
mm: convert printk(KERN_<LEVEL> to pr_<level>
2016-03-17 15:09:34 -07:00
mm/kmemleak.c: fix check for softirq context
2019-08-04 09:33:41 +02:00
mm/ksm: fix interaction with THP
2018-05-30 07:50:41 +02:00
mm/list_lru.c: fix memory leak in __memcg_init_list_lru_node
2019-06-22 08:17:18 +02:00
x86: remove more uaccess_32.h complexity
2016-05-22 17:21:27 -07:00
mm: madvise(MADV_DODUMP): allow hugetlbfs pages
2018-10-10 08:53:20 +02:00
Disable the __builtin_return_address() warning globally after all
2016-10-12 10:23:41 -07:00
mm/memblock.c: reversed logic in memblock_discard()
2017-08-30 10:21:47 +02:00
memcg: remove memcg_cgroup::id from IDR on mem_cgroup_css_alloc() failure
2018-09-05 09:20:04 +02:00
mm: hwpoison: fix thp split handing in soft_offline_in_use_page()
2019-03-23 13:19:49 +01:00
mm: stop leaking PageTables
2019-02-20 10:18:34 +01:00
mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone
2019-03-13 14:04:58 -07:00
mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified
2019-04-05 22:29:05 +02:00
Revert "mm, mempool: only set __GFP_NOMEMALLOC if there are free elements"
2016-07-28 16:07:41 -07:00
hugetlbfs: fix races and page leaks during migration
2019-03-13 14:04:54 -07:00
mm/mincore.c: make mincore() more conservative
2019-05-21 18:48:58 +02:00
mm/mlock.c: change count_mm_mlocked_page_nr return type
2019-07-10 09:55:43 +02:00
mm: convert printk(KERN_<LEVEL> to pr_<level>
2016-03-17 15:09:34 -07:00
mm: enforce min addr even if capable() in expand_downwards()
2019-03-05 17:57:07 +01:00
mm/mmu_context, sched/core: Fix mmu_context.h assumption
2016-04-28 11:44:19 +02:00
mm/mmu_notifier: use hlist_add_head_rcu()
2019-08-04 09:33:42 +02:00
mm, page_alloc: inline the fast path of the zonelist iterator
2016-05-19 19:12:14 -07:00
x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings
2018-08-15 18:14:45 +02:00
mremap: properly flush TLB before releasing the page
2018-10-20 09:51:31 +02:00
mm: discard memblock data later
2017-08-24 17:12:19 -07:00
ptrace: Don't allow accessing an undumpable mm
2017-01-06 10:40:13 +01:00
oom, oom_reaper: do not enqueue same task twice
2019-02-12 19:45:02 +01:00
mm/page-writeback.c: don't break integrity writeback on ->writepage() error
2019-01-26 09:38:35 +01:00
mem-hotplug: fix node spanned pages when we have a node with only ZONE_MOVABLE
2019-06-22 08:17:12 +02:00
mm/page_ext.c: fix an imbalance with kmemleak
2019-04-05 22:29:06 +02:00
mm/page_idle.c: fix oops because end_pfn is larger than max_pfn
2019-07-10 09:55:38 +02:00
mm/page_io.c: replace some BUG_ON()s with VM_BUG_ON_PAGE()
2016-10-07 18:46:29 -07:00
mm/page_isolation: fix typo: "paes" -> "pages"
2016-10-07 18:46:29 -07:00
mm/page_owner: don't define fields on struct page_ext by hard-coding
2016-10-07 18:46:27 -07:00
mm: check the return value of lookup_page_ext for all call sites
2016-06-03 15:06:22 -07:00
mm/pagewalk.c: report holes in hugetlb ranges
2017-11-24 08:33:42 +01:00
mm: percpu: use pr_fmt to prefix output
2016-03-17 15:09:34 -07:00
percpu: stop printing kernel addresses
2019-04-27 09:34:47 +02:00
mm/thp/migration: switch from flush_tlb_range to flush_pmd_tlb_range
2016-03-17 15:09:34 -07:00
mm: remove write/force parameters from __get_user_pages_unlocked()
2016-10-18 14:13:37 -07:00
fix Christoph's email addresses
2016-03-17 15:09:34 -07:00
mm: silently skip readahead for DAX inodes
2016-08-26 17:39:35 -07:00
mm: migration: fix migration of huge PMD shared pages
2018-11-21 09:26:03 +01:00
tmpfs: fix uninitialized return value in shmem_link
2019-03-23 13:19:44 +01:00
mm/slab.c: fix an infinite loop in leaks_show()
2019-06-22 08:17:13 +02:00
slub: move synchronize_sched out of slab_mutex on shrink
2017-03-22 12:43:38 +01:00
mm: don't warn about large allocations for slab
2018-12-01 09:44:19 +01:00
slub: move synchronize_sched out of slab_mutex on shrink
2017-03-22 12:43:38 +01:00
slub: make ->cpu_partial unsigned int
2018-10-03 17:01:50 -07:00
treewide: replace obsolete _refok by __ref
2016-08-02 17:31:41 -04:00
mm/memory_hotplug: set magic number to page->freelist instead of page->lru.next
2017-10-21 17:21:36 +02:00
thp: reduce usage of huge zero page's atomic counter
2016-10-07 18:46:28 -07:00
mm, swap_cgroup: reschedule when neeed in swap_cgroup_swapoff()
2017-07-05 14:40:17 +02:00
mm, swap: use offset of swap entry as key of swap cache
2016-10-07 18:46:28 -07:00
x86/speculation/l1tf: Limit swap file size to MAX_PA/2
2018-08-15 18:14:45 +02:00
mm: cleancache: fix corruption on missed inode invalidation
2018-12-08 13:05:09 +01:00
mm: usercopy: Check for module addresses
2016-09-20 16:07:39 -07:00
mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros
2016-04-04 10:41:08 -07:00
mm: page_mapped: don't assume compound page is huge or THP
2019-01-16 22:12:32 +01:00
mm: get rid of vmacache_flush_all() entirely
2018-09-19 22:47:17 +02:00
mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512!
2019-04-05 22:29:06 +02:00
mm: vmpressure: fix sending wrong events on underflow
2017-03-12 06:41:43 +01:00
mm: remove seemingly spurious reclaimability check from laptop_mode gating
2018-09-19 22:47:12 +02:00
mm/vmstat.c: fix /proc/vmstat format for CONFIG_DEBUG_TLBFLUSH=y CONFIG_SMP=n
2019-04-27 09:34:46 +02:00
mm: workingset: fix premature shadow node shrinking with cgroups
2017-04-08 09:30:36 +02:00
mm/z3fold.c: avoid modifying HEADLESS page and minor cleanup
2016-06-03 16:02:55 -07:00
mm/zsmalloc.c: fix -Wunneeded-internal-declaration warning
2019-02-27 10:07:03 +01:00
zswap: re-check zswap_is_full() after do zswap_shrink()
2018-09-05 09:20:02 +02:00
484354b26e