summaryrefslogtreecommitdiff
path: root/mm/memremap.c
diff options
context:
space:
mode:
authorMiaohe Lin <linmiaohe@huawei.com>2022-06-09 15:13:05 +0300
committerakpm <akpm@linux-foundation.org>2022-06-17 05:48:31 +0300
commit1e57ffb6e3fd9583268c6462c4e3853575b21701 (patch)
tree4b76609ac9ac17d254cf50fb74d9b2d9b8dd8b14 /mm/memremap.c
parent84c326299191042a719655d3327538fc52aa8473 (diff)
downloadlinux-1e57ffb6e3fd9583268c6462c4e3853575b21701.tar.xz
mm/memremap: fix memunmap_pages() race with get_dev_pagemap()
Think about the below scene: CPU1 CPU2 memunmap_pages percpu_ref_exit __percpu_ref_exit free_percpu(percpu_count); /* percpu_count is freed here! */ get_dev_pagemap xa_load(&pgmap_array, PHYS_PFN(phys)) /* pgmap still in the pgmap_array */ percpu_ref_tryget_live(&pgmap->ref) if __ref_is_percpu /* __PERCPU_REF_ATOMIC_DEAD not set yet */ this_cpu_inc(*percpu_count) /* access freed percpu_count here! */ ref->percpu_count_ptr = __PERCPU_REF_ATOMIC_DEAD; /* too late... */ pageunmap_range To fix the issue, do percpu_ref_exit() after pgmap_array is emptied. So we won't do percpu_ref_tryget_live() against a being freed percpu_ref. Link: https://lkml.kernel.org/r/20220609121305.2508-1-linmiaohe@huawei.com Fixes: b7b3c01b1915 ("mm/memremap_pages: support multiple ranges per invocation") Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> Cc: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'mm/memremap.c')
-rw-r--r--mm/memremap.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/mm/memremap.c b/mm/memremap.c
index 377ccbc7e356..8b5c8fd4ea8e 100644
--- a/mm/memremap.c
+++ b/mm/memremap.c
@@ -141,10 +141,10 @@ void memunmap_pages(struct dev_pagemap *pgmap)
for (i = 0; i < pgmap->nr_range; i++)
percpu_ref_put_many(&pgmap->ref, pfn_len(pgmap, i));
wait_for_completion(&pgmap->done);
- percpu_ref_exit(&pgmap->ref);
for (i = 0; i < pgmap->nr_range; i++)
pageunmap_range(pgmap, i);
+ percpu_ref_exit(&pgmap->ref);
WARN_ONCE(pgmap->altmap.alloc, "failed to free all reserved pages\n");
devmap_managed_enable_put(pgmap);