s390/mm: fix asce_bits handling with dynamic pagetable levels
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Ubuntu on IBM z Systems |
Fix Released
|
High
|
Andy Whitcroft | ||
linux (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Wily |
Invalid
|
Undecided
|
Unassigned | ||
Xenial |
Fix Released
|
Undecided
|
Tim Gardner | ||
Yakkety |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
== Comment: #0 - Hendrik Brueckner <email address hidden> - 2016-05-23 09:17:08 ==
Please backport the following linux stable commit ID:
s390/mm: fix asce_bits handling with dynamic pagetable levels
commit 723cacbd9dc7958
There is a race with multi-threaded applications between context switch and
pagetable upgrade. In switch_mm() a new user_asce is built from mm->pgd and
mm->context.
pagetable upgrade on another thread in crst_table_
have set new asce_bits, but not yet the new mm->pgd. This would result in a
corrupt user_asce in switch_mm(), and eventually in a kernel panic from a
translation exception.
Fix this by storing the complete asce instead of just the asce_bits, which
can then be read atomically from switch_mm(), so that it either sees the
old value or the new value, but no mixture. Both cases are OK. Having the
old value would result in a page fault on access to the higher level memory,
but the fault handler would see the new mm->pgd, if it was a valid access
after the mmap on the other thread has completed. So as worst-case scenario
we would have a page fault loop for the racing thread until the next time
slice.
Also remove dead code and simplify the upgrade/downgrade path, there are no
upgrades from 2 levels, and only downgrades from 3 levels for compat tasks.
There are also no concurrent upgrades, because the mmap_sem is held with
down_write() in do_mmap, so the flush and table checks during upgrade can
be removed.
Reported-by: Michael Munday <email address hidden>
Reviewed-by: Martin Schwidefsky <email address hidden>
Signed-off-by: Gerald Schaefer <email address hidden>
Signed-off-by: Martin Schwidefsky <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
tags: | added: architecture-s39064 bugnameltc-141692 severity-high targetmilestone-inin16041 |
Changed in ubuntu: | |
assignee: | nobody → Skipper Bug Screeners (skipper-screen-team) |
affects: | ubuntu → linux (Ubuntu) |
Changed in ubuntu-z-systems: | |
status: | New → Triaged |
importance: | Undecided → High |
assignee: | nobody → Andy Whitcroft (apw) |
Changed in linux (Ubuntu Xenial): | |
status: | Fix Released → In Progress |
Changed in linux (Ubuntu Wily): | |
assignee: | Tim Gardner (timg-tpi) → nobody |
Changed in linux (Ubuntu Xenial): | |
assignee: | nobody → Tim Gardner (timg-tpi) |
Changed in ubuntu-z-systems: | |
status: | Triaged → In Progress |
Changed in linux (Ubuntu Xenial): | |
status: | In Progress → Fix Committed |
Changed in ubuntu-z-systems: | |
status: | In Progress → Fix Committed |
Changed in ubuntu-z-systems: | |
status: | Fix Committed → Fix Released |
Released in v4.4.11. This patch will get merged in Ubuntu-4.4.0-24.42 via the normal stable updates process.