From: Miaohe Lin Date: Wed, 5 May 2021 01:37:45 +0000 (-0700) Subject: ksm: fix potential missing rmap_item for stable_node X-Git-Tag: microblaze-v5.14~41^2~49 X-Git-Url: http://git.monstr.eu/?a=commitdiff_plain;h=c89a384e2551c692a9fe60d093fd7080f50afc51;p=linux-2.6-microblaze.git ksm: fix potential missing rmap_item for stable_node When removing rmap_item from stable tree, STABLE_FLAG of rmap_item is cleared with head reserved. So the following scenario might happen: For ksm page with rmap_item1: cmp_and_merge_page stable_node->head = &migrate_nodes; remove_rmap_item_from_tree, but head still equal to stable_node; try_to_merge_with_ksm_page failed; return; For the same ksm page with rmap_item2, stable node migration succeed this time. The stable_node->head does not equal to migrate_nodes now. For ksm page with rmap_item1 again: cmp_and_merge_page stable_node->head != &migrate_nodes && rmap_item->head == stable_node return; We would miss the rmap_item for stable_node and might result in failed rmap_walk_ksm(). Fix this by set rmap_item->head to NULL when rmap_item is removed from stable tree. Link: https://lkml.kernel.org/r/20210330140228.45635-5-linmiaohe@huawei.com Fixes: 4146d2d673e8 ("ksm: make !merge_across_nodes migration safe") Signed-off-by: Miaohe Lin Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- diff --git a/mm/ksm.c b/mm/ksm.c index 4b25f642f4ec..e2ba4ebc2500 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -791,6 +791,7 @@ static void remove_rmap_item_from_tree(struct rmap_item *rmap_item) stable_node->rmap_hlist_len--; put_anon_vma(rmap_item->anon_vma); + rmap_item->head = NULL; rmap_item->address &= PAGE_MASK; } else if (rmap_item->address & UNSTABLE_FLAG) {