On Thu, Sep 14, 2023 at 2:57 PM Nadav Amit nadav.amit@gmail.com wrote:
On Sep 14, 2023, at 8:26 AM, Suren Baghdasaryan surenb@google.com wrote:
if (!pte_same(ptep_clear_flush(src_vma, src_addr, src_pte),orig_src_pte))BUG_ON(1);Just a minor detail regarding these few lines:
Besides the less-than-ideal use of BUG_ON() here, I think that this code assumes that the PTE cannot change at this point. However, as the PTE was still mapped at this point, I think the access and dirty bits can be set.
At this point we are holding PTLs for both PTEs (see double_pt_lock()). Can a PTE be modified from under us in this situation?
tl;dr: this appears to be triggerable by userspace.
[ as for the performance of this code, the lack of batching would mean that for multithreaded applications where more than a single page is remapped, performance would suffer ]
Thanks for the note! I'll see if it's possible to implement some batching mechanism here. Thanks, Suren.