From c1d19aaf7fde95215af01a6f9d8f71540fbeeabf Mon Sep 17 00:00:00 2001 From: martin Date: Tue, 15 Aug 2023 09:44:09 +0000 Subject: [PATCH] Pull up following revision(s) (requested by chs in ticket #327): sys/uvm/uvm_fault.c: revision 1.234 uvm: prevent TLB invalidation races during COW resolution When a thread takes a page fault which results in COW resolution, other threads in the same process can be concurrently accessing that same mapping on other CPUs. When the faulting thread updates the pmap entry at the end of COW processing, the resulting TLB invalidations to other CPUs are not done atomically, so another thread can write to the new writable page and then a third thread might still read from the old read-only page, resulting in inconsistent views of the page by the latter two threads. Fix this by removing the pmap entry entirely for the original page before we install the new pmap entry for the new page, so that the new page can only be modified after the old page is no longer accessible. This fixes PR 56535 as well as the netbsd versions of problems described in various bug trackers: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=225584 https://reviews.freebsd.org/D14347 https://github.com/golang/go/issues/34988 --- sys/uvm/uvm_fault.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/sys/uvm/uvm_fault.c b/sys/uvm/uvm_fault.c index 7e5133f124e9..0ae21b4ad395 100644 --- a/sys/uvm/uvm_fault.c +++ b/sys/uvm/uvm_fault.c @@ -1,4 +1,4 @@ -/* $NetBSD: uvm_fault.c,v 1.231 2022/10/26 23:27:32 riastradh Exp $ */ +/* $NetBSD: uvm_fault.c,v 1.231.2.1 2023/08/15 09:44:09 martin Exp $ */ /* * Copyright (c) 1997 Charles D. Cranor and Washington University. @@ -32,7 +32,7 @@ */ #include -__KERNEL_RCSID(0, "$NetBSD: uvm_fault.c,v 1.231 2022/10/26 23:27:32 riastradh Exp $"); +__KERNEL_RCSID(0, "$NetBSD: uvm_fault.c,v 1.231.2.1 2023/08/15 09:44:09 martin Exp $"); #include "opt_uvmhist.h" @@ -633,8 +633,17 @@ uvmfault_promote(struct uvm_faultinfo *ufi, goto done; } - /* copy page [pg now dirty] */ + /* + * copy the page [pg now dirty] + * + * Remove the pmap entry now for the old page at this address + * so that no thread can modify the new page while any thread + * might still see the old page. + */ if (opg) { + pmap_remove(vm_map_pmap(ufi->orig_map), ufi->orig_rvaddr, + ufi->orig_rvaddr + PAGE_SIZE); + pmap_update(vm_map_pmap(ufi->orig_map)); uvm_pagecopy(opg, pg); } KASSERT(uvm_pagegetdirty(pg) == UVM_PAGE_STATUS_DIRTY);