lockless pgtable walker could see the migration entry pmd in this state
and start interpretting the fields as if it were present, leading to
BadThings (TM). GUP-fast appears to be one such lockless pgtable walker.
Could you please explain how bad things might happen ?
See 2 places where pmdp_get_lockless() is called in gup.c, without the PTL.
These could both return the swap pte for which pmd_mkinvalid() has been called.
In both cases, this would lead to the pmd_present() check eroneously returning
true, eventually causing incorrect interpretation of the pte fields. e.g.:
gup_pmd_range()
pmd_t pmd = pmdp_get_lockless(pmdp);
gup_huge_pmd(pmd, ...)
page = nth_page(pmd_page(orig), (addr & ~PMD_MASK) >> PAGE_SHIFT);
page is guff.
Let me know what you think!
Add JohnH to check GUP code.