On Tue, Dec 22, 2020 at 3:39 PM Yu Zhao yuzhao@google.com wrote:
- is the false positive because of what we do, and it's causing the
memory corruption because do_wp_page() tries to make copies of pages that seem to be RO but may have stale RW tlb entries pending flush.
Yeah, that's definitely a different bug.
The rule is that the TLB flush has to be done before the page table lock is released.
See zap_pte_range() for an example of doing it right, even in the presence of complexities (ie that has an example of both flushing the TLB, and doing the actual "free the pages after flush", and it does the two cases separately).
Linus