From patchwork Mon May 17 14:02:05 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 440961 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5B8C7C43462 for ; Mon, 17 May 2021 14:30:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3C5FC6162F for ; Mon, 17 May 2021 14:30:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240179AbhEQObr (ORCPT ); Mon, 17 May 2021 10:31:47 -0400 Received: from mail.kernel.org ([198.145.29.99]:43164 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239932AbhEQO3i (ORCPT ); Mon, 17 May 2021 10:29:38 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 40BBE6162F; Mon, 17 May 2021 14:14:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1621260882; bh=jZg9Nfkp6NaT9j+pNjhQadU8Qkt9QEg7dV8blh+bJ6k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R3/v6bY3JWo7CJm5h0oI4Bwn5q1+xkN/fdbkGAYDbIp0ziF6tT34/Pq5jRQ0wyPNo 6S++9QzX0ezBbDwfXCx3nJmSaBH4Xd7VLqs3jo0o1jTiXGPRRYJySM0LWUnTkZFvGj /c68jcnLzF3wzXuqqUGMEn8UEjMXmNPZDcqJTgtY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peter Xu , Mike Kravetz , Hugh Dickins , "Joel Fernandes (Google)" , Andrew Morton , Linus Torvalds Subject: [PATCH 5.12 259/363] mm/hugetlb: fix cow where page writtable in child Date: Mon, 17 May 2021 16:02:05 +0200 Message-Id: <20210517140311.350695394@linuxfoundation.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210517140302.508966430@linuxfoundation.org> References: <20210517140302.508966430@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Peter Xu commit 84894e1c42e9f25c17f2888e0c0e1505cb727538 upstream. When rework early cow of pinned hugetlb pages, we moved huge_ptep_get() upper but overlooked a side effect that the huge_ptep_get() will fetch the pte after wr-protection. After moving it upwards, we need explicit wr-protect of child pte or we will keep the write bit set in the child process, which could cause data corrution where the child can write to the original page directly. This issue can also be exposed by "memfd_test hugetlbfs" kselftest. Link: https://lkml.kernel.org/r/20210503234356.9097-3-peterx@redhat.com Fixes: 4eae4efa2c299 ("hugetlb: do early cow when page pinned on src mm") Signed-off-by: Peter Xu Reviewed-by: Mike Kravetz Cc: Hugh Dickins Cc: Joel Fernandes (Google) Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/hugetlb.c | 1 + 1 file changed, 1 insertion(+) --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3905,6 +3905,7 @@ again: * See Documentation/vm/mmu_notifier.rst */ huge_ptep_set_wrprotect(src, addr, src_pte); + entry = huge_pte_wrprotect(entry); } page_dup_rmap(ptepage, true);