From patchwork Thu Apr 28 15:42:11 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 567476 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46547C43217 for ; Thu, 28 Apr 2022 15:42:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349453AbiD1PqH (ORCPT ); Thu, 28 Apr 2022 11:46:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34902 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349432AbiD1PqG (ORCPT ); Thu, 28 Apr 2022 11:46:06 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F2F5B97BA4; Thu, 28 Apr 2022 08:42:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9FE92B82919; Thu, 28 Apr 2022 15:42:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8E5B9C385AE; Thu, 28 Apr 2022 15:42:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1651160569; bh=vTiTP7APfnXW+lzB1PYghHO5btI5VUE0Bb+7eSWCJao=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vj5em6zaSmA0fQ4h3Wl+2NIaKChNi94AD96GtWWo210nnOg5ILZLXWP35M5oJoCE1 rsQwqEMcRH0VCQX178rpyK5ad++NlYKQtNRa35M7H1DBpHAeigQS/egrLE5xDiVKy/ bJ2RigzmX2F+nbsUDf6ObfNbYAeFPvCg+wuUbmsc= From: Greg Kroah-Hartman To: stable@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Muchun Song , Mike Kravetz , Axel Rasmussen , David Rientjes , Fam Zheng , "Kirill A . Shutemov" , Lars Persson , Peter Xu , Xiongchun Duan , Zi Yan , Andrew Morton , Linus Torvalds , Greg Kroah-Hartman Subject: [PATCH AUTOSEL 03/14] mm: hugetlb: fix missing cache flush in copy_huge_page_from_user() Date: Thu, 28 Apr 2022 17:42:11 +0200 Message-Id: <20220428154222.1230793-3-gregkh@linuxfoundation.org> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220428154222.1230793-1-gregkh@linuxfoundation.org> References: <20220428154222.1230793-1-gregkh@linuxfoundation.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1634; i=gregkh@linuxfoundation.org; h=from:subject; bh=RDNUkPqpYNC5Fqd1rPdREkz34APkzrftk+046XZIsXU=; b=owGbwMvMwCRo6H6F97bub03G02pJDElZW+8w9h6q2DrPSUctb/PaO1o2O1PniZ57Iv1iZoRWl0fU /A+fO2JZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAikXwM8yv97fbsizJcusV7puzR3m 3BfYdvvmJYcKXWgj/77RUB926ODUdS7X7UpRpsBQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Muchun Song commit e763243cc6cb1fcc720ec58cfd6e7c35ae90a479 upstream. userfaultfd calls copy_huge_page_from_user() which does not do any cache flushing for the target page. Then the target page will be mapped to the user space with a different address (user address), which might have an alias issue with the kernel address used to copy the data from the user to. Fix this issue by flushing dcache in copy_huge_page_from_user(). Link: https://lkml.kernel.org/r/20220210123058.79206-4-songmuchun@bytedance.com Fixes: fa4d75c1de13 ("userfaultfd: hugetlbfs: add copy_huge_page_from_user for hugetlb userfaultfd support") Signed-off-by: Muchun Song Reviewed-by: Mike Kravetz Cc: Axel Rasmussen Cc: David Rientjes Cc: Fam Zheng Cc: Kirill A. Shutemov Cc: Lars Persson Cc: Peter Xu Cc: Xiongchun Duan Cc: Zi Yan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/memory.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/memory.c b/mm/memory.c index b69afe3dd597..886925d97759 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -5475,6 +5475,8 @@ long copy_huge_page_from_user(struct page *dst_page, if (rc) break; + flush_dcache_page(subpage); + cond_resched(); } return ret_val;