Commit 6fe74fb8 authored Jul 03, 2018 by Janosch Frank Committed by Greg Kroah-Hartman Jul 11, 2018

userfaultfd: hugetlbfs: fix userfaultfd_huge_must_wait() pte access

commit 1e2c043628c7736dd56536d16c0ce009bc834ae7 upstream.

Use huge_ptep_get() to translate huge ptes to normal ptes so we can
check them with the huge_pte_* functions.  Otherwise some architectures
will check the wrong values and will not wait for userspace to bring in
the memory.

Link: http://lkml.kernel.org/r/20180626132421.78084-1-frankja@linux.ibm.com


Fixes: 369cd212 ("userfaultfd: hugetlbfs: userfaultfd_huge_must_wait for hugepmd ranges")
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 5893f4c3

fs/userfaultfd.c

+7 −5

Original line number	Diff line number	Diff line
		@@ -220,24 +220,26 @@ static inline bool userfaultfd_huge_must_wait(struct userfaultfd_ctx *ctx,
		unsigned long reason)
		{
		struct mm_struct *mm = ctx->mm;
		pte_t *pte;
		pte_t *ptep, pte;
		bool ret = true;

		VM_BUG_ON(!rwsem_is_locked(&mm->mmap_sem));

		pte = huge_pte_offset(mm, address, vma_mmu_pagesize(vma));
		if (!pte)
		ptep = huge_pte_offset(mm, address, vma_mmu_pagesize(vma));

		if (!ptep)
		goto out;

		ret = false;
		pte = huge_ptep_get(ptep);

		/*
		* Lockless access: we're in a wait_event so it's ok if it
		* changes under us.
		*/
		if (huge_pte_none(*pte))
		if (huge_pte_none(pte))
		ret = true;
		if (!huge_pte_write(*pte) && (reason & VM_UFFD_WP))
		if (!huge_pte_write(pte) && (reason & VM_UFFD_WP))
		ret = true;
		out:
		return ret;