Commit ba385c05 authored Sep 18, 2017 by Gerald Schaefer Committed by Martin Schwidefsky Sep 19, 2017

s390/mm: fix write access check in gup_huge_pmd()

The check for the _SEGMENT_ENTRY_PROTECT bit in gup_huge_pmd() is the
wrong way around. It must not be set for write==1, and not be checked for
write==0. Fix this similar to how it was fixed for ptes long time ago in
commit 25591b07 ("[S390] fix get_user_pages_fast").

One impact of this bug would be unnecessarily using the gup slow path for
write==0 on r/w mappings. A potentially more severe impact would be that
gup_huge_pmd() will succeed for write==1 on r/o mappings.

Cc: <stable@vger.kernel.org>
Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

parent 91c575b3

arch/s390/mm/gup.c

+3 −4

Original line number	Diff line number	Diff line
		@@ -56,13 +56,12 @@ static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
		static inline int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
		unsigned long end, int write, struct page *pages, int nr)
		{
		unsigned long mask, result;
		struct page head, page;
		unsigned long mask;
		int refs;

		result = write ? 0 : _SEGMENT_ENTRY_PROTECT;
		mask = result \| _SEGMENT_ENTRY_INVALID;
		if ((pmd_val(pmd) & mask) != result)
		mask = (write ? _SEGMENT_ENTRY_PROTECT : 0) \| _SEGMENT_ENTRY_INVALID;
		if ((pmd_val(pmd) & mask) != 0)
		return 0;
		VM_BUG_ON(!pfn_valid(pmd_val(pmd) >> PAGE_SHIFT));

Admin message