Commit ef947b25 authored Mar 09, 2017 by Dan Williams Committed by Linus Torvalds Mar 09, 2017

x86, mm: fix gup_pte_range() vs DAX mappings

gup_pte_range() fails to check pte_allows_gup() before translating a DAX
pte entry, pte_devmap(), to a page.  This allows writes to read-only
mappings, and bypasses the DAX cacheline dirty tracking due to missed
'mkwrite' faults.  The gup_huge_pmd() path and the gup_huge_pud() path
correctly check pte_allows_gup() before checking for _devmap() entries.

Fixes: 3565fce3 ("mm, x86: get_user_pages() for dax mappings")
Link: http://lkml.kernel.org/r/148804251312.36605.12665024794196605053.stgit@dwillia2-desk3.amr.corp.intel.com


Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Reported-by: Dave Hansen <dave.hansen@linux.intel.com>
Reported-by: Ross Zwisler <ross.zwisler@linux.intel.com>
Cc: Xiong Zhou <xzhou@redhat.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent d19469e8

arch/x86/mm/gup.c

+6 −2

Original line number	Diff line number	Diff line
		@@ -120,6 +120,11 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
		return 0;
		}

		if (!pte_allows_gup(pte_val(pte), write)) {
		pte_unmap(ptep);
		return 0;
		}

		if (pte_devmap(pte)) {
		pgmap = get_dev_pagemap(pte_pfn(pte), pgmap);
		if (unlikely(!pgmap)) {
		@@ -127,8 +132,7 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
		pte_unmap(ptep);
		return 0;
		}
		} else if (!pte_allows_gup(pte_val(pte), write) \|\|
		pte_special(pte)) {
		} else if (pte_special(pte)) {
		pte_unmap(ptep);
		return 0;
		}

Admin message