qiurui/Centos-kernel-stream-9
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git synced 2026-09-09 00:08:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

mm/uffd: add missing pte_mkdirty() to mfill_atomic_install_pte()

Browse Source 
JIRA: https://issues.redhat.com/browse/RHEL-46006
Upstream Status: RHEL only
Tested: s390x reproducer no longer panics with this patch. No other
        issues seen on x86_64, ppc64le, or aarch64

Downstream patch 653ae76632 ("mm/uffd: always wr-protect pte in
pte|pmd_mkuffd_wp()") partially reverts 8e95bedaa1a ("mm: Fix
CVE-2022-2590 by reverting "mm/shmem: unconditionally set pte dirty in
mic_install_pte"") by removing the following from the routine
mfill_atomic_install_pte():

-       if (writable || !page_in_cache)
-               _dst_pte = pte_mkdirty(_dst_pte);

However, 8e95bedaa1a also removed the call to pte_mkdirty() earlier
in mfill_atomic_install_pte():

        _dst_pte = mk_pte(page, dst_vma->vm_page_prot);
-       _dst_pte = pte_mkdirty(_dst_pte);

653ae76632 did not restore the call to pte_mkdirty(), leading
to unexpected exceptions in s390x kvm guests, like the following:

[2835953.436969] Low-address protection: 0004 ilc:3 [#1] SMP
[2835953.436978] Modules linked in: ...
[2835953.437045] CPU: 2 PID: 1632 Comm: .... Not tainted 5.14.0-570.37.1.el9_6.s390x #1
[2835953.437048] Hardware name: IBM 3931 LA1 400 (KVM/Linux)
[2835953.437049] User PSW : 0705200180000000 000002aa39538b2a
[2835953.437051]            R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:1 AS:0 CC:2 PM:0 RI:0 EA:3
[2835953.437052] User GPRS: 00000000002b45f1 000002aa00000000 000002aa39fd0ff0 ffffffff00120123
[2835953.437054]            000003ff94802200 000003ff94802200 000002aa39fd2280 000003ff94801840
[2835953.437055]            ffffffff00000002 000002aa39fd0fd0 0000000000000000 0000000000000001
[2835953.437056]            000003ff963aef98 000003ffeb279d7f 000003ff947f63d0 000003ff947f62d8
[2835953.437063] User Code: 000002aa39538b1c: 55106004          cl      %r1,4(%r6)
                            000002aa39538b20: a7a40403          brc     10,000002aa39539326
                           #000002aa39538b24: ecb1000100d8      ahik    %r11,%r1,1
                           >000002aa39538b2a: eb1b62440114      csy     %r1,%r11,4676(%r6)
                            000002aa39538b30: a774fff3          brc     7,000002aa39538b16
                            000002aa39538b34: 58109008          l       %r1,8(%r9)
                            000002aa39538b38: eca137b70055      risbg   %r10,%r1,55,183,0
                            000002aa39538b3e: a774fe75          brc     7,000002aa39538828
[2835953.437071] Last Breaking-Event-Address:
[2835953.437071]  [<000002aa39538810>] ....[2aa39380000+2c2000]
[2835953.437081] Kernel panic - not syncing: Fatal exception: panic_on_oops

Signed-off-by: Lucas Oakley <soakley@redhat.com>
This commit is contained in:
Lucas Oakley
2025-11-11 14:59:42 -06:00
parent f07b929571
commit 7684af088b
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mm/userfaultfd.c
+1
View File
@@ -82,6 +82,7 @@ int mfill_atomic_install_pte(pmd_t *dst_pmd,
struct folio *folio;
_dst_pte = mk_pte(page, dst_vma->vm_page_prot);
_dst_pte = pte_mkdirty(_dst_pte);
if (page_in_cache && !vm_shared)
writable = false;
if (writable)