Commit 1267d8f9 authored by Huacai Chen's avatar Huacai Chen Committed by Hongchen Zhang
Browse files

LoongArch: Set _PAGE_DIRTY only if _PAGE_WRITE is set in {pmd,pte}_mkdirty() 

mainline inclusion
from mainline-v6.1-rc7
commit bf2f34a5
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7362E
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/arch/loongarch?id=bf2f34a506e66e2979de6b17c337c5d4b25b4d2c



--------------------------------

Now {pmd,pte}_mkdirty() set _PAGE_DIRTY bit unconditionally, this causes
random segmentation fault after commit 0ccf7f16 ("mm/thp: carry
over dirty bit when thp splits on pmd").

The reason is: when fork(), parent process use pmd_wrprotect() to clear
huge page's _PAGE_WRITE and _PAGE_DIRTY (for COW); then pte_mkdirty() set
_PAGE_DIRTY as well as _PAGE_MODIFIED while splitting dirty huge pages;
once _PAGE_DIRTY is set, there will be no tlb modify exception so the COW
machanism fails; and at last memory corruption occurred between parent
and child processes.

So, we should set _PAGE_DIRTY only when _PAGE_WRITE is set in {pmd,pte}_
mkdirty().

Cc: stable@vger.kernel.org
Cc: Peter Xu <peterx@redhat.com>
Signed-off-by: default avatarHuacai Chen <chenhuacai@loongson.cn>
Change-Id: Iade25111367c20f3cf777630e09eb6a10a62b6a8
parent dd318f86

arch/loongarch/include/asm/pgtable.h

+6 −2
Original line number Diff line number Diff line
@@ -361,7 +361,9 @@ static inline pte_t pte_mkclean(pte_t pte) 


static inline pte_t pte_mkdirty(pte_t pte)

{

	pte_val(pte) |= (_PAGE_DIRTY | _PAGE_MODIFIED);

	pte_val(pte) |= _PAGE_MODIFIED;

	if (pte_val(pte) & _PAGE_WRITE)

		pte_val(pte) |= _PAGE_DIRTY;

	return pte;

}
@@ -487,7 +489,9 @@ static inline pmd_t pmd_mkclean(pmd_t pmd) 


static inline pmd_t pmd_mkdirty(pmd_t pmd)

{

	pmd_val(pmd) |= (_PAGE_DIRTY | _PAGE_MODIFIED);

	pmd_val(pmd) |= _PAGE_MODIFIED;

	if (pmd_val(pmd) & _PAGE_WRITE)

		pmd_val(pmd) |= _PAGE_DIRTY;

	return pmd;

}