Commit 445475d0 authored by Miaohe Lin's avatar Miaohe Lin Committed by Wupeng Ma
Browse files

mm/madvise: fix potential pte_unmap_unlock pte error 

mainline inclusion
from mainline-v5.19-rc1
commit f3b9e8cc
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9JPDJ

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f3b9e8cc8b09ba3b41bb068c24a1061e8a70d26f

--------------------------------

We can't assume pte_offset_map_lock will return same orig_pte value. So
it's necessary to reacquire the orig_pte or pte_unmap_unlock will unmap
the stale pte.

Link: https://lkml.kernel.org/r/20220416081416.23304-1-linmiaohe@huawei.com


Fixes: 9c276cc6 ("mm: introduce MADV_COLD")
Fixes: 854e9ed0 ("mm: support madvise(MADV_FREE)")
Signed-off-by: default avatarMiaohe Lin <linmiaohe@huawei.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarMa Wupeng <mawupeng1@huawei.com>
parent 4aa8e00d

mm/madvise.c

+4 −4
Original line number Diff line number Diff line
@@ -451,12 +451,12 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd, 
			if (split_huge_page(page)) {

				unlock_page(page);

				put_page(page);

				pte_offset_map_lock(mm, pmd, addr, &ptl);

				orig_pte = pte_offset_map_lock(mm, pmd, addr, &ptl);

				break;

			}

			unlock_page(page);

			put_page(page);

			pte = pte_offset_map_lock(mm, pmd, addr, &ptl);

			orig_pte = pte = pte_offset_map_lock(mm, pmd, addr, &ptl);

			pte--;

			addr -= PAGE_SIZE;

			continue;
@@ -669,12 +669,12 @@ static int madvise_free_pte_range(pmd_t *pmd, unsigned long addr, 
			if (split_huge_page(page)) {

				unlock_page(page);

				put_page(page);

				pte_offset_map_lock(mm, pmd, addr, &ptl);

				orig_pte = pte_offset_map_lock(mm, pmd, addr, &ptl);

				goto out;

			}

			unlock_page(page);

			put_page(page);

			pte = pte_offset_map_lock(mm, pmd, addr, &ptl);

			orig_pte = pte = pte_offset_map_lock(mm, pmd, addr, &ptl);

			pte--;

			addr -= PAGE_SIZE;

			continue;