Commit 8a0d9430 authored by David Stevens's avatar David Stevens Committed by Peng Zhang
Browse files

mm/shmem: fix race in shmem_undo_range w/THP 

stable inclusion
from stable-v6.6.8
commit 7a4ae7acd20805940307be98b304871a43288a01
bugzilla: https://gitee.com/openeuler/kernel/issues/I99K53

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7a4ae7acd20805940307be98b304871a43288a01

--------------------------------

commit 55ac8bbe358bdd2f3c044c12f249fd22d48fe015 upstream.

Split folios during the second loop of shmem_undo_range.  It's not
sufficient to only split folios when dealing with partial pages, since
it's possible for a THP to be faulted in after that point.  Calling
truncate_inode_folio in that situation can result in throwing away data
outside of the range being targeted.

[akpm@linux-foundation.org: tidy up comment layout]
Link: https://lkml.kernel.org/r/20230418084031.3439795-1-stevensd@google.com


Fixes: b9a8a419 ("truncate,shmem: Handle truncates that split large folios")
Signed-off-by: default avatarDavid Stevens <stevensd@chromium.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Suleiman Souhlal <suleiman@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarZhangPeng <zhangpeng362@huawei.com>
parent f934393a

mm/shmem.c

+18 −1
Original line number Diff line number Diff line
@@ -1101,7 +1101,24 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, loff_t lend, 
				}

				VM_BUG_ON_FOLIO(folio_test_writeback(folio),

						folio);



				if (!folio_test_large(folio)) {

					truncate_inode_folio(mapping, folio);

				} else if (truncate_inode_partial_folio(folio, lstart, lend)) {

					/*

					 * If we split a page, reset the loop so

					 * that we pick up the new sub pages.

					 * Otherwise the THP was entirely

					 * dropped or the target range was

					 * zeroed, so just continue the loop as

					 * is.

					 */

					if (!folio_test_large(folio)) {

						folio_unlock(folio);

						index = start;

						break;

					}

				}

			}

			folio_unlock(folio);

		}