From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4602EC4708D for ; Wed, 30 Nov 2022 22:51:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229698AbiK3Wv5 (ORCPT ); Wed, 30 Nov 2022 17:51:57 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58042 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229722AbiK3Wvv (ORCPT ); Wed, 30 Nov 2022 17:51:51 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 044BD6034D; Wed, 30 Nov 2022 14:51:50 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 93F1261E24; Wed, 30 Nov 2022 22:51:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E93CFC433D7; Wed, 30 Nov 2022 22:51:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1669848709; bh=k3BreU5Dijb+3js79bXG5+/BEld5nAFAxIy7ygp7OK0=; h=Date:To:From:Subject:From; b=NfIzyGRWmMeoy7h+ePo7H4LXax8cKMinV3NWKTYAEMDx2oohuq18xp8TBXM+dtwUp PjuFnQ/OmKt+VrF1ul0tFNJyQSNZyheobBCJgXGzQrTrUV9Jir3Pkg1AllRJsxV+vt jHCTBtxUZHlUiw1P6HR2dhQm+siSgt1fTrAqfMy4= Date: Wed, 30 Nov 2022 14:51:48 -0800 To: mm-commits@vger.kernel.org, stable@vger.kernel.org, shy828301@gmail.com, peterx@redhat.com, jhubbard@nvidia.com, david@redhat.com, jannh@google.com, akpm@linux-foundation.org From: Andrew Morton Subject: [merged mm-hotfixes-stable] mm-khugepaged-invoke-mmu-notifiers-in-shmem-file-collapse-paths.patch removed from -mm tree Message-Id: <20221130225148.E93CFC433D7@smtp.kernel.org> Precedence: bulk Reply-To: linux-kernel@vger.kernel.org List-ID: X-Mailing-List: mm-commits@vger.kernel.org The quilt patch titled Subject: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths has been removed from the -mm tree. Its filename was mm-khugepaged-invoke-mmu-notifiers-in-shmem-file-collapse-paths.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Jann Horn Subject: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Date: Fri, 25 Nov 2022 22:37:14 +0100 Any codepath that zaps page table entries must invoke MMU notifiers to ensure that secondary MMUs (like KVM) don't keep accessing pages which aren't mapped anymore. Secondary MMUs don't hold their own references to pages that are mirrored over, so failing to notify them can lead to page use-after-free. I'm marking this as addressing an issue introduced in commit f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages"), but most of the security impact of this only came in commit 27e1f8273113 ("khugepaged: enable collapse pmd for pte-mapped THP"), which actually omitted flushes for the removal of present PTEs, not just for the removal of empty page tables. Link: https://lkml.kernel.org/r/20221129154730.2274278-3-jannh@google.com Link: https://lkml.kernel.org/r/20221128180252.1684965-3-jannh@google.com Link: https://lkml.kernel.org/r/20221125213714.4115729-3-jannh@google.com Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages") Signed-off-by: Jann Horn Acked-by: David Hildenbrand Reviewed-by: Yang Shi Cc: John Hubbard Cc: Peter Xu Cc: Signed-off-by: Andrew Morton --- mm/khugepaged.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/mm/khugepaged.c~mm-khugepaged-invoke-mmu-notifiers-in-shmem-file-collapse-paths +++ a/mm/khugepaged.c @@ -1399,6 +1399,7 @@ static void collapse_and_free_pmd(struct unsigned long addr, pmd_t *pmdp) { pmd_t pmd; + struct mmu_notifier_range range; mmap_assert_write_locked(mm); if (vma->vm_file) @@ -1410,8 +1411,12 @@ static void collapse_and_free_pmd(struct if (vma->anon_vma) lockdep_assert_held_write(&vma->anon_vma->root->rwsem); + mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, NULL, mm, addr, + addr + HPAGE_PMD_SIZE); + mmu_notifier_invalidate_range_start(&range); pmd = pmdp_collapse_flush(vma, addr, pmdp); tlb_remove_table_sync_one(); + mmu_notifier_invalidate_range_end(&range); mm_dec_nr_ptes(mm); page_table_check_pte_clear_range(mm, addr, pmd); pte_free(mm, pmd_pgtable(pmd)); _ Patches currently in -mm which might be from jannh@google.com are