57 lines
2.1 KiB
Diff
57 lines
2.1 KiB
Diff
From d165b8446312b442d98a7072eebdbf98f30cdb11 Mon Sep 17 00:00:00 2001
|
|
From: Sasha Levin <sashal@kernel.org>
|
|
Date: Thu, 31 Jul 2025 10:44:31 -0400
|
|
Subject: mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE
|
|
|
|
With CONFIG_HIGHPTE on 32-bit ARM, move_pages_pte() maps PTE pages using
|
|
kmap_local_page(), which requires unmapping in Last-In-First-Out order.
|
|
|
|
The current code maps dst_pte first, then src_pte, but unmaps them in the
|
|
same order (dst_pte, src_pte), violating the LIFO requirement. This
|
|
causes the warning in kunmap_local_indexed():
|
|
|
|
WARNING: CPU: 0 PID: 604 at mm/highmem.c:622 kunmap_local_indexed+0x178/0x17c
|
|
addr \!= __fix_to_virt(FIX_KMAP_BEGIN + idx)
|
|
|
|
Fix this by reversing the unmap order to respect LIFO ordering.
|
|
|
|
This issue follows the same pattern as similar fixes:
|
|
- commit eca6828403b8 ("crypto: skcipher - fix mismatch between mapping and unmapping order")
|
|
- commit 8cf57c6df818 ("nilfs2: eliminate staggered calls to kunmap in nilfs_rename")
|
|
|
|
Both of which addressed the same fundamental requirement that kmap_local
|
|
operations must follow LIFO ordering.
|
|
|
|
Link: https://lkml.kernel.org/r/20250731144431.773923-1-sashal@kernel.org
|
|
Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
|
|
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
Acked-by: David Hildenbrand <david@redhat.com>
|
|
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
|
|
Cc: Andrea Arcangeli <aarcange@redhat.com>
|
|
Cc: <stable@vger.kernel.org>
|
|
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
---
|
|
mm/userfaultfd.c | 9 +++++++--
|
|
1 file changed, 7 insertions(+), 2 deletions(-)
|
|
|
|
--- a/mm/userfaultfd.c
|
|
+++ b/mm/userfaultfd.c
|
|
@@ -1453,10 +1453,15 @@ out:
|
|
folio_unlock(src_folio);
|
|
folio_put(src_folio);
|
|
}
|
|
- if (dst_pte)
|
|
- pte_unmap(dst_pte);
|
|
+ /*
|
|
+ * Unmap in reverse order (LIFO) to maintain proper kmap_local
|
|
+ * index ordering when CONFIG_HIGHPTE is enabled. We mapped dst_pte
|
|
+ * first, then src_pte, so we must unmap src_pte first, then dst_pte.
|
|
+ */
|
|
if (src_pte)
|
|
pte_unmap(src_pte);
|
|
+ if (dst_pte)
|
|
+ pte_unmap(dst_pte);
|
|
mmu_notifier_invalidate_range_end(&range);
|
|
if (si)
|
|
put_swap_device(si);
|