mm: hugetlb_vmemmap: fix a race between vmemmap pmd split
authorMuchun Song <songmuchun@bytedance.com>
Fri, 7 Jul 2023 03:38:59 +0000 (11:38 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 19 Sep 2023 10:27:56 +0000 (12:27 +0200)
commit84a212a72c84906f75ed7ea926b2e584a9ce9234
treeb400220958bc3f73176bca2739e59596e392e5e1
parent21ef9e11205fca43785eecf7d4a99528d4de5701
mm: hugetlb_vmemmap: fix a race between vmemmap pmd split

commit 3ce2c24cb68f228590a053d6058a5901cd31af61 upstream.

The local variable @page in __split_vmemmap_huge_pmd() to obtain a pmd
page without holding page_table_lock may possiblely get the page table
page instead of a huge pmd page.

The effect may be in set_pte_at() since we may pass an invalid page
struct, if set_pte_at() wants to access the page struct (e.g.
CONFIG_PAGE_TABLE_CHECK is enabled), it may crash the kernel.

So fix it.  And inline __split_vmemmap_huge_pmd() since it only has one
user.

Link: https://lkml.kernel.org/r/20230707033859.16148-1-songmuchun@bytedance.com
Fixes: d8d55f5616cf ("mm: sparsemem: use page table lock to protect kernel pmd operations")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mm/hugetlb_vmemmap.c