mm: vm_page_prot: update with WRITE_ONCE/READ_ONCE

vma->vm_page_prot is read lockless from the rmap_walk, it may be updated
concurrently and this prevents the risk of reading intermediate values.

Link: http://lkml.kernel.org/r/1474660305-19222-1-git-send-email-aarcange@redhat.com
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Jan Vorlicek <janvorli@microsoft.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/include/linux/mm.h b/include/linux/mm.h
index 3e8807e0b9d2f9457a38c7be3f5f647e543eaf4a..040a04a889967eadc6a1fc469fc8172c8f603e4a 100644 (file)
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1517,7 +1517,7 @@ static inline int pte_devmap(pte_t pte)
 }
 #endif
 
 }
 #endif
 

-int vma_wants_writenotify(struct vm_area_struct *vma);
+int vma_wants_writenotify(struct vm_area_struct *vma, pgprot_t vm_page_prot);

 
 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
                               spinlock_t **ptl);
 
 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
                               spinlock_t **ptl);

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 12b9f1a39b63ecea917cc3ed182233f458a13df6..cdcd25cb30fea3f2ad2c660e547d014b7378b3dd 100644 (file)
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1620,7 +1620,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
                        if (soft_dirty)
                                entry = pte_swp_mksoft_dirty(entry);
                } else {
                        if (soft_dirty)
                                entry = pte_swp_mksoft_dirty(entry);
                } else {

-                       entry = mk_pte(page + i, vma->vm_page_prot);
+                       entry = mk_pte(page + i, READ_ONCE(vma->vm_page_prot));

                        entry = maybe_mkwrite(entry, vma);
                        if (!write)
                                entry = pte_wrprotect(entry);
                        entry = maybe_mkwrite(entry, vma);
                        if (!write)
                                entry = pte_wrprotect(entry);

diff --git a/mm/migrate.c b/mm/migrate.c
index f7ee04a5ae27a2934de9fab746667597bffafef3..99250aee1ac166fd8d5bb03849041b2a07fc3f80 100644 (file)
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -234,7 +234,7 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
                goto unlock;
 
        get_page(new);
                goto unlock;
 
        get_page(new);

-       pte = pte_mkold(mk_pte(new, vma->vm_page_prot));
+       pte = pte_mkold(mk_pte(new, READ_ONCE(vma->vm_page_prot)));

        if (pte_swp_soft_dirty(*ptep))
                pte = pte_mksoft_dirty(pte);
 
        if (pte_swp_soft_dirty(*ptep))
                pte = pte_mksoft_dirty(pte);
 

diff --git a/mm/mmap.c b/mm/mmap.c
index 7a0707a480479f1837cc6537182300bd6d94d51f..b3b74cc705aea3e43741838e712a6244af8b7a45 100644 (file)
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -116,13 +116,15 @@ static pgprot_t vm_pgprot_modify(pgprot_t oldprot, unsigned long vm_flags)
 void vma_set_page_prot(struct vm_area_struct *vma)
 {
        unsigned long vm_flags = vma->vm_flags;
 void vma_set_page_prot(struct vm_area_struct *vma)
 {
        unsigned long vm_flags = vma->vm_flags;

+       pgprot_t vm_page_prot;

 
 

-       vma->vm_page_prot = vm_pgprot_modify(vma->vm_page_prot, vm_flags);
-       if (vma_wants_writenotify(vma)) {
+       vm_page_prot = vm_pgprot_modify(vma->vm_page_prot, vm_flags);
+       if (vma_wants_writenotify(vma, vm_page_prot)) {

                vm_flags &= ~VM_SHARED;
                vm_flags &= ~VM_SHARED;

-               vma->vm_page_prot = vm_pgprot_modify(vma->vm_page_prot,
-                                                    vm_flags);
+               vm_page_prot = vm_pgprot_modify(vm_page_prot, vm_flags);

        }
        }

+       /* remove_protection_ptes reads vma->vm_page_prot without mmap_sem */
+       WRITE_ONCE(vma->vm_page_prot, vm_page_prot);

 }
 
 /*
 }
 
 /*


@@ -1386,7 +1388,7 @@ SYSCALL_DEFINE1(old_mmap, struct mmap_arg_struct __user *, arg)
  * to the private version (using protection_map[] without the
  * VM_SHARED bit).
  */
  * to the private version (using protection_map[] without the
  * VM_SHARED bit).
  */

-int vma_wants_writenotify(struct vm_area_struct *vma)
+int vma_wants_writenotify(struct vm_area_struct *vma, pgprot_t vm_page_prot)

 {
        vm_flags_t vm_flags = vma->vm_flags;
        const struct vm_operations_struct *vm_ops = vma->vm_ops;
 {
        vm_flags_t vm_flags = vma->vm_flags;
        const struct vm_operations_struct *vm_ops = vma->vm_ops;


@@ -1401,8 +1403,8 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
 
        /* The open routine did something to the protections that pgprot_modify
         * won't preserve? */
 
        /* The open routine did something to the protections that pgprot_modify
         * won't preserve? */

-       if (pgprot_val(vma->vm_page_prot) !=
-           pgprot_val(vm_pgprot_modify(vma->vm_page_prot, vm_flags)))
+       if (pgprot_val(vm_page_prot) !=
+           pgprot_val(vm_pgprot_modify(vm_page_prot, vm_flags)))

                return 0;
 
        /* Do we need to track softdirty? */
                return 0;
 
        /* Do we need to track softdirty? */

diff --git a/mm/mprotect.c b/mm/mprotect.c
index a4830f0325fe255ef4e106bb9b982bf7a2747415..063bbed22c7b67a24f114567e027292dc88982ee 100644 (file)
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -327,7 +327,7 @@ success:
         * held in write mode.
         */
        vma->vm_flags = newflags;
         * held in write mode.
         */
        vma->vm_flags = newflags;

-       dirty_accountable = vma_wants_writenotify(vma);
+       dirty_accountable = vma_wants_writenotify(vma, vma->vm_page_prot);

        vma_set_page_prot(vma);
 
        change_protection(vma, start, end, vma->vm_page_prot,
        vma_set_page_prot(vma);
 
        change_protection(vma, start, end, vma->vm_page_prot,