| From d3cb8bf6081b8b7a2dabb1264fe968fd870fa595 Mon Sep 17 00:00:00 2001 |
| From: Mel Gorman <mgorman@suse.de> |
| Date: Thu, 2 Oct 2014 19:47:41 +0100 |
| Subject: mm: migrate: Close race between migration completion and mprotect |
| |
| From: Mel Gorman <mgorman@suse.de> |
| |
| commit d3cb8bf6081b8b7a2dabb1264fe968fd870fa595 upstream. |
| |
| A migration entry is marked as write if pte_write was true at the time the |
| entry was created. The VMA protections are not double checked when migration |
| entries are being removed as mprotect marks write-migration-entries as |
| read. It means that potentially we take a spurious fault to mark PTEs write |
| again but it's straight-forward. However, there is a race between write |
| migrations being marked read and migrations finishing. This potentially |
| allows a PTE to be write that should have been read. Close this race by |
| double checking the VMA permissions using maybe_mkwrite when migration |
| completes. |
| |
| [torvalds@linux-foundation.org: use maybe_mkwrite] |
| Signed-off-by: Mel Gorman <mgorman@suse.de> |
| Acked-by: Rik van Riel <riel@redhat.com> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| mm/migrate.c | 5 ++++- |
| 1 file changed, 4 insertions(+), 1 deletion(-) |
| |
| --- a/mm/migrate.c |
| +++ b/mm/migrate.c |
| @@ -146,8 +146,11 @@ static int remove_migration_pte(struct p |
| pte = pte_mkold(mk_pte(new, vma->vm_page_prot)); |
| if (pte_swp_soft_dirty(*ptep)) |
| pte = pte_mksoft_dirty(pte); |
| + |
| + /* Recheck VMA as permissions can change since migration started */ |
| if (is_write_migration_entry(entry)) |
| - pte = pte_mkwrite(pte); |
| + pte = maybe_mkwrite(pte, vma); |
| + |
| #ifdef CONFIG_HUGETLB_PAGE |
| if (PageHuge(new)) { |
| pte = pte_mkhuge(pte); |
