From: Chen, Kenneth W Date: Wed, 4 Oct 2006 09:15:24 +0000 (-0700) Subject: [PATCH] enforce proper tlb flush in unmap_hugepage_range X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=fe1668ae5bf0145014c71797febd9ad5670d5d05;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git [PATCH] enforce proper tlb flush in unmap_hugepage_range Spotted by Hugh that hugetlb page is free'ed back to global pool before performing any TLB flush in unmap_hugepage_range(). This potentially allow threads to abuse free-alloc race condition. The generic tlb gather code is unsuitable to use by hugetlb, I just open coded a page gathering list and delayed put_page until tlb flush is performed. Cc: Hugh Dickins Signed-off-by: Ken Chen Acked-by: William Irwin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 7c7d03dbf73d..1d709ff528e1 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -364,6 +364,8 @@ void unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start, pte_t *ptep; pte_t pte; struct page *page; + struct page *tmp; + LIST_HEAD(page_list); WARN_ON(!is_vm_hugetlb_page(vma)); BUG_ON(start & ~HPAGE_MASK); @@ -384,12 +386,16 @@ void unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start, continue; page = pte_page(pte); - put_page(page); + list_add(&page->lru, &page_list); add_mm_counter(mm, file_rss, (int) -(HPAGE_SIZE / PAGE_SIZE)); } spin_unlock(&mm->page_table_lock); flush_tlb_range(vma, start, end); + list_for_each_entry_safe(page, tmp, &page_list, lru) { + list_del(&page->lru); + put_page(page); + } } static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,