linux-kernel - [PATCH v3 4/5] mm: hugetlb: fix missing cache flush in hugetlb_mcopy_atomic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220131160254.43211-5-songmuchun@bytedance.com>
Date:   Tue,  1 Feb 2022 00:02:53 +0800
From:   Muchun Song <songmuchun@...edance.com>
To:     akpm@...ux-foundation.org, zi.yan@...rutgers.edu,
        kirill.shutemov@...ux.intel.com, rientjes@...gle.com,
        lars.persson@...s.com, mike.kravetz@...cle.com
Cc:     linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        duanxiongchun@...edance.com, Muchun Song <songmuchun@...edance.com>
Subject: [PATCH v3 4/5] mm: hugetlb: fix missing cache flush in hugetlb_mcopy_atomic_pte()

folio_copy() will copy the data from one page to the target page, then
the target page will be mapped to the user space address, which might
have an alias issue with the kernel address used to copy the data from
the page to.  Fix this issue by flushing dcache but not use
flush_dcache_folio() since it is not backportable.

Fixes: 8cc5fcbb5be8 ("mm, hugetlb: fix racy resv_huge_pages underflow on UFFDIO_COPY")
Signed-off-by: Muchun Song <songmuchun@...edance.com>
---
 mm/hugetlb.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index a1baa198519a..f1f1ab31dc8a 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -5804,6 +5804,8 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
 			goto out;
 		}
 	} else {
+		int i, nr;
+
 		if (vm_shared &&
 		    hugetlbfs_pagecache_present(h, dst_vma, dst_addr)) {
 			put_page(*pagep);
@@ -5819,6 +5821,9 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
 			goto out;
 		}
 		folio_copy(page_folio(page), page_folio(*pagep));
+		nr = compound_nr(page);
+		for (i = 0; i < nr; i++)
+			flush_dcache_page(page + i);
 		put_page(*pagep);
 		*pagep = NULL;
 	}
-- 
2.11.0