linux-kernel - [PATCH 4.14 07/14] mm: hugetlb: fix missing cache flush in copy_huge_page_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 13 May 2022 16:23:23 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     linux-kernel@...r.kernel.org
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org, Muchun Song <songmuchun@...edance.com>,
        Mike Kravetz <mike.kravetz@...cle.com>,
        Axel Rasmussen <axelrasmussen@...gle.com>,
        David Rientjes <rientjes@...gle.com>,
        Fam Zheng <fam.zheng@...edance.com>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Lars Persson <lars.persson@...s.com>,
        Peter Xu <peterx@...hat.com>,
        Xiongchun Duan <duanxiongchun@...edance.com>,
        Zi Yan <ziy@...dia.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: [PATCH 4.14 07/14] mm: hugetlb: fix missing cache flush in copy_huge_page_from_user()

From: Muchun Song <songmuchun@...edance.com>

commit e763243cc6cb1fcc720ec58cfd6e7c35ae90a479 upstream.

userfaultfd calls copy_huge_page_from_user() which does not do any cache
flushing for the target page.  Then the target page will be mapped to
the user space with a different address (user address), which might have
an alias issue with the kernel address used to copy the data from the
user to.

Fix this issue by flushing dcache in copy_huge_page_from_user().

Link: https://lkml.kernel.org/r/20220210123058.79206-4-songmuchun@bytedance.com
Fixes: fa4d75c1de13 ("userfaultfd: hugetlbfs: add copy_huge_page_from_user for hugetlb userfaultfd support")
Signed-off-by: Muchun Song <songmuchun@...edance.com>
Reviewed-by: Mike Kravetz <mike.kravetz@...cle.com>
Cc: Axel Rasmussen <axelrasmussen@...gle.com>
Cc: David Rientjes <rientjes@...gle.com>
Cc: Fam Zheng <fam.zheng@...edance.com>
Cc: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
Cc: Lars Persson <lars.persson@...s.com>
Cc: Peter Xu <peterx@...hat.com>
Cc: Xiongchun Duan <duanxiongchun@...edance.com>
Cc: Zi Yan <ziy@...dia.com>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
---
 mm/memory.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4836,6 +4836,8 @@ long copy_huge_page_from_user(struct pag
 		if (rc)
 			break;
 
+		flush_dcache_page(subpage);
+
 		cond_resched();
 	}
 	return ret_val;