linux-kernel - [PATCH] mm: fix missing wake-up event for FSDAX pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220704074054.32310-1-songmuchun@bytedance.com>
Date:   Mon,  4 Jul 2022 15:40:54 +0800
From:   Muchun Song <songmuchun@...edance.com>
To:     akpm@...ux-foundation.org, willy@...radead.org, jgg@...pe.ca,
        jhubbard@...dia.com, william.kucharski@...cle.com,
        dan.j.williams@...el.com, jack@...e.cz
Cc:     linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        linux-fsdevel@...r.kernel.org, nvdimm@...ts.linux.dev,
        Muchun Song <songmuchun@...edance.com>
Subject: [PATCH] mm: fix missing wake-up event for FSDAX pages

FSDAX page refcounts are 1-based, rather than 0-based: if refcount is
1, then the page is freed.  The FSDAX pages can be pinned through GUP,
then they will be unpinned via unpin_user_page() using a folio variant
to put the page, however, folio variants did not consider this special
case, the result will be to miss a wakeup event (like the user of
__fuse_dax_break_layouts()).

Fixes: d8ddc099c6b3 ("mm/gup: Add gup_put_folio()")
Signed-off-by: Muchun Song <songmuchun@...edance.com>
---
 include/linux/mm.h | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/include/linux/mm.h b/include/linux/mm.h
index 517f9deba56f..32aaa7b06f5a 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1223,6 +1223,9 @@ static inline __must_check bool try_get_page(struct page *page)
  */
 static inline void folio_put(struct folio *folio)
 {
+	if (put_devmap_managed_page(&folio->page))
+		return;
+
 	if (folio_put_testzero(folio))
 		__folio_put(folio);
 }
@@ -1243,8 +1246,13 @@ static inline void folio_put(struct folio *folio)
  */
 static inline void folio_put_refs(struct folio *folio, int refs)
 {
-	if (folio_ref_sub_and_test(folio, refs))
-		__folio_put(folio);
+	/*
+	 * For fsdax managed pages we need to catch refcount transition
+	 * from 2 to 1:
+	 */
+	if (refs > 1)
+		folio_ref_sub(folio, refs - 1);
+	folio_put(folio);
 }
 
 void release_pages(struct page **pages, int nr);
@@ -1268,15 +1276,7 @@ static inline void folios_put(struct folio **folios, unsigned int nr)
 
 static inline void put_page(struct page *page)
 {
-	struct folio *folio = page_folio(page);
-
-	/*
-	 * For some devmap managed pages we need to catch refcount transition
-	 * from 2 to 1:
-	 */
-	if (put_devmap_managed_page(&folio->page))
-		return;
-	folio_put(folio);
+	folio_put(page_folio(page));
 }
 
 /*
-- 
2.11.0