linux-kernel - [PATCH 1/1] userfaultfd: remove WRITE_ONCE when setting folio->index during UFFDIO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240415020821.1152951-1-surenb@google.com>
Date: Sun, 14 Apr 2024 19:08:21 -0700
From: Suren Baghdasaryan <surenb@...gle.com>
To: akpm@...ux-foundation.org
Cc: willy@...radead.org, david@...hat.com, peterx@...hat.com, 
	lokeshgidra@...gle.com, linux-mm@...ck.org, linux-kernel@...r.kernel.org, 
	surenb@...gle.com
Subject: [PATCH 1/1] userfaultfd: remove WRITE_ONCE when setting folio->index
 during UFFDIO_MOVE

When folio is moved with UFFDIO_MOVE it gets locked before the rmap and
index are modified. Due to the folio lock being already held, WRITE_ONCE()
is not needed when setting the folio index. Remove it.

Reported-by: Matthew Wilcox <willy@...radead.org>
Signed-off-by: Suren Baghdasaryan <surenb@...gle.com>
Cc: David Hildenbrand <david@...hat.com>
Cc: Peter Xu <peterx@...hat.com>
Cc: Lokesh Gidra <lokeshgidra@...gle.com>
---
 mm/huge_memory.c | 2 +-
 mm/userfaultfd.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 58f2c4745d80..ee12726291f1 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2200,7 +2200,7 @@ int move_pages_huge_pmd(struct mm_struct *mm, pmd_t *dst_pmd, pmd_t *src_pmd, pm
 		}
 
 		folio_move_anon_rmap(src_folio, dst_vma);
-		WRITE_ONCE(src_folio->index, linear_page_index(dst_vma, dst_addr));
+		src_folio->index = linear_page_index(dst_vma, dst_addr);
 
 		_dst_pmd = mk_huge_pmd(&src_folio->page, dst_vma->vm_page_prot);
 		/* Follow mremap() behavior and treat the entry dirty after the move */
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index b70618e8dcd2..575ccf90325a 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -1026,7 +1026,7 @@ static int move_present_pte(struct mm_struct *mm,
 	}
 
 	folio_move_anon_rmap(src_folio, dst_vma);
-	WRITE_ONCE(src_folio->index, linear_page_index(dst_vma, dst_addr));
+	src_folio->index = linear_page_index(dst_vma, dst_addr);
 
 	orig_dst_pte = mk_pte(&src_folio->page, dst_vma->vm_page_prot);
 	/* Follow mremap() behavior and treat the entry dirty after the move */

base-commit: 3aec6b2b34e219898883d1e9ea7e911b4d3762a9
-- 
2.44.0.683.g7961c838ac-goog