From 28b6860b1cde018c63c40e5db9944b6d1a87498d Mon Sep 17 00:00:00 2001 From: Muchun Song Date: Tue, 9 Aug 2022 22:16:21 +0800 Subject: [PATCH] mm: hugetlb: fix missing cache flush in copy_huge_page_from_user() stable inclusion from stable-v5.10.116 commit c6cbf5431a626fbb13271cacad93ae849b889769 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5L64K Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c6cbf5431a626fbb13271cacad93ae849b889769 -------------------------------- commit e763243cc6cb1fcc720ec58cfd6e7c35ae90a479 upstream. userfaultfd calls copy_huge_page_from_user() which does not do any cache flushing for the target page. Then the target page will be mapped to the user space with a different address (user address), which might have an alias issue with the kernel address used to copy the data from the user to. Fix this issue by flushing dcache in copy_huge_page_from_user(). Link: https://lkml.kernel.org/r/20220210123058.79206-4-songmuchun@bytedance.com Fixes: fa4d75c1de13 ("userfaultfd: hugetlbfs: add copy_huge_page_from_user for hugetlb userfaultfd support") Signed-off-by: Muchun Song Reviewed-by: Mike Kravetz Cc: Axel Rasmussen Cc: David Rientjes Cc: Fam Zheng Cc: Kirill A. Shutemov Cc: Lars Persson Cc: Peter Xu Cc: Xiongchun Duan Cc: Zi Yan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Signed-off-by: Zheng Zengkai Reviewed-by: Wei Li --- mm/memory.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/memory.c b/mm/memory.c index 6d3a07c821fe..3667ec456ace 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -5349,6 +5349,8 @@ long copy_huge_page_from_user(struct page *dst_page, if (rc) break; + flush_dcache_page(subpage); + cond_resched(); } return ret_val; -- GitLab