From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Date: Fri, 1 Dec 2017 04:06:28 +0000 (-0500)
Subject: mm, thp: Do not make page table dirty unconditionally in follow_trans_huge_pmd()
X-Git-Tag: v4.1.12-124.31.3~1503^2~3
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=0927678e0bd57c1853224900d0f710e2f43d85a0;p=users%2Fjedix%2Flinux-maple.git

mm, thp: Do not make page table dirty unconditionally in follow_trans_huge_pmd()

Currently, we unconditionally make page table dirty in
follow_trans_huge_pmd(). However, it should be set only in case of
write access.

This is port of upstream commit: a8f97366452ed491d13cf1e44241bc0b5740b1f0

Orabug: 27165913

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

CVE: CVE-2017-1000405
Signed-off-by: Nitin Gupta <nitin.m.gupta@oracle.com>
Reviewed-by: Dhaval Giani <dhaval.giani@oracle.com>
---

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index b380af5c779b..97fade84118b 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1335,17 +1335,11 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
 	VM_BUG_ON_PAGE(!PageHead(page), page);
 	if (flags & FOLL_TOUCH) {
 		pmd_t _pmd;
-		/*
-		 * We should set the dirty bit only for FOLL_WRITE but
-		 * for now the dirty bit in the pmd is meaningless.
-		 * And if the dirty bit will become meaningful and
-		 * we'll only set it with FOLL_WRITE, an atomic
-		 * set_bit will be required on the pmd to set the
-		 * young bit, instead of the current set_pmd_at.
-		 */
-		_pmd = pmd_mkyoung(pmd_mkdirty(*pmd));
+		_pmd = pmd_mkyoung(*pmd);
+		if (flags & FOLL_WRITE)
+			_pmd = pmd_mkdirty(_pmd);
 		if (pmdp_set_access_flags(vma, addr & HPAGE_PMD_MASK,
-					  pmd, _pmd,  1))
+					  pmd, _pmd, flags & FOLL_WRITE))
 			update_mmu_cache_pmd(vma, addr, pmd);
 	}
 	if ((flags & FOLL_POPULATE) && (vma->vm_flags & VM_LOCKED)) {