diff options
| author | Miaohe Lin <linmiaohe@huawei.com> | 2022-04-28 23:16:09 -0700 |
|---|---|---|
| committer | akpm <akpm@linux-foundation.org> | 2022-04-28 23:16:09 -0700 |
| commit | f3b9e8cc8b09ba3b41bb068c24a1061e8a70d26f (patch) | |
| tree | 70458dc058264b792658417cabe0c1a7dc636b4f | |
| parent | 7d6e2d96384556a4f30547803be1f606eb805a62 (diff) | |
| download | linux-f3b9e8cc8b09ba3b41bb068c24a1061e8a70d26f.tar.bz2 | |
mm/madvise: fix potential pte_unmap_unlock pte error
We can't assume pte_offset_map_lock will return same orig_pte value. So
it's necessary to reacquire the orig_pte or pte_unmap_unlock will unmap
the stale pte.
Link: https://lkml.kernel.org/r/20220416081416.23304-1-linmiaohe@huawei.com
Fixes: 9c276cc65a58 ("mm: introduce MADV_COLD")
Fixes: 854e9ed09ded ("mm: support madvise(MADV_FREE)")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
| -rw-r--r-- | mm/madvise.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/mm/madvise.c b/mm/madvise.c index 1873616a37d2..c965fac7b13a 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -432,12 +432,12 @@ regular_page: if (split_huge_page(page)) { unlock_page(page); put_page(page); - pte_offset_map_lock(mm, pmd, addr, &ptl); + orig_pte = pte_offset_map_lock(mm, pmd, addr, &ptl); break; } unlock_page(page); put_page(page); - pte = pte_offset_map_lock(mm, pmd, addr, &ptl); + orig_pte = pte = pte_offset_map_lock(mm, pmd, addr, &ptl); pte--; addr -= PAGE_SIZE; continue; @@ -648,12 +648,12 @@ static int madvise_free_pte_range(pmd_t *pmd, unsigned long addr, if (split_huge_page(page)) { unlock_page(page); put_page(page); - pte_offset_map_lock(mm, pmd, addr, &ptl); + orig_pte = pte_offset_map_lock(mm, pmd, addr, &ptl); goto out; } unlock_page(page); put_page(page); - pte = pte_offset_map_lock(mm, pmd, addr, &ptl); + orig_pte = pte = pte_offset_map_lock(mm, pmd, addr, &ptl); pte--; addr -= PAGE_SIZE; continue; |