From: Mike Rapoport rppt@linux.ibm.com
The check in gup_pte_range() whether a page belongs to a secretmem mapping is performed before grabbing the page reference.
To avoid potential race move the check after try_grab_compound_head().
Signed-off-by: Mike Rapoport rppt@linux.ibm.com --- mm/gup.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/mm/gup.c b/mm/gup.c index c3a17b189064..6515f82b0f32 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -2080,13 +2080,15 @@ static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end, VM_BUG_ON(!pfn_valid(pte_pfn(pte))); page = pte_page(pte);
- if (page_is_secretmem(page)) - goto pte_unmap; - head = try_grab_compound_head(page, 1, flags); if (!head) goto pte_unmap;
+ if (unlikely(page_is_secretmem(page))) { + put_compound_head(head, 1, flags); + goto pte_unmap; + } + if (unlikely(pte_val(pte) != pte_val(*ptep))) { put_compound_head(head, 1, flags); goto pte_unmap;