The patch titled Subject: mm/hugetlb: fix cow where page writable in child has been removed from the -mm tree. Its filename was mm-hugetlb-fix-cow-where-page-writtable-in-child.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------ From: Peter Xu peterx@redhat.com Subject: mm/hugetlb: fix cow where page writtable in child

When rework early cow of pinned hugetlb pages, we moved huge_ptep_get() upper but overlooked a side effect that the huge_ptep_get() will fetch the pte after wr-protection. After moving it upwards, we need explicit wr-protect of child pte or we will keep the write bit set in the child process, which could cause data corrution where the child can write to the original page directly.

This issue can also be exposed by "memfd_test hugetlbfs" kselftest.

Link: https://lkml.kernel.org/r/20210503234356.9097-3-peterx@redhat.com Fixes: 4eae4efa2c299 ("hugetlb: do early cow when page pinned on src mm") Signed-off-by: Peter Xu peterx@redhat.com Reviewed-by: Mike Kravetz mike.kravetz@oracle.com Cc: Hugh Dickins hughd@google.com Cc: Joel Fernandes (Google) joel@joelfernandes.org Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org ---

mm/hugetlb.c | 1 + 1 file changed, 1 insertion(+)

--- a/mm/hugetlb.c~mm-hugetlb-fix-cow-where-page-writtable-in-child +++ a/mm/hugetlb.c @@ -4056,6 +4056,7 @@ again: * See Documentation/vm/mmu_notifier.rst */ huge_ptep_set_wrprotect(src, addr, src_pte); + entry = huge_pte_wrprotect(entry); }

page_dup_rmap(ptepage, true); _

Patches currently in -mm which might be from peterx@redhat.com are

mm-gup_benchmark-support-threading.patch mm-gup-pack-has_pinned-in-mmf_has_pinned-fix.patch userfaultfd-selftests-use-user-mode-only.patch userfaultfd-selftests-remove-the-time-check-on-delayed-uffd.patch userfaultfd-selftests-dropping-verify-check-in-locking_thread.patch userfaultfd-selftests-only-dump-counts-if-mode-enabled.patch userfaultfd-selftests-unify-error-handling.patch mm-thp-simplify-copying-of-huge-zero-page-pmd-when-fork.patch mm-userfaultfd-fix-uffd-wp-special-cases-for-fork.patch mm-userfaultfd-fix-a-few-thp-pmd-missing-uffd-wp-bit.patch mm-userfaultfd-fail-uffd-wp-registeration-if-not-supported.patch mm-pagemap-export-uffd-wp-protection-information.patch userfaultfd-selftests-add-pagemap-uffd-wp-test.patch