s390/uv: Don't call folio_wait_writeback() without a folio reference

folio_wait_writeback() requires that no spinlocks are held and that
a folio reference is held, as documented. After we dropped the PTL, the
folio could get freed concurrently. So grab a temporary reference.

Fixes: 214d9bbcd3a6 ("s390/mm: provide memory management functions for protected KVM guests")
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Link: https://lore.kernel.org/r/20240508182955.358628-2-david@redhat.com
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>

diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c
index 265fea37e0308c3464d81e81eea47f1731f7dfde..016993e9eb72f670ea7673944a8af955f4f97edd 100644 (file)
--- a/arch/s390/kernel/uv.c
+++ b/arch/s390/kernel/uv.c
@@ -318,6 +318,13 @@ again:
                        rc = make_folio_secure(folio, uvcb);
                        folio_unlock(folio);
                }
+
+               /*
+                * Once we drop the PTL, the folio may get unmapped and
+                * freed immediately. We need a temporary reference.
+                */
+               if (rc == -EAGAIN)
+                       folio_get(folio);
        }
 unlock:
        pte_unmap_unlock(ptep, ptelock);
@@ -330,6 +337,7 @@ out:
                 * completion, this is just a useless check, but it is safe.
                 */
                folio_wait_writeback(folio);
+               folio_put(folio);
        } else if (rc == -EBUSY) {
                /*
                 * If we have tried a local drain and the folio refcount