From: Greg Kroah-Hartman Date: Sun, 6 Mar 2022 10:47:32 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.9.305~28 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bde7ac62f7a74723a75560211f25703ac2603746;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: memfd-fix-f_seal_write-after-shmem-huge-page-allocated.patch --- diff --git a/queue-4.9/memfd-fix-f_seal_write-after-shmem-huge-page-allocated.patch b/queue-4.9/memfd-fix-f_seal_write-after-shmem-huge-page-allocated.patch new file mode 100644 index 00000000000..fcaff7697d0 --- /dev/null +++ b/queue-4.9/memfd-fix-f_seal_write-after-shmem-huge-page-allocated.patch @@ -0,0 +1,75 @@ +From f2b277c4d1c63a85127e8aa2588e9cc3bd21cb99 Mon Sep 17 00:00:00 2001 +From: Hugh Dickins +Date: Fri, 4 Mar 2022 20:29:01 -0800 +Subject: memfd: fix F_SEAL_WRITE after shmem huge page allocated + +From: Hugh Dickins + +commit f2b277c4d1c63a85127e8aa2588e9cc3bd21cb99 upstream. + +Wangyong reports: after enabling tmpfs filesystem to support transparent +hugepage with the following command: + + echo always > /sys/kernel/mm/transparent_hugepage/shmem_enabled + +the docker program tries to add F_SEAL_WRITE through the following +command, but it fails unexpectedly with errno EBUSY: + + fcntl(5, F_ADD_SEALS, F_SEAL_WRITE) = -1. + +That is because memfd_tag_pins() and memfd_wait_for_pins() were never +updated for shmem huge pages: checking page_mapcount() against +page_count() is hopeless on THP subpages - they need to check +total_mapcount() against page_count() on THP heads only. + +Make memfd_tag_pins() (compared > 1) as strict as memfd_wait_for_pins() +(compared != 1): either can be justified, but given the non-atomic +total_mapcount() calculation, it is better now to be strict. Bear in +mind that total_mapcount() itself scans all of the THP subpages, when +choosing to take an XA_CHECK_SCHED latency break. + +Also fix the unlikely xa_is_value() case in memfd_wait_for_pins(): if a +page has been swapped out since memfd_tag_pins(), then its refcount must +have fallen, and so it can safely be untagged. + +Link: https://lkml.kernel.org/r/a4f79248-df75-2c8c-3df-ba3317ccb5da@google.com +Signed-off-by: Hugh Dickins +Reported-by: Zeal Robot +Reported-by: wangyong +Cc: Mike Kravetz +Cc: Matthew Wilcox (Oracle) +Cc: CGEL ZTE +Cc: Kirill A. Shutemov +Cc: Song Liu +Cc: Yang Yang +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + mm/shmem.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2478,7 +2478,8 @@ static void shmem_tag_pins(struct addres + slot = radix_tree_iter_retry(&iter); + continue; + } +- } else if (page_count(page) - page_mapcount(page) > 1) { ++ } else if (!PageTail(page) && page_count(page) != ++ hpage_nr_pages(page) + total_mapcount(page)) { + radix_tree_tag_set(&mapping->page_tree, iter.index, + SHMEM_TAG_PINNED); + } +@@ -2538,8 +2539,8 @@ static int shmem_wait_for_pins(struct ad + page = NULL; + } + +- if (page && +- page_count(page) - page_mapcount(page) != 1) { ++ if (page && page_count(page) != ++ hpage_nr_pages(page) + total_mapcount(page)) { + if (scan < LAST_SCAN) + goto continue_resched; + diff --git a/queue-4.9/series b/queue-4.9/series index 02009dbeebf..c3e66293754 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -28,3 +28,4 @@ net-chelsio-cxgb3-check-the-return-value-of-pci_find.patch input-elan_i2c-move-regulator_able-out-of-elan_able_power.patch input-elan_i2c-fix-regulator-enable-count-imbalance-after-suspend-resume.patch hid-add-mapping-for-key_all_applications.patch +memfd-fix-f_seal_write-after-shmem-huge-page-allocated.patch