]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
powerpc, mm: Fix mprotect on book3s 32-bit
authorDave Vasilevsky <dave@vasilevsky.ca>
Sun, 16 Nov 2025 06:40:46 +0000 (01:40 -0500)
committerMadhavan Srinivasan <maddy@linux.ibm.com>
Tue, 18 Nov 2025 07:04:17 +0000 (12:34 +0530)
commit78fc63ffa7813e33681839bb33826c24195f0eb7
tree6cc927aeda495eb8a0a652c987c7a4497770c992
parentfb2ff9fa72e20a75cab0ffc9dc8735de68ed4d0d
powerpc, mm: Fix mprotect on book3s 32-bit

On 32-bit book3s with hash-MMUs, tlb_flush() was a no-op. This was
unnoticed because all uses until recently were for unmaps, and thus
handled by __tlb_remove_tlb_entry().

After commit 4a18419f71cd ("mm/mprotect: use mmu_gather") in kernel 5.19,
tlb_gather_mmu() started being used for mprotect as well. This caused
mprotect to simply not work on these machines:

  int *ptr = mmap(NULL, 4096, PROT_READ|PROT_WRITE,
                  MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
  *ptr = 1; // force HPTE to be created
  mprotect(ptr, 4096, PROT_READ);
  *ptr = 2; // should segfault, but succeeds

Fixed by making tlb_flush() actually flush TLB pages. This finally
agrees with the behaviour of boot3s64's tlb_flush().

Fixes: 4a18419f71cd ("mm/mprotect: use mmu_gather")
Cc: stable@vger.kernel.org
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Dave Vasilevsky <dave@vasilevsky.ca>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20251116-vasi-mprotect-g3-v3-1-59a9bd33ba00@vasilevsky.ca
arch/powerpc/include/asm/book3s/32/tlbflush.h
arch/powerpc/mm/book3s32/tlb.c