From: Gerald Schaefer Date: Mon, 18 Sep 2017 14:51:51 +0000 (+0200) Subject: s390/mm: fix write access check in gup_huge_pmd() X-Git-Tag: v3.2.97~84 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c87f2285d0f94bbb594c2d768143e2569697df02;p=thirdparty%2Fkernel%2Fstable.git s390/mm: fix write access check in gup_huge_pmd() commit ba385c0594e723d41790ecfb12c610e6f90c7785 upstream. The check for the _SEGMENT_ENTRY_PROTECT bit in gup_huge_pmd() is the wrong way around. It must not be set for write==1, and not be checked for write==0. Fix this similar to how it was fixed for ptes long time ago in commit 25591b070336 ("[S390] fix get_user_pages_fast"). One impact of this bug would be unnecessarily using the gup slow path for write==0 on r/w mappings. A potentially more severe impact would be that gup_huge_pmd() will succeed for write==1 on r/o mappings. Signed-off-by: Gerald Schaefer Signed-off-by: Martin Schwidefsky [bwh: Backported to 3.2: - Segment flag names are different - Adjust context] Signed-off-by: Ben Hutchings --- diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c index 4ccf9f54355ea..65dcae761da9b 100644 --- a/arch/s390/mm/gup.c +++ b/arch/s390/mm/gup.c @@ -51,13 +51,12 @@ static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr, static inline int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr, unsigned long end, int write, struct page **pages, int *nr) { - unsigned long mask, result; struct page *head, *page, *tail; + unsigned long mask; int refs; - result = write ? 0 : _SEGMENT_ENTRY_RO; - mask = result | _SEGMENT_ENTRY_INV; - if ((pmd_val(pmd) & mask) != result) + mask = (write ? _SEGMENT_ENTRY_RO : 0) | _SEGMENT_ENTRY_INV; + if ((pmd_val(pmd) & mask) != 0) return 0; VM_BUG_ON(!pfn_valid(pmd_val(pmd) >> PAGE_SHIFT));