diff options
| author |   Maarten Lankhorst <dev@lankhorst.se> | 2025-01-23 17:58:12 +0100 |
|---|---|---|
| committer | Maarten Lankhorst <dev@lankhorst.se> | 2025-01-23 17:58:12 +0100 |
| commit | 37ba6c7f4c69ee775dd3d3f84e45d9f89f1cf183 (patch) | |
| tree | eaa3fe68838f976ed4f6a3ca0dbb378a00f8ad16 /mm/hugetlb.c | |
| parent | drm/virtio: Fix UAF in virtgpu_dma_buf_free_obj() (diff) | |
| parent | Merge v6.13 into drm-next (diff) | |
| download | wireguard-linux-37ba6c7f4c69ee775dd3d3f84e45d9f89f1cf183.tar.xz wireguard-linux-37ba6c7f4c69ee775dd3d3f84e45d9f89f1cf183.zip | |
Merge remote-tracking branch 'drm/drm-next' into drm-misc-next-fixes
A regression was caused by commit e4b5ccd392b9 ("drm/v3d: Ensure job pointer is set to NULL
after job completion"), but this commit is not yet in next-fixes,
fast-forward it.
Try #2, first one didn't have v6.13 in it.
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
Diffstat (limited to 'mm/hugetlb.c')
| -rw-r--r-- | mm/hugetlb.c | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/mm/hugetlb.c b/mm/hugetlb.c index c498874a7170..eaaec19caa7c 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5402,6 +5402,7 @@ static void move_huge_pte(struct vm_area_struct *vma, unsigned long old_addr, unsigned long new_addr, pte_t *src_pte, pte_t *dst_pte, unsigned long sz) { + bool need_clear_uffd_wp = vma_has_uffd_without_event_remap(vma); struct hstate *h = hstate_vma(vma); struct mm_struct *mm = vma->vm_mm; spinlock_t *src_ptl, *dst_ptl; @@ -5418,7 +5419,18 @@ static void move_huge_pte(struct vm_area_struct *vma, unsigned long old_addr, spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING); pte = huge_ptep_get_and_clear(mm, old_addr, src_pte); - set_huge_pte_at(mm, new_addr, dst_pte, pte, sz); + + if (need_clear_uffd_wp && pte_marker_uffd_wp(pte)) + huge_pte_clear(mm, new_addr, dst_pte, sz); + else { + if (need_clear_uffd_wp) { + if (pte_present(pte)) + pte = huge_pte_clear_uffd_wp(pte); + else if (is_swap_pte(pte)) + pte = pte_swp_clear_uffd_wp(pte); + } + set_huge_pte_at(mm, new_addr, dst_pte, pte, sz); + } if (src_ptl != dst_ptl) spin_unlock(src_ptl); |