diff options
| author | Gerald Schaefer <gerald.schaefer@de.ibm.com> | 2017-09-18 16:51:51 +0200 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2018-01-01 20:51:32 +0000 |
| commit | 7bb28761f47f58ad388383bf69048682124bac45 (patch) | |
| tree | 4975b6e4382253e58618c0a577b46f61277b971d /arch/s390/mm | |
| parent | 19d1b47bd177746dfa395cc9f88e8cb070bdc244 (diff) | |
s390/mm: fix write access check in gup_huge_pmd()
commit ba385c0594e723d41790ecfb12c610e6f90c7785 upstream.
The check for the _SEGMENT_ENTRY_PROTECT bit in gup_huge_pmd() is the
wrong way around. It must not be set for write==1, and not be checked for
write==0. Fix this similar to how it was fixed for ptes long time ago in
commit 25591b070336 ("[S390] fix get_user_pages_fast").
One impact of this bug would be unnecessarily using the gup slow path for
write==0 on r/w mappings. A potentially more severe impact would be that
gup_huge_pmd() will succeed for write==1 on r/o mappings.
Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'arch/s390/mm')
| -rw-r--r-- | arch/s390/mm/gup.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c index 639fce464008..21e925e9845a 100644 --- a/arch/s390/mm/gup.c +++ b/arch/s390/mm/gup.c @@ -51,13 +51,12 @@ static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr, static inline int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr, unsigned long end, int write, struct page **pages, int *nr) { - unsigned long mask, result; struct page *head, *page, *tail; + unsigned long mask; int refs; - result = write ? 0 : _SEGMENT_ENTRY_PROTECT; - mask = result | _SEGMENT_ENTRY_INVALID; - if ((pmd_val(pmd) & mask) != result) + mask = (write ? _SEGMENT_ENTRY_PROTECT : 0) | _SEGMENT_ENTRY_INVALID; + if ((pmd_val(pmd) & mask) != 0) return 0; VM_BUG_ON(!pfn_valid(pmd_val(pmd) >> PAGE_SHIFT)); |