Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <alpine.LSU.2.11.2106011353270.2148@eggly.anvils> <alpine.LSU.2.11.2106011409390.2148@eggly.anvils>
In-Reply-To: <alpine.LSU.2.11.2106011409390.2148@eggly.anvils>
From:   Yang Shi <shy828301@gmail.com>
Date:   Thu, 3 Jun 2021 15:06:01 -0700
Message-ID: <CAHbLzkp0g5sveHfQoWQAWd6qfFaiNEVfYgFsBf7vOiMQm8uc8Q@mail.gmail.com>
Subject: Re: [PATCH 4/7] mm/thp: fix page_address_in_vma() on file THP tails
To:     Hugh Dickins <hughd@google.com>
Cc:     Andrew Morton <akpm@linux-foundation.org>,
        "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
        Wang Yugui <wangyugui@e16-tech.com>,
        Matthew Wilcox <willy@infradead.org>,
        Naoya Horiguchi <naoya.horiguchi@nec.com>,
        Alistair Popple <apopple@nvidia.com>,
        Ralph Campbell <rcampbell@nvidia.com>, Zi Yan <ziy@nvidia.com>,
        Miaohe Lin <linmiaohe@huawei.com>,
        Minchan Kim <minchan@kernel.org>, Jue Wang <juew@google.com>,
        Peter Xu <peterx@redhat.com>, Jan Kara <jack@suse.cz>,
        Linux MM <linux-mm@kvack.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Tue, Jun 1, 2021 at 2:11 PM Hugh Dickins <hughd@google.com> wrote:
>
> From: Jue Wang <juew@google.com>
>
> Anon THP tails were already supported, but memory-failure may need to use
> page_address_in_vma() on file THP tails, which its page->mapping check did
> not permit: fix it.
>
> hughd adds: no current usage is known to hit the issue, but this does fix
> a subtle trap in a general helper: best fixed in stable sooner than later.
>
> Fixes: 800d8c63b2e9 ("shmem: add huge pages support")
> Signed-off-by: Jue Wang <juew@google.com>
> Signed-off-by: Hugh Dickins <hughd@google.com>
> Cc: <stable@vger.kernel.org>

Reviewed-by: Yang Shi <shy828301@gmail.com>

> ---
>  mm/rmap.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/mm/rmap.c b/mm/rmap.c
> index 144de54efc1c..e05c300048e6 100644
> --- a/mm/rmap.c
> +++ b/mm/rmap.c
> @@ -716,11 +716,11 @@ unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
>                 if (!vma->anon_vma || !page__anon_vma ||
>                     vma->anon_vma->root != page__anon_vma->root)
>                         return -EFAULT;
> -       } else if (page->mapping) {
> -               if (!vma->vm_file || vma->vm_file->f_mapping != page->mapping)
> -                       return -EFAULT;
> -       } else
> +       } else if (!vma->vm_file) {
> +               return -EFAULT;
> +       } else if (vma->vm_file->f_mapping != compound_head(page)->mapping) {
>                 return -EFAULT;
> +       }
>
>         return vma_address(page, vma);
>  }
> --
> 2.32.0.rc0.204.g9fa02ecfa5-goog
>
>