diff mbox series

[5.15,052/124] arm64: mm: fix p?d_leaf()

Message ID	20220426081748.781082477@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Qian Cai <quic_qiancai@quicinc.com>, Muchun Song <songmuchun@bytedance.com>, Will Deacon <will@kernel.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.15 052/124] arm64: mm: fix p?d_leaf() Date: Tue, 26 Apr 2022 10:20:53 +0200 Message-Id: <20220426081748.781082477@linuxfoundation.org> In-Reply-To: <20220426081747.286685339@linuxfoundation.org> References: <20220426081747.286685339@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.15,002/124] block: remove __sync_blockdev [5.15,003/124] block: simplify the block device syncing code [5.15,004/124] vfs: make sync_filesystem return errors from ->sync_fs [5.15,005/124] xfs: return errors in xfs_fs_sync_fs [5.15,006/124] dma-mapping: remove bogus test for pfn_valid from dma_map_resource [5.15,007/124] arm64/mm: drop HAVE_ARCH_PFN_VALID [5.15,008/124] etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead [5.15,009/124] mm: page_alloc: fix building error on -Werror=array-compare [5.15,010/124] perf tools: Fix segfault accessing sample_id xyarray [5.15,011/124] mm, kfence: support kmem_dump_obj() for KFENCE objects [5.15,012/124] gfs2: assign rgrp glock before compute_bitstructs [5.15,013/124] scsi: ufs: core: scsi_get_lba() error fix [5.15,014/124] net/sched: cls_u32: fix netns refcount changes in u32_change() [5.15,015/124] ALSA: usb-audio: Clear MIDI port active flag after draining [5.15,016/124] ALSA: hda/realtek: Add quirk for Clevo NP70PNP [5.15,017/124] ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek [5.15,018/124] ASoC: topology: Correct error handling in soc_tplg_dapm_widget_create() [5.15,019/124] ASoC: rk817: Use devm_clk_get() in rk817_platform_probe [5.15,020/124] ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component [5.15,021/124] ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use [5.15,022/124] dmaengine: idxd: fix device cleanup on disable [5.15,023/124] dmaengine: imx-sdma: Fix error checking in sdma_event_remap [5.15,024/124] dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resou... [5.15,025/124] dmaengine: dw-edma: Fix unaligned 64bit access [5.15,026/124] spi: spi-mtk-nor: initialize spi controller after resume [5.15,027/124] esp: limit skb_page_frag_refill use to a single page [5.15,028/124] spi: cadence-quadspi: fix incorrect supports_op() return value [5.15,029/124] igc: Fix infinite loop in release_swfw_sync [5.15,030/124] igc: Fix BUG: scheduling while atomic [5.15,031/124] igc: Fix suspending when PTM is active [5.15,032/124] ALSA: hda/hdmi: fix warning about PCM count when used with SOF [5.15,033/124] rxrpc: Restore removed timer deletion [5.15,034/124] net/smc: Fix sock leak when release after smc_shutdown() [5.15,035/124] net/packet: fix packet_sock xmit return value checking [5.15,036/124] ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit() [5.15,037/124] ip6_gre: Fix skb_under_panic in __gre6_xmit() [5.15,038/124] net: restore alpha order to Ethernet devices in config [5.15,039/124] net/sched: cls_u32: fix possible leak in u32_init_knode() [5.15,040/124] l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upp... [5.15,041/124] ipv6: make ip6_rt_gc_expire an atomic_t [5.15,042/124] can: isotp: stop timeout monitoring when no first frame was sent [5.15,043/124] net: dsa: hellcreek: Calculate checksums in tagger [5.15,044/124] net: mscc: ocelot: fix broken IP multicast flooding [5.15,045/124] netlink: reset network and mac headers in netlink_dump() [5.15,046/124] drm/i915/display/psr: Unset enable_psr2_sel_fetch if other checks in intel_psr2_co... [5.15,047/124] net: stmmac: Use readl_poll_timeout_atomic() in atomic state [5.15,048/124] dmaengine: idxd: add RO check for wq max_batch_size write [5.15,049/124] dmaengine: idxd: add RO check for wq max_transfer_size write [5.15,050/124] dmaengine: idxd: skip clearing device context when device is read-only [5.15,051/124] selftests: mlxsw: vxlan_flooding: Prevent flooding of unwanted packets [5.15,052/124] arm64: mm: fix p?d_leaf() [5.15,053/124] ARM: vexpress/spc: Avoid negative array index when !SMP [5.15,054/124] reset: renesas: Check return value of reset_control_deassert() [5.15,055/124] reset: tegra-bpmp: Restore Handle errors in BPMP response [5.15,056/124] platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative [5.15,057/124] ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant [5.15,058/124] drm/msm/disp: check the return value of kzalloc() [5.15,059/124] arm64: dts: imx: Fix imx8*-var-som touchscreen property sizes [5.15,060/124] vxlan: fix error return code in vxlan_fdb_append [5.15,061/124] cifs: Check the IOCB_DIRECT flag, not O_DIRECT [5.15,062/124] net: atlantic: Avoid out-of-bounds indexing [5.15,063/124] mt76: Fix undefined behavior due to shift overflowing the constant [5.15,064/124] brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant [5.15,065/124] dpaa_eth: Fix missing of_node_put in dpaa_get_ts_info() [5.15,066/124] drm/msm/mdp5: check the return of kzalloc() [5.15,067/124] net: macb: Restart tx only if queue pointer is lagging [5.15,068/124] scsi: iscsi: Release endpoint ID when its freed [5.15,069/124] scsi: iscsi: Merge suspend fields [5.15,070/124] scsi: iscsi: Fix NOP handling during conn recovery [5.15,071/124] scsi: qedi: Fix failed disconnect handling [5.15,072/124] stat: fix inconsistency between struct stat and struct compat_stat [5.15,073/124] VFS: filename_create(): fix incorrect intent. [5.15,074/124] nvme: add a quirk to disable namespace identifiers [5.15,075/124] nvme-pci: disable namespace identifiers for the MAXIO MAP1002/1202 [5.15,076/124] nvme-pci: disable namespace identifiers for Qemu controllers [5.15,077/124] EDAC/synopsys: Read the error count from the correct register [5.15,078/124] mm/memory-failure.c: skip huge_zero_page in memory_failure() [5.15,079/124] memcg: sync flush only if periodic flush is delayed [5.15,080/124] mm, hugetlb: allow for "high" userspace addresses [5.15,081/124] oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup [5.15,082/124] mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() [5.15,083/124] ata: pata_marvell: Check the bmdma_addr beforing reading [5.15,084/124] dma: at_xdmac: fix a missing check on list iterator [5.15,085/124] dmaengine: imx-sdma: fix init of uart scripts [5.15,086/124] net: atlantic: invert deep par in pm functions, preventing null derefs [5.15,087/124] Input: omap4-keypad - fix pm_runtime_get_sync() error checking [5.15,088/124] scsi: sr: Do not leak information in ioctl [5.15,089/124] sched/pelt: Fix attach_entity_load_avg() corner case [5.15,090/124] perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled [5.15,091/124] drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised [5.15,092/124] drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare [5.15,093/124] KVM: PPC: Fix TCE handling for VFIO [5.15,094/124] drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage [5.15,095/124] powerpc/perf: Fix power9 event alternatives [5.15,096/124] powerpc/perf: Fix power10 event alternatives [5.15,097/124] perf script: Always allow field data_src for auxtrace [5.15,098/124] perf report: Set PERF_SAMPLE_DATA_SRC bit for Arm SPE event [5.15,099/124] xtensa: patch_text: Fixup last cpu should be master [5.15,100/124] xtensa: fix a7 clobbering in coprocessor context load/store [5.15,101/124] openvswitch: fix OOB access in reserve_sfa_size() [5.15,102/124] gpio: Request interrupts after IRQ is initialized [5.15,103/124] ASoC: soc-dapm: fix two incorrect uses of list iterator [5.15,104/124] e1000e: Fix possible overflow in LTR decoding [5.15,105/124] ARC: entry: fix syscall_trace_exit argument [5.15,106/124] arm_pmu: Validate single/group leader events [5.15,107/124] KVM: x86/pmu: Update AMD PMC sample period to fix guest NMI-watchdog [5.15,108/124] KVM: x86: Pend KVM_REQ_APICV_UPDATE during vCPU creation to fix a race [5.15,109/124] KVM: nVMX: Defer APICv updates while L2 is active until L1 is active [5.15,110/124] KVM: SVM: Flush when freeing encrypted pages even on SME_COHERENT CPUs [5.15,111/124] netfilter: conntrack: convert to refcount_t api [5.15,112/124] netfilter: conntrack: avoid useless indirection during conntrack destruction [5.15,113/124] ext4: fix fallocate to use file_modified to update permissions consistently [5.15,114/124] ext4: fix symlink file size not match to file content [5.15,115/124] ext4: fix use-after-free in ext4_search_dir [5.15,116/124] ext4: limit length to bitmap_maxbytes - blocksize in punch_hole [5.15,117/124] ext4, doc: fix incorrect h_reserved size [5.15,118/124] ext4: fix overhead calculation to account for the reserved gdt blocks [5.15,119/124] ext4: force overhead calculation if the s_overhead_cluster makes no sense [5.15,120/124] netfilter: nft_ct: fix use after free when attaching zone template [5.15,121/124] jbd2: fix a potential race while discarding reserved buffers after an abort [5.15,122/124] spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and controller [5.15,123/124] block/compat_ioctl: fix range check in BLKGETSIZE [5.15,124/124] arm64: dts: qcom: add IPA qcom,qmp property

Commit Message

Greg Kroah-Hartman April 26, 2022, 8:20 a.m. UTC

From: Muchun Song <songmuchun@bytedance.com>

[ Upstream commit 23bc8f69f0eceecbb87c3801d2e48827d2dca92b ]

The pmd_leaf() is used to test a leaf mapped PMD, however, it misses
the PROT_NONE mapped PMD on arm64.  Fix it.  A real world issue [1]
caused by this was reported by Qian Cai. Also fix pud_leaf().

Link: https://patchwork.kernel.org/comment/24798260/ [1]
Fixes: 8aa82df3c123 ("arm64: mm: add p?d_leaf() definitions")
Reported-by: Qian Cai <quic_qiancai@quicinc.com>
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Link: https://lore.kernel.org/r/20220422060033.48711-1-songmuchun@bytedance.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/include/asm/pgtable.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff mbox series

Patch

diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 08363d3cc1da..ed57717cd004 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -535,7 +535,7 @@  extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
 				 PMD_TYPE_TABLE)
 #define pmd_sect(pmd)		((pmd_val(pmd) & PMD_TYPE_MASK) == \
 				 PMD_TYPE_SECT)
-#define pmd_leaf(pmd)		pmd_sect(pmd)
+#define pmd_leaf(pmd)		(pmd_present(pmd) && !pmd_table(pmd))
 #define pmd_bad(pmd)		(!pmd_table(pmd))
 
 #define pmd_leaf_size(pmd)	(pmd_cont(pmd) ? CONT_PMD_SIZE : PMD_SIZE)
@@ -625,7 +625,7 @@  static inline unsigned long pmd_page_vaddr(pmd_t pmd)
 #define pud_none(pud)		(!pud_val(pud))
 #define pud_bad(pud)		(!pud_table(pud))
 #define pud_present(pud)	pte_present(pud_pte(pud))
-#define pud_leaf(pud)		pud_sect(pud)
+#define pud_leaf(pud)		(pud_present(pud) && !pud_table(pud))
 #define pud_valid(pud)		pte_valid(pud_pte(pud))
 
 static inline void set_pud(pud_t *pudp, pud_t pud)