tree 35f65cdeb7c8e4ac8559ef289413b7f828fc9589
parent 8df5504f642af3d493fa2dc0a5748524520c82f3
author Linus Torvalds <torvalds@linux-foundation.org> 1541164962 +0000
committer ChromeOS Commit Bot <chromeos-commit-bot@chromium.org> 1542647957 +0000

BACKPORT: mremap: properly flush TLB before releasing the page

Commit eb66ae030829605d61fbef1909ce310e29f78821 upstream.

This is a backport to stable 4.4.y.

Jann Horn points out that our TLB flushing was subtly wrong for the
mremap() case.  What makes mremap() special is that we don't follow the
usual "add page to list of pages to be freed, then flush tlb, and then
free pages".  No, mremap() obviously just _moves_ the page from one page
table location to another.

That matters, because mremap() thus doesn't directly control the
lifetime of the moved page with a freelist: instead, the lifetime of the
page is controlled by the page table locking, that serializes access to
the entry.

As a result, we need to flush the TLB not just before releasing the lock
for the source location (to avoid any concurrent accesses to the entry),
but also before we release the destination page table lock (to avoid the
TLB being flushed after somebody else has already done something to that
page).

This also makes the whole "need_flush" logic unnecessary, since we now
always end up flushing the TLB for every valid entry.

Reported-and-tested-by: Jann Horn <jannh@google.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Tested-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[will: backport to 4.4 stable]
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

BUG=chromium:901801, b/118836219
TEST=Run PoC

Change-Id: I30d65ce79c4dc5a787583a6359933b609e6c7b48
[groeck: Backport to chromeos-3.18]
Signed-off-by: Guenter Roeck <groeck@chromium.org>
(cherry picked from commit a94cab0a4ad06bf806fed7a785029a6dfc7e1d8f)
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/1318540
Reviewed-by: Zubin Mithra <zsm@chromium.org>
(cherry picked from commit d904626f962b8c4d4cf3c35a42d5e523ca8c1c80)
Reviewed-on: https://chromium-review.googlesource.com/c/1342419