mirror of
https://github.com/torvalds/linux
synced 2024-10-08 04:12:40 +00:00
921d161f15
In copy_highpage() the `kto` and `kfrom` local variables are pointers to struct page, but these are used to hold arbitrary pointers to kernel memory . Each call to page_address() returns a void pointer to memory associated with the relevant page, and copy_page() expects void pointers to this memory. This inconsistency was introduced in commit2563776b41("arm64: mte: Tags-aware copy_{user_,}highpage() implementations") and while this doesn't appear to be harmful in practice it is clearly wrong. Correct this by making `kto` and `kfrom` void pointers. Fixes:2563776b41("arm64: mte: Tags-aware copy_{user_,}highpage() implementations") Signed-off-by: Tong Tiangen <tongtiangen@huawei.com> Acked-by: Mark Rutland <mark.rutland@arm.com> Reviewed-by: Kefeng Wang <wangkefeng.wang@huawei.com> Link: https://lore.kernel.org/r/20220420030418.3189040-3-tongtiangen@huawei.com Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
47 lines
1.2 KiB
C
47 lines
1.2 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* Based on arch/arm/mm/copypage.c
|
|
*
|
|
* Copyright (C) 2002 Deep Blue Solutions Ltd, All Rights Reserved.
|
|
* Copyright (C) 2012 ARM Ltd.
|
|
*/
|
|
|
|
#include <linux/bitops.h>
|
|
#include <linux/mm.h>
|
|
|
|
#include <asm/page.h>
|
|
#include <asm/cacheflush.h>
|
|
#include <asm/cpufeature.h>
|
|
#include <asm/mte.h>
|
|
|
|
void copy_highpage(struct page *to, struct page *from)
|
|
{
|
|
void *kto = page_address(to);
|
|
void *kfrom = page_address(from);
|
|
|
|
copy_page(kto, kfrom);
|
|
|
|
if (system_supports_mte() && test_bit(PG_mte_tagged, &from->flags)) {
|
|
set_bit(PG_mte_tagged, &to->flags);
|
|
page_kasan_tag_reset(to);
|
|
/*
|
|
* We need smp_wmb() in between setting the flags and clearing the
|
|
* tags because if another thread reads page->flags and builds a
|
|
* tagged address out of it, there is an actual dependency to the
|
|
* memory access, but on the current thread we do not guarantee that
|
|
* the new page->flags are visible before the tags were updated.
|
|
*/
|
|
smp_wmb();
|
|
mte_copy_page_tags(kto, kfrom);
|
|
}
|
|
}
|
|
EXPORT_SYMBOL(copy_highpage);
|
|
|
|
void copy_user_highpage(struct page *to, struct page *from,
|
|
unsigned long vaddr, struct vm_area_struct *vma)
|
|
{
|
|
copy_highpage(to, from);
|
|
flush_dcache_page(to);
|
|
}
|
|
EXPORT_SYMBOL_GPL(copy_user_highpage);
|