Userspace PROT_NONE ptes set _PAGE_PRIVILEGED, triggering a false
positive debug assertion that __pte_flags_need_flush() is not called
on a kernel mapping.

Detect when it is a userspace PROT_NONE page by checking the required
bits of PAGE_NONE are set, and none of the RWX bits are set.
pte_protnone() is insufficient here because it always returns 0 when
CONFIG_NUMA_BALANCING=n.

Reported-by: Russell Currey <rus...@russell.cc>
Fixes: b11931e9adc1 ("powerpc/64s: add pte_needs_flush and 
huge_pmd_needs_flush")
Signed-off-by: Benjamin Gray <bg...@linux.ibm.com>
---
v2: removed an auto-import that slipped in

MRE (CONFIG_DEBUG_VM must be enabled):

int main(int argc, char **argv)
{
        char *buf = mmap(NULL, getpagesize(), PROT_WRITE, MAP_SHARED | 
MAP_ANONYMOUS, -1, 0);
        buf[0] = '1';
        mprotect(buf, getpagesize(), PROT_NONE);
        return 0;
}
---
 arch/powerpc/include/asm/book3s/64/tlbflush.h | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/include/asm/book3s/64/tlbflush.h 
b/arch/powerpc/include/asm/book3s/64/tlbflush.h
index 2bbc0fcce04a..5e26c7f2c25a 100644
--- a/arch/powerpc/include/asm/book3s/64/tlbflush.h
+++ b/arch/powerpc/include/asm/book3s/64/tlbflush.h
@@ -148,6 +148,11 @@ static inline void flush_tlb_fix_spurious_fault(struct 
vm_area_struct *vma,
         */
 }
 
+static inline bool __pte_protnone(unsigned long pte)
+{
+       return (pte & (pgprot_val(PAGE_NONE) | _PAGE_RWX)) == 
pgprot_val(PAGE_NONE);
+}
+
 static inline bool __pte_flags_need_flush(unsigned long oldval,
                                          unsigned long newval)
 {
@@ -164,8 +169,8 @@ static inline bool __pte_flags_need_flush(unsigned long 
oldval,
        /*
         * We do not expect kernel mappings or non-PTEs or not-present PTEs.
         */
-       VM_WARN_ON_ONCE(oldval & _PAGE_PRIVILEGED);
-       VM_WARN_ON_ONCE(newval & _PAGE_PRIVILEGED);
+       VM_WARN_ON_ONCE(!__pte_protnone(oldval) && oldval & _PAGE_PRIVILEGED);
+       VM_WARN_ON_ONCE(!__pte_protnone(newval) && newval & _PAGE_PRIVILEGED);
        VM_WARN_ON_ONCE(!(oldval & _PAGE_PTE));
        VM_WARN_ON_ONCE(!(newval & _PAGE_PTE));
        VM_WARN_ON_ONCE(!(oldval & _PAGE_PRESENT));

base-commit: 90dbf76e470bc4b973052a8f26ea43bae30f9aec
-- 
2.39.2

Reply via email to